Privacy Policy

• Account data: your name, email address, and an encrypted password when you create an account.
• Profile data: the information you provide during onboarding — your regulatory lenses, employment status, immigration status, housing situation, benefits status, and any health or accessibility notes you choose to add.
• Situation data: the text you type into the Analyse or Draft tabs, and the contents of documents you upload (contracts, letters, notices).
• Usage data: the number of AI actions you use during your free trial and in each month of a subscription, and timestamps of your activity.
• Billing data: your plan, its status, trial and renewal dates, and the reference numbers Stripe gives your customer record and subscription. The card you save to start the free trial goes directly to Stripe and never reaches us.
• Generated output: the AI analyses, draft letters, and chat responses produced for you, stored so you can revisit them in My Record.

• To authenticate you and keep your data private to your account.
• To personalise the regulatory analysis to your specific situation and active lenses.
• To generate AI analyses and draft letters that cite the right UK legislation for your circumstances.
• To maintain a personal regulatory timeline (My Record) you can refer back to.
• To apply your plan's AI action limit during the 7-day free trial, 15 on Individual, 25 on Legal professional and 20 on Business, and the monthly allowance of your subscription.
• To take subscription payments and tell you when one is declined.
• To stop the free trial being taken again straight after an account is deleted. When you delete your account we keep a one-way hash of your email address, not the address itself, for 14 days. During that time the same email can't be used to sign up. After that the hash no longer applies and is deleted.
• To improve the quality and accuracy of the regulatory content we retrieve.

We do not sell your data. We share the minimum necessary with the following subprocessors to deliver the service:

• Supabase — database hosting and file storage, in the EU (Stockholm, eu-north-1). Your account, profile, analyses, timeline entries, and uploaded documents are stored here under Row Level Security so only you can read your own records.
• AWS — hosts the Quantum Lens application itself, in the UK (London, eu-west-2). Every request you make to the service passes through this infrastructure.
• Google — provides the Gemini AI model that generates your analyses and draft letters, and reads uploaded documents and images. Your situation text, question text and document contents are sent to Google for the purpose of generating a response, in line with their API usage terms.
• OpenAI — converts the text of your question or situation into a search embedding, so the most relevant UK legislation can be retrieved before your analysis is generated. Only this text is sent to OpenAI — not your uploaded documents.
• Pinecone — the vector database holding indexed UK legislation and regulatory text, used to retrieve relevant content before an analysis is generated. Your situation or question text is sent to Pinecone as a search query. This index is hosted in the United States, which means that query text is transferred outside the UK and EEA.
• Stripe — processes subscription payments. When you start the free trial, Stripe receives your email address and the card details you enter on its payment page, and keeps its own records of your payments under its privacy policy. Deleting your Quantum Lens account deletes your customer record in Stripe as well, though Stripe keeps records of past payments where the law requires it.
• Resend — would deliver any email we send you, per their terms. Quantum Lens does not currently send email: reminders and other notifications appear only inside the app. This will be updated if that changes.

Each subprocessor processes data only to provide the service function we request, and we do not authorise them to use your data for their own purposes.

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erasure — request that we delete your data, subject to legal retention obligations.
• Restrict or object to the processing of your data.
• Data portability — receive your data in a structured format.
• Withdraw consent at any time, where processing is consent-based.
• Lodge a complaint with the Information Commissioner's Office (ICO).

To exercise any of these rights, email support@quantumlens.co.uk and we will respond within one month.

If you have any questions about this policy or how your data is handled, contact us at support@quantumlens.co.uk.