MiQSBack to home

Privacy Policy

Last updated: [[DATE]]

Who we are

MiQS is provided by [[LEGAL ENTITY NAME]] (company number [[COMPANY NUMBER]]), registered office [[REGISTERED ADDRESS]] ("MiQS", "we", "us"). We are registered with the UK Information Commissioner's Office, registration number [[ICO REGISTRATION NUMBER]].

What personal data we collect

  • Account data: name, email address, role within your company account
  • Usage data: which projects and CVR periods you access, timestamps of actions you take (uploads, generations, resolutions) — kept for audit purposes within your company account
  • We do not collect payment card data directly; if you pay by card this is handled by our payment processor, who has their own privacy notice

We do not collect special category data about individuals. The commercial and cost data you upload as part of using MiQS (project costs, contract values, change events) belongs to your company and is not personal data about you — it's your company's business data, which we process on your company's behalf (see the Data Processing Agreement).

Why we process it and our legal basis

  • To provide the MiQS service you've signed up for (performance of a contract)
  • To secure your account and prevent misuse (legitimate interests)
  • To meet our legal and regulatory obligations

Who we share it with

  • Supabase — our database and authentication provider, hosting your account and project data
  • [[AI PROVIDER NAME(S)]] — the AI provider(s) used to generate CVR narrative commentary. Only the project data relevant to the specific request is sent (cost movements, change register entries, programme status); it is not used to train the provider's models
  • We do not sell personal data, and we do not share it with third parties for their own marketing purposes

Where your data is stored

[[STATE WHETHER DATA IS STORED IN THE UK/EU OR ELSEWHERE, AND SAFEGUARDS IF OUTSIDE THE UK — this depends on your Supabase project region and your AI provider's data residency, confirm both before publishing.]]

How long we keep it

  • Account data: for as long as your company account is active, plus [[X]] after closure for legal/accounting purposes
  • Project and CVR data: for the duration of your company's subscription. Account closure and deletion is currently handled manually — your company's owner contacts us at [[CONTACT EMAIL]], we provide an export where requested, and we then delete the company's data within [[X]] days unless we're required to retain it longer by law. There is no self-serve delete button today.

Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, or port your personal data, and to object to how we process it. To exercise any of these, contact [[CONTACT EMAIL]]. If you're not satisfied with our response, you can complain to the ICO (ico.org.uk).

Changes to this policy

We'll update this page when our processing changes and, where the change is material, notify company admins directly.

Contact: [[CONTACT EMAIL]]