Privacy policy
Effective from [Date]
1. Who we are
PQQ Generator is operated by PQQ Generator, a company registered in England and Wales (company number [Company number]) whose registered office is at [Registered office address]. We are registered with the Information Commissioner's Office (ICO) under number [ICO registration number].
For anything about this policy or your personal data, email support@pqqgenerator.com.
2. Our role
We are the controller of the personal data we need to run your account: your name, email address, sign-in activity, billing details and how you use the service.
The content your organisation adds (company profile, knowledge library documents, questionnaires and answers) may include personal data about other people, such as staff CVs or client reference contacts. For that content, your organisation is the controller and we act as its processor, using it only to provide the service. A data processing agreement is available on request.
3. What we collect
| Data | Examples |
|---|---|
| Account data | Name, email address, organisation membership and role, sign-in times |
| Workspace content | Company profile, text extracted from documents you upload, questionnaires, drafted and edited answers. We keep the extracted text, not the original files. |
| Billing data | Plan, subscription status, billing name and address, VAT number. Card details are handled by Stripe and never reach our servers. |
| Usage data | Records of AI requests (time, model, size and cost, but not their content), questionnaires created, plan limits used |
| Technical data | Error reports (browser type, page, error details) and server logs (which include IP addresses) kept by our hosting provider |
4. Why we use it, and our lawful basis
- To provide the service: creating your account, drafting answers, exporting documents, managing your team. Lawful basis: performance of our contract with you.
- To take payment and keep accounts. Lawful basis: contract and legal obligation (tax and accounting records).
- To keep the service secure and working: preventing abuse, enforcing fair-use limits, fixing errors. Lawful basis: our legitimate interests in running a reliable, secure service.
- To contact you about your account: service and billing emails such as your welcome email, “draft ready” notifications, trial reminders, payment problems and support replies. Lawful basis: contract.
- To send tips and product updates, only if you opt in on your dashboard. If you do, we share your name, email, plan and how you use the service (for example, questionnaires uploaded) with Klaviyo so the emails are relevant. Lawful basis: your consent. You can opt out at any time from your dashboard or the unsubscribe link in any marketing email; we then stop sending marketing emails.
We do not sell your data, and we do not use your workspace content to train AI models.
5. How the AI features handle your content
To read questionnaires and draft answers, we send the relevant questionnaire text, company profile and knowledge library text to OpenRouter, which routes the request to an AI model provider. For every request we instruct OpenRouter to use only providers that, under OpenRouter's policies, do not collect or retain your data to train models. The content is used only to generate the response returned to you.
AI-generated answers can be wrong or incomplete. You should review every answer before you submit it to a buyer.
6. Who we share data with
We use the following suppliers (sub-processors) to run the service. Each only receives the data it needs for its task.
| Supplier | Purpose | Location |
|---|---|---|
| Clerk | Sign-in and account management | USA |
| Stripe | Payments and invoicing | USA / Ireland |
| Neon | Database hosting | USA |
| Vercel | Application hosting | USA / global edge network |
| OpenRouter and the AI model providers it routes to | Reading questionnaires and drafting answers | USA and other countries |
| Resend | Sending account and service emails | USA |
| Klaviyo | Marketing emails, only if you opt in | USA |
| Sentry | Error monitoring | USA |
We may also disclose data where the law requires it, or to a buyer of our business, who would be bound by this policy.
7. International transfers
Some of our suppliers store or process data outside the UK, mainly in the USA. Where they do, we rely on the UK Extension to the EU-US Data Privacy Framework where the supplier is certified, or on the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, so your data stays protected to UK standards.
8. How long we keep it
- Account data and workspace content: for as long as the account exists. When a user or organisation is deleted, its workspace content and usage records are deleted from our database.
- Billing records: 6 years after the end of the financial year they relate to, as required by HMRC.
- Error reports: up to 90 days.
- Backups: deleted data may remain in encrypted backups for a short period before being overwritten.
9. Cookies
We only use cookies that are strictly necessary to keep you signed in and to keep the service secure. We do not use advertising or analytics cookies, so we don't ask for cookie consent. If that changes, we will update this policy and ask first.
10. Security
Data is encrypted in transit and at rest by our hosting and database suppliers. Each organisation's data is kept separate and is only available to its members. Our error reports are configured not to include request bodies, cookies or IP addresses. Access to production systems is limited to staff who need it.
11. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data deleted
- restrict or object to how we use it
- receive your data in a portable format
Email support@pqqgenerator.com to use any of these rights. We will reply within one month. If your request is about content in an organisation's workspace, we may refer you to that organisation, as it is the controller.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put things right first.
12. Children
The service is for businesses and is not intended for anyone under 18.
13. Changes to this policy
We will post any changes on this page and update the effective date. If a change is significant, we will tell account holders by email before it takes effect.