Privacy Policy

• Account data: your name, email address, and an encrypted password when you create an account.
• Profile data: the information you provide during onboarding — your regulatory lenses, employment status, immigration status, housing situation, benefits status, and any health or accessibility notes you choose to add.
• Situation data: the text you type into the Analyse or Draft tabs, and the contents of documents you upload (contracts, letters, notices).
• Usage data: the number of analyses you run each month (to enforce free-tier limits) and timestamps of your activity.
• Generated output: the AI analyses, draft letters, and chat responses produced for you, stored so you can revisit them in My Record.

• To authenticate you and keep your data private to your account.
• To personalise the regulatory analysis to your specific situation and active lenses.
• To generate AI analyses and draft letters that cite the right UK legislation for your circumstances.
• To maintain a personal regulatory timeline (My Record) you can refer back to.
• To enforce the 5-analysis limit during the 7-day free trial.
• To improve the quality and accuracy of the regulatory content we retrieve.

We do not sell your data. We share the minimum necessary with the following subprocessors to deliver the service:

• Supabase — database hosting and file storage, in the EU (Stockholm, eu-north-1). Your account, profile, analyses, timeline entries, and uploaded documents are stored here under Row Level Security so only you can read your own records.
• AWS — hosts the Quantum Lens application itself, in the UK (London, eu-west-2). Every request you make to the service passes through this infrastructure.
• Google — provides the Gemini AI model that generates your analyses and draft letters, and reads uploaded documents and images. Your situation text, question text and document contents are sent to Google for the purpose of generating a response, in line with their API usage terms.
• OpenAI — converts the text of your question or situation into a search embedding, so the most relevant UK legislation can be retrieved before your analysis is generated. Only this text is sent to OpenAI — not your uploaded documents.
• Pinecone — the vector database holding indexed UK legislation and regulatory text, used to retrieve relevant content before an analysis is generated. Your situation or question text is sent to Pinecone as a search query. This index is hosted in the United States, which means that query text is transferred outside the UK and EEA.
• Resend — would deliver any email we send you, per their terms. Quantum Lens does not currently send email: reminders and other notifications appear only inside the app. This will be updated if that changes.

Each subprocessor processes data only to provide the service function we request, and we do not authorise them to use your data for their own purposes.

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erasure — request that we delete your data, subject to legal retention obligations.
• Restrict or object to the processing of your data.
• Data portability — receive your data in a structured format.
• Withdraw consent at any time, where processing is consent-based.
• Lodge a complaint with the Information Commissioner's Office (ICO).

To exercise any of these rights, email hello@quantumlens.co.uk and we will respond within one month.

If you have any questions about this policy or how your data is handled, contact us at hello@quantumlens.co.uk.