Privacy
What we hold about you, and why
This privacy policy covers uksrs.org.uk and the one account that serves every site in the UK SRS family.
Reading needs no account, and a reader who never signs in leaves very little with us.
If you sign in, we hold your name, surname, email address, your organisation, and your activity and conversations in the workspace, including what the assistant remembers. Every one of those is set out below, with who handles it, why, and for how long.
Who we are
The controller
Fractional Quest Ltd, company no. 17322105, 71–75 Shelton Street, London WC2H 9JQ, is the data controller for everything on this page.
Write to us at hello@uksrs.org.uk about anything here, or to use any of the rights below.
We do not sell personal data, and we do not use it to train any model.
Scope
One account, ten sites
There is one account for the whole UK SRS family, and it is made and held here, on uksrs.org.uk.
The other nine sites (sustainabilityreportingstandards.co.uk, srsreport.co.uk, srsreport.com, uksrsreport.co.uk, uksrs.finance, secr.quest, srs.credit, srs.green and carbon.legal) have no sign-in of their own.
Each of them has its own privacy page for what that site does itself, such as whether it loads analytics, and points here for the account.
Signing in here does not sign you in on the others: no cookie of ours crosses from one domain to another.
Reading the site
If you never sign in
We do not know who you are, and nothing you read is tied to you.
Analytics. We count page views with Google Analytics, which sets cookies only if you accept the cookie notice. Until you accept, Google Analytics still loads, with Google Consent Mode set to denied: it stores nothing on your device and sends no identifier, but it does make a request, so Google sees your IP address as it would for any file a page fetches.
The cookie notice. Your answer is kept in your browser’s local storage under the key cookie-consent, whichever answer you give, so we do not ask again. It never leaves your device.
Hosting. Vercel, which hosts this site, logs each request (IP address, browser, page and time) to keep the site secure and working.
Booking a call. Our booking page embeds Cal.com’s calendar, loaded from app.cal.com. If you book, the name, email address and notes you enter go to Cal.com, under Cal.com’s own privacy policy, and to us, so we can hold the call.
Email. If you write to us, we keep your message and our reply so we can answer you. No fixed period is set for deleting them; ask and we will.
The old newsletter form. An earlier newsletter sign-up stored the email address, IP address, browser and referring page of anyone who used it. No page offers it now. If you signed up, those details stay in our database until you ask us to delete them.
Why we may. Analytics cookies rest on your consent (UK GDPR Article 6(1)(a)), which you give or refuse in the cookie notice. Hosting logs, bookings, emails and newsletter details rest on our legitimate interests in running a secure site and answering what you asked us for (Article 6(1)(f)).
We count page views with Google Analytics. It sets cookies only if you accept. Until you do, it still loads but stores nothing on your device and sends no identifier, though Google sees your IP address. Whichever you choose, your answer is kept in your browser, so we do not ask again. Reading needs no account. If you sign in, your account holds your name and surname, email address and organisation, and your activity and conversations in the member app.
Signing in
What an account holds
Each row is one kind of data, with what it is, why we hold it, the lawful basis under UK GDPR Article 6(1), who processes it for us, and how long we keep it.
Your sign-in
Your email address, the name you gave when you signed up (your email address stands in for it if you left it blank, or the name on your Google account), whether your address is verified, how you sign in (with a password or with Google), and your signed-in sessions, which the sign-in service records with the IP address and browser each came from.
Why. To create your account, sign you in, and send the codes that verify your address and reset a forgotten password.
Lawful basis. Contract — Article 6(1)(b): we cannot give you an account without it.
Who processes it. Neon, which hosts the sign-in service and sends the codes. Google, only if you choose to sign in with Google.
How long. Until you delete your account.
Your profile
Your first name, your surname, the name you want to be called, and your photo if you upload one.
Why. To show your name in the workspace, and to the colleagues in your organisation.
Lawful basis. Contract — Article 6(1)(b).
Who processes it. Neon, which hosts the database.
How long. Until you delete your data or your account.
Your organisation
The organisation you belong to and your role in it, requests to join, and invitations you send (which hold the colleague's email address). The organisation's own record holds its name, Companies House number, email domain and logo.
Why. To place you in your organisation. People in your organisation can see your name, email address and role.
Lawful basis. Contract — Article 6(1)(b).
Who processes it. Neon. Companies House, when you search for your company: that sends the company's name or number to the public register, and nothing about you.
How long. Your membership until you delete your data. An invitation nobody answered is deleted 90 days after it was sent, and a revoked one 30 days after it was revoked; an accepted one is kept as the record of how that person joined.
Your company record
The company you confirmed and the figures you give or tap to confirm (headcount, turnover, balance sheet, year end and others), with the history of every change, and which version of the workspace terms you ticked.
Why. To work out which reporting rules apply to your company and when. Colleagues in your organisation, and any guest it invites, can read the record.
Lawful basis. Contract — Article 6(1)(b).
Who processes it. Neon. If you ask the assistant to read your company's filed accounts, Interfaze reads that public document from Companies House to pull out the figures; nothing about you is sent. If your organisation switches on its API or a webhook, the organisation's record (not your name) goes to whoever holds its key, or to the address it sets.
How long. Until you delete your data or your account.
Your activity and conversations
Your messages to the assistant and its replies, your threads and their titles, what you kept in your working file, your plan board and its history, the steps behind each reply, and the text of any tender you upload (never the file itself).
Why. To carry a conversation on where you left it and show you your work. Colleagues in your organisation, and invited guests, can read the organisation's conversations and working file.
Lawful basis. Contract — Article 6(1)(b).
Who processes it. Neon stores it. Vercel hosts the workspace and Railway runs the assistant. Each message, with the context the assistant needs, goes through the Vercel AI Gateway to the model that writes the reply (by default Anthropic's Claude).
How long. Until you delete your data or your account.
What the assistant remembers
Your own words, and the values you confirmed, held as a memory graph so the assistant can recall them in a later conversation. The assistant's replies are not sent to it, and neither is the text of a tender.
Why. So you do not have to repeat yourself.
Lawful basis. Contract — Article 6(1)(b).
Who processes it. Zep, our memory provider.
How long. Until you delete your data or your account; it is erased first, before anything else.
Company look-ups and Slack
When the assistant looks your company up in public sources, the company's name and website, which go to a search provider; nothing else about you is in the search. If your organisation connects Slack, the link between your Slack user and your account, and the Slack threads the assistant answers in.
Why. To suggest facts about your company for you to confirm, and to answer you in Slack as yourself.
Lawful basis. Contract — Article 6(1)(b).
Who processes it. Exa and Tavily, the search providers. CopilotKit, which relays Slack messages to the assistant and holds those threads. Slack holds the messages under your organisation's own agreement with Slack.
How long. The Slack link and the relayed threads until you delete your data or your account.
Service records
Traces of what the product did (timings, which tool ran, errors, and your account and thread IDs, but not the content of your messages), request logs (IP address, browser, page and time), counters of how many messages your account sent in a minute and in a day, and, if your organisation uses the API, a log line and a counter per request with its IP address.
Why. To keep the service secure and working, and to cap how much one account can spend.
Lawful basis. Legitimate interests — Article 6(1)(f): running a secure, reliable service.
Who processes it. Pydantic Logfire (traces), Vercel and Railway (request logs), Neon (the counters and the API log).
How long. API request lines for 90 days. Traces and request logs for the periods Logfire, Vercel and Railway set. The counters have no deletion period set yet. None of these is deleted with your account.
Checked against the product’s code on 1 October 2026.
The erasure list
Every store in the account, by its real name
This is the list the delete controls work from: every place the product keeps member data, with the name we use for it, so you can ask about any one of them.
| Store | What it holds |
|---|---|
member_object | Your company record — the company you confirmed, its number, your headcount, turnover, balance sheet, year end and anything else you have told us or tapped to confirm. |
member_object_changelog | The history of those figures: what each one was before you changed it, and when. It is an audit trail, so you can always see what you told us and when you corrected it. |
conversation_message | Your conversations with the assistant — your messages and its replies, kept so a conversation carries on where you left it. |
pinned_artefact | Anything you kept from a conversation into your working file. |
plan_task_status | Your plan board: which cards are on it, where you moved each one, the dates you set, who you assigned it to and your notes. |
plan_card_event | The history of that board — every move, so the board can show you how the work has gone. |
tender_document | The TEXT of any tender you uploaded, and its page numbers. We never keep the PDF itself. |
tender_requirement | What we extracted from that tender — the requirements, the quotes and where each one sits against your record. |
member_profile | Your name, what you asked us to call you, and your photo if you uploaded one. |
member_thread | Your threads — the separate conversations you have going, and their titles. |
thread_hidden | Which threads you dismissed, so they stay out of your list. |
conversation_recovery | A reply that was still being written when something interrupted it, so it is not lost when you come back. |
copilot_thread_run | The run behind a reply — the steps taken to answer you, kept so a conversation can be replayed where it left off rather than started again. |
plan_card_checkpoint | How far through a plan card you are. |
channel_identity | The link between your Slack user and your account, if your organisation connected one, so a question asked in a channel is answered as you. |
organisation_member | Which organisations you belong to, and your role in each. |
organisation_join_request | Any request you made to join an organisation, and whether it was decided. |
user_active_organisation | Which of your organisations you were last working in. |
zep graph (words + tapped facts) | A memory of what you have said, held by Zep, our memory provider, so the assistant recalls it in a later conversation. Your words and the values you confirmed go there. The text of a tender does not, and the PDF never existed to send. |
neon_auth.user | Your sign-in: your email address, whether it is verified, and how you sign in — with a password, or with Google. |
Outside this list sit the service records in the last row of the table above: traces, request logs, the daily count of your messages and, for organisations using the API, the request log.
Who else sees it
Processors, colleagues and transfers
Neon hosts the database and the sign-in service, and sends your verification and password-reset codes.
Vercel hosts the site and the workspace, and Railway runs the assistant.
The Vercel AI Gateway carries each message, with the context the assistant needs, to the model that writes the reply; by default that is Anthropic’s Claude.
Zep holds the memory graph: your words and the values you confirmed. The assistant’s own replies are never sent to it.
Pydantic Logfire receives traces of what the product did, such as how long a step took and which tool ran, with your account and thread IDs. Message content is switched off (include_content=False), so your words are not in them.
When the assistant looks your company up in public sources, the company’s name and website go to Exa or Tavily, the search providers; nothing else about you is in the search.
We look your company up on the Companies House public register when you search for it; that sends the company’s name or number and nothing about you.
If you ask the assistant to read your company’s filed accounts, Interfaze reads that public document from Companies House to pull out the figures; nothing about you is sent.
Google receives your sign-in only if you choose “Continue with Google”.
If your organisation connects Slack, CopilotKit relays the Slack messages to the assistant and holds those threads; Slack keeps the messages under your organisation’s own agreement with Slack.
Your colleagues. People in your organisation, and any guest it invites, can read its company record, conversations and working file, and can see your name, email address and role.
Transfers. Several of these providers are based in, or process data in, the United States, so your data may be processed outside the UK. Ask us and we will tell you the safeguard that covers each transfer.
Keeping and deleting
How long, and what “delete” means
We keep what the account holds until you delete it. There is no expiry.
Delete everything we hold about you, under Settings → Privacy, removes every store in the list above, including the change history, which is deleted with the rest rather than kept. It leaves your sign-in, so signing in again gives you an empty account.
Delete account, under Settings → Account, does all of that and then removes the sign-in. If the sign-in service refuses that last step, the screen tells you, and we will finish it if you ask.
Both ask you to type DELETE, and neither can be undone.
The memory is erased first. Something you have just told the assistant takes a few minutes to be processed into its memory. If you delete during that window, we erase the memory graph before anything else, and if that cannot be confirmed we stop and delete nothing.
What outlives your account. Two stores are not deleted with you, and each has a period that the code enforces when it writes a new row:
| Store | What it holds | Kept |
|---|---|---|
api_request_log | If your organisation uses the API, a line per request: which key, which endpoint, when, and the IP address it came from. It is how we can tell a key has been abused or leaked. | 90 days from the request, then the row is deleted. |
organisation_invite | An invitation someone sent to a colleague's email address. It belongs to the organisation rather than to the person who sent it, so it survives them leaving — revoking a pending invite because somebody else deleted their account would take away a third party's access. | An accepted invite is kept as the record of how that person joined. One nobody answered is deleted 90 days after it was sent; a revoked one, 30 days after it was revoked. |
Service records (traces and request logs) are kept for the periods Logfire, Vercel and Railway set, and are not deleted with your account.
The counters of how many messages an account sent in a minute or a day, and of API requests per IP address, have no deletion period set yet.
Your rights
What you can do, and how
Most of it you can do yourself, in Settings, without asking us:
- See and correct: every figure on your company record can be edited, and the old value stays in the history.
- Export: Settings → Privacy → Export as JSON downloads your email, profile, organisation and company record. It does not include your conversations or the assistant's memory; ask us for those and we will send them.
- Delete your data: Settings → Privacy → Delete everything we hold about you erases every store in the account, the assistant's memory first. It leaves your sign-in, so signing in again gives you an empty account.
- Delete your account: Settings → Account → Delete account does all of that and then removes your sign-in. If the sign-in service refuses that last step, the screen says so and you can ask us to finish it.
You also have the right to a copy of everything we hold (UK GDPR Article 15), to have it corrected (Article 16), erased (Article 17) or given to you in a machine-readable form (Article 20), and to object to what we do on the basis of legitimate interests (Article 21).
Write to hello@uksrs.org.uk for any of these.
To complain, tell us first: under section 164A of the Data Protection Act 2018 we must acknowledge your complaint within 30 days and tell you the outcome.
You can also complain to the Information Commissioner under section 165, through the ICO’s complaint page.
Cookies
What is stored on your device
The rule is regulation 6 of PECR: nothing is stored on your device without your consent, unless it is strictly necessary for a service you asked for (Schedule A1, paragraph 4).
| What | Set by | When | Why |
|---|---|---|---|
| Google Analytics cookies | Only after you accept | To count page views. | |
cookie-consent | This site, in local storage | When you answer the notice | To remember your answer. Strictly necessary. |
uksrs-sbt-steps | This site, in local storage | When you tick a step on the science-based targets guide | To remember your ticks. It never leaves your device. |
| A draft question | The workspace, in session storage | When you send a tender to the chat | To carry your question to the chat. It is removed as soon as the chat reads it. |
| Sign-in session cookies | Neon Auth, for this site | When you sign in | To keep you signed in. Strictly necessary, so not optional. |
| Whatever Cal.com stores for its calendar | Cal.com, inside its embedded calendar | Only on the booking page | To run the booking calendar you opened, under Cal.com's own policy. |
Declining costs you nothing: every page works the same.
To change your answer, clear this site’s storage in your browser and the notice will ask again. A script already running cannot be recalled by a later Decline; the change takes effect on the next page.
Changes
When this page changes
When what the product does with your data changes, this page changes with it, and the date at the top moves.
The terms that go with the account are in the terms of service.
Sources
The law this rests on
The legislation behind your rights, the regulator you can complain to, and the public record of who we are.
- legislation.gov.ukUK GDPR, Article 6(1) — lawfulness of processing
The lawful bases named in the table: contract (b), legitimate interests (f), consent (a).
- legislation.gov.ukUK GDPR, Article 13 — information to be provided
What a privacy notice must tell you, which is the shape of this page.
- legislation.gov.ukUK GDPR, Article 15 — right of access
Your right to a copy of what we hold, beyond what the export button gives you.
- legislation.gov.ukUK GDPR, Article 16 — right to rectification
Correcting your figures and profile.
- legislation.gov.ukUK GDPR, Article 17 — right to erasure
What the two delete controls carry out.
- legislation.gov.ukUK GDPR, Article 20 — right to data portability
Why the export is machine-readable.
- legislation.gov.ukUK GDPR, Article 21 — right to object
Objecting to processing on legitimate interests.
- legislation.gov.ukData Protection Act 2018, section 164A — complaints to controllers
Your right to complain to us, and our duty to acknowledge it within 30 days.
- legislation.gov.ukData Protection Act 2018, section 165 — complaints to the Commissioner
Your right to complain to the regulator.
- legislation.gov.ukPECR 2003 (SI 2003/2426), regulation 6
Storing or reading anything on your device needs consent, subject to Schedule A1.
- legislation.gov.ukPECR 2003, Schedule A1 paragraph 4 — strictly necessary storage
Why the sign-in cookie and the record of your cookie choice need no consent.
- Information Commissioner's OfficeMake a complaint
Where to complain about how we handle your data.
- Information Commissioner's OfficeCookies and similar technologies
The regulator's guidance on consent for device storage.
- Companies HouseFractional Quest Ltd — company 17322105
The public record of who the controller is.