Legal
Privacy Notice
Draft version · last updated 14 September 2026
In short: we collect the minimum personal data needed to run Qapacity — mainly your account details and the work you do in your workspace. We do not sell data or use advertising cookies. Requirements stay private to your organisation unless you choose to share them.
1.Who is responsible for your data
The data controller for personal data processed through the Qapacity website and platform is [Qapacity contracting entity — to be confirmed]. Registration details, registered address and, if appointed, data protection officer details will be added once confirmed.
Where a customer or provider organisation uploads personal data about its own staff or contacts into its workspace, that organisation may act as a controller and Qapacity may process that data on its behalf. [Controller/processor roles to be confirmed on review.]
2.How to contact us
For privacy questions or to exercise your rights, use the contact page, choose “General enquiry” and start your message with “Privacy”. [A dedicated privacy contact address will be added.]
3.Personal data we collect
| Category | Examples |
|---|---|
| Account data | Name, work email address, job title, password (stored only as a bcrypt hash). |
| Organisation and membership data | Organisation you belong to, your roles, invitations you send or accept, facilities you are assigned to. |
| Workspace content | Requirements, access requests, clarifications, quotes, documents and messages you create — which may incidentally contain personal data. |
| Contact enquiries | Enquiry type, name, email, organisation (optional) and message submitted through the contact form. |
| Correction submissions | The correction, any evidence, and your email address or account. |
| Security and usage records | Session records, IP address and browser user agent at sign-in, audit log entries of significant actions, rate-limit counters. |
| Facility contact data | Institutional contact details for facilities. We avoid personal details of individual scientists. |
We do not intentionally collect special category data. Please do not include it in requirements, documents or messages.
4.Purposes and lawful bases
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Creating and operating your account and organisation workspace | Contract, or legitimate interests where you act for an organisation |
| Matching requirements to facilities and coordinating access requests | Contract / legitimate interests |
| Keeping the service secure, preventing abuse, maintaining audit logs | Legitimate interests; legal obligation where applicable |
| Responding to contact enquiries and correction submissions | Legitimate interests |
| Sending service notifications about activity in your workspace | Contract / legitimate interests |
| Maintaining accurate facility information | Legitimate interests |
| Complying with legal obligations and establishing or defending legal claims | Legal obligation / legitimate interests |
5.Who we share data with
We use service providers (processors) who act on our instructions:
- Vercel — application hosting and content delivery.
- A managed PostgreSQL database provider — storage of application data and uploaded documents. [Provider to be named.]
- Anthropic — only where AI-assisted requirement structuring is enabled, the requirement text you submit for structuring is sent to Anthropic’s Claude API. See AI Use.
We share information with facility providers only when you choose to send them a request, and you review what will be shared first. We do not sell personal data or share it for advertising.
6.International transfers
Some processors may process data outside the UK, including in the United States. Where they do, we rely on appropriate safeguards such as UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework or the International Data Transfer Addendum. [Transfer mechanisms for each processor to be confirmed.]
7.How long we keep data
| Data | Retention |
|---|---|
| Account and workspace data | For as long as the account or organisation is active, then [period to be confirmed]. |
| Sessions | Up to 14 days, or until you sign out. |
| Contact enquiries | [Period to be confirmed] after the enquiry is resolved. |
| Correction submissions | Kept with the facility record history while it is relevant to the provenance of that information. |
| Audit logs | [Period to be confirmed] for security and legal purposes. |
8.Your rights
Under UK data protection law you have the right to:
- access your personal data;
- have inaccurate data corrected;
- have data erased in certain circumstances;
- restrict or object to processing, including processing based on legitimate interests;
- data portability where processing is based on contract or consent;
- withdraw consent at any time where processing is based on consent.
We will respond within one month, extendable where the law allows.
9.Complaints
Please contact us first so we can try to help. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk.
11.Automated processing
Qapacity uses automated rules — and, where enabled, AI — to suggest requirement criteria and to assess facilities against them. These outputs are suggestions reviewed by people. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
12.Security
See the security page for the measures we use to protect data.
13.Changes to this notice
We will update this notice when our processing changes and show the date of the latest version at the top of the page.
Questions about this document? Use the contact page.