Legal information
Privacy notice
Last updated: 10 October 2026
PrivacyStead is responsible for personal information collected through this website, the early access list and direct enquiries. Contact us at PrivacyStead@pm.me.
Information we collect
- Your email address when you join the early access list or contact us.
- Workspace user information, including name, work email address, role, account status and sign-in timestamps.
- Information entered into a workspace, such as requester and departmental contact details, case notes, assignments, deadlines and audit events.
- Technical and security information routinely generated when the service is used, such as IP address, device or browser details, timestamps and diagnostic logs.
The public FOI and EIR calculator performs calculations in your browser. Dates and case information entered into the calculator are not sent to PrivacyStead.
Why we use personal information
| Purpose | Typical lawful basis |
|---|---|
| Provide and secure user accounts and the requested service | Contract or steps requested before entering a contract; legitimate interests in operating a secure service |
| Operate an organisation’s information rights workspace | The customer organisation determines its lawful basis. PrivacyStead normally acts as its processor under written instructions. |
| Respond to enquiries and administer early access | Consent where required for electronic marketing; otherwise legitimate interests in responding to requested communications |
| Prevent misuse, diagnose faults and protect the service | Legitimate interests in service security and reliability; legal obligation where applicable |
| Meet legal, regulatory or accounting requirements | Legal obligation |
Where we rely on legitimate interests, those interests are operating, improving and securing PrivacyStead and responding to people who contact us. We consider the necessity and effect of the processing before relying on this basis.
Customer workspace data
For personal information entered by a customer organisation into its workspace, that organisation is generally the controller and decides why the information is used, how long it is kept and how individual rights requests are handled. PrivacyStead acts as a processor and follows the organisation’s documented instructions. Individuals should normally contact the relevant organisation first about information contained in its cases.
Who receives information
We use service providers needed to run the prototype, including Vercel for application hosting, Neon for managed database services, Resend for transactional email and Proton Mail for correspondence. Professional advisers, regulators or law enforcement may receive information where this is necessary and lawful. We do not sell personal information.
International transfers
Some service providers may process information outside the UK. Where UK data protection law requires a transfer safeguard, we use an applicable adequacy regulation or contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum. Customer contracts should record the locations and safeguards that apply to the production service.
How long we keep information
- Early access details are kept until you unsubscribe, ask for deletion or the early access programme ends and the information is no longer needed.
- Enquiry correspondence is normally reviewed for deletion after 24 months.
- Workspace account and case information is retained according to the customer organisation’s instructions, contractual terms and configured retention schedule.
- Security and diagnostic logs are kept only for the period needed to investigate incidents, maintain the service and meet legal obligations.
Backups and provider logs may take a limited additional period to expire after deletion from the live service.
Your rights
Depending on the circumstances and lawful basis, you may have rights to be informed, access your information, correct inaccurate information, request erasure or restriction, object to processing and receive portable information. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You also have rights relating to solely automated decisions; PrivacyStead does not currently make such decisions about website visitors or workspace users.
To exercise a right relating to this website, contact PrivacyStead@pm.me. You may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
Updates
We will update this notice when the product, providers or processing purposes change. Material changes will be brought to affected users’ attention where appropriate.