Privacy Notice

1. Who we are

UIE Group is the data controller for personal data processed through UIE Systems (uiesystems.com), UIE Academy (uieacademy.com), and Q's operational surfaces (chat, briefings, audits). For any data-protection question, contact info@uieglobal.com.

2. What personal data we collect

The personal data we collect and process about you includes:

• Account data: email address, organisation name, principal URL (institutional tier signups)
• Authentication data: hashed session tokens issued by our auth provider (Supabase)
• Engagement data: chat messages you send to Q, audit subjects, world-model entries derived from your engagement
• Payment data: we receive billing event metadata from Stripe (status, tier, amount, currency, invoice status). We do not store card numbers or banking details ourselves — Stripe is the payment processor.
• Operational telemetry: IP address, user agent, and timestamps for security and rate-limiting; minimal session cookies for authentication

3. Why we process it (purposes and lawful bases)

• Performance of contract — to deliver the service you subscribed to: provisioning your tenant, running audits, maintaining your world model, processing payments.
• Legitimate interests — to secure the platform, prevent abuse, improve Q's general capability via aggregated, anonymised patterns, and to communicate operationally about your account.
• Legal obligation — to keep accounting and tax records for the periods UK law requires, and to respond to lawful regulatory or law-enforcement requests.
• Consent — for marketing communications outside the operational scope of your subscription, which you can withdraw at any time.

4. Who we share it with (processors)

We use third-party processors to deliver the service. Each is bound by a data-processing agreement and processes data only on our instructions:

• Supabase — managed Postgres, auth, storage (data infrastructure)
• Anthropic — Claude API powers Q's reasoning; chat content and audit subject matter are sent for model inference
• Stripe — payment processing (card data, invoicing)
• Resend — transactional email (sign-in links, welcome notes, billing receipts)
• Vercel — application hosting (front-end + webhook handlers)
• Railway — agent backend hosting (Q's audit and briefing pipeline)

5. Retention

We retain your data for the duration of your active subscription. After cancellation, we retain billing and engagement records for six years to meet UK accounting and tax requirements, after which they are deleted or anonymised. World-model artifacts associated with your engagement are deleted on request unless we are legally required to retain them.

6. International transfers

Some of our processors are based in the United States (Stripe, Anthropic, Supabase, Resend, Vercel). When data is transferred outside the UK we rely on the UK addendum to the EU Standard Contractual Clauses and adequacy decisions where they apply.

7. Your rights

Under UK GDPR you have the right to access your data, correct it, request erasure (subject to our retention obligations), object to processing, restrict processing, request portability of data you provided, and withdraw consent where it is the lawful basis. To exercise any right, email info@uieglobal.com. We respond within 30 days.

8. Cookies

We use only the cookies necessary to operate the service: session cookies for authentication and minimal analytics for error reporting. We do not use advertising or cross-site tracking cookies.

9. Complaints

If you believe we have not handled your data properly, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. We would appreciate the chance to address your concern first — email info@uieglobal.com.

10. Changes to this notice

We may update this notice from time to time. Material changes will be notified to your principal email and posted on this page with an updated "Effective" date.