ConsultCloud Privacy Policy

1. Who we are

Digital Works Nottingham Ltd is a company registered in England and Wales. We are the data controller for personal information collected through our marketing site and for account information collected through the ConsultCloud application. For client project data that customers upload into the application, we act as a data processor on behalf of the customer.

2. Information we collect

a. Information you provide

When you register, contact us, or use the application we may collect:

• Account details such as name, work email and company name
• Authentication credentials and session information
• Project content you upload: briefs, proposals, Statements of Work, rate cards, resource profiles, templates and any source material you add
• Communications with our support team

b. Information collected automatically

• IP address and approximate location
• Device, browser and operating system information
• Pages visited, features used and timestamps
• Cookies and similar technologies (see section 5)

c. Information from connected services

If you choose to connect a third-party service such as HubSpot or Xero, we receive the data needed to operate that integration (for example deals, contacts, companies or invoice records). You control which integrations are connected from within the application.

3. How we use information

• To provide, secure and improve the Services
• To generate AI outputs such as briefs, proposals, Statements of Work and resource matches at your request
• To send service notifications, billing communications and product updates
• To respond to support requests
• To detect, investigate and prevent misuse or security incidents
• To comply with legal and regulatory obligations

We do not sell personal information.

4. AI processing

Some features use third-party AI providers to generate content from the inputs you supply. We only send the content needed to fulfil the request. Customer content is not used by ConsultCloud to train foundation models. We require AI providers to operate under contractual terms that restrict use of customer content for model training where that option is available from the provider.

5. Cookies and analytics

We use a small number of essential cookies to keep you signed in, remember preferences and keep the Services secure. These are always active because the Services cannot work without them.

We use Google Analytics 4, provided by Google Ireland Limited, to measure how many people visit the marketing website, which pages they read and which calls to action they use. The analytics tag runs in a cookieless mode by default: until you select "Accept analytics" in our cookie banner, no analytics cookies or identifiers are stored on your device and only aggregated, non-identifying measurement signals are sent. Analytics cookies are set only after you accept, and IP addresses are anonymised. We do not use these cookies for advertising or profiling.

You can change or withdraw your choice at any time using the "Cookie settings" link in the footer of any page, or by clearing cookies and site data in your browser. Analytics data collected by Google may be transferred outside the UK and EEA under the standard contractual clauses in Google's data processing terms.

6. Sharing with third parties

We share personal information only with:

• Our platform host, which provides the underlying hosting, managed database, authentication and edge compute for ConsultCloud under a Data Processing Agreement.
• Paddle.com Market Ltd, our Merchant of Record, which processes payments, invoicing, VAT and other sales tax collection and remittance, fraud prevention and chargeback handling. Paddle acts as an independent data controller for transaction data it collects directly from buyers.
• Additional subprocessors for e-signature and AI generation.
• Integrations you have explicitly connected, such as HubSpot or Xero.
• Professional advisers where reasonably necessary.
• Authorities where required by law.

A consolidated list of subprocessors and a copy of our Data Processing Agreement are available on request. Open a privacy request.

7. International transfers

Some subprocessors may process data outside the United Kingdom or European Economic Area. Where this happens we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

8. Retention

We retain account and project data for as long as your account is active. When an account is closed, customer project data is deleted from active systems within 30 days and removed from routine backups within a further 60 days, unless retention is required by law.

9. Your rights

Under UK GDPR you can request access to your personal data, correction, deletion, restriction or portability, and you can object to certain processing. To make a request, open a privacy request. You also have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk).

10. Security

We apply organisational and technical controls to protect personal information, including encryption in transit, role-based access controls and continuous monitoring. No system can be guaranteed completely secure. See our Security Policy for more detail.

11. Children's privacy

The Services are intended for business users and are not directed at children. We do not knowingly collect personal information from children under 16.

12. Changes to this policy

We may update this policy from time to time. Significant changes will be notified through the application or by email to account holders.

13. Contact

For any questions about this Privacy Policy or your personal data, open a privacy request.