Legal
Privacy policy: what we collect, and why
SRS Report (srsreport.com) is an independent reference site on UK sustainability reporting, operated by Fractional Quest Ltd.
This policy explains what information we collect from visitors, why, and what choices you have.
What we collect
Very little, by design
We do not require account creation, and we run no advertising trackers on this site; the one analytics tag, Snitcher, is described under Cookies and analytics below.
Our hosting provider, Vercel, processes standard technical request data — IP address, browser type, pages requested — to serve the site and keep it secure; we do not collect or combine this into visitor profiles.
If you email us or book a call, we receive whatever you provide: your email address, and anything you tell us.
Call bookings are handled by Cal.com, a third-party scheduling service, and its handling of that data is governed by Cal.com’s own privacy policy.
The controller
| Detail | Record |
|---|---|
| Company | Fractional Quest Ltd |
| Company number | 17322105 |
| Address | 71–75 Shelton Street, London WC2H 9JQ |
| hello@uksrs.org.uk |
How we use it
Only to run the site and reply to you
We use what we receive solely to operate the site, respond to enquiries, arrange calls and correct errors readers report.
We do not sell, rent or share personal data with third parties for marketing purposes.
Hosting logs, bookings and emails rest on our legitimate interests in running a secure site and answering what you asked us for (UK GDPR Article 6(1)(f)).
No fixed period is set for deleting an email you send us; ask and we will delete it.
Accounts
There is no account on this site
This site has no sign-in, no registration and no member area.
The account for everything in the network lives on uksrs.org.uk.
Anything to do with that account — what it holds, for how long, and your rights over it — is covered by the hub’s own privacy policy, summarised in the next section.
Signing in
If you sign in on uksrs.org.uk
This site has no sign-in of its own.
The sign-in link in the header takes you to uksrs.org.uk, where the one account for this family of sites is made and held by Fractional Quest Ltd.
Signing in there does not sign you in here: no cookie crosses from uksrs.org.uk to this site.
If you make an account, it holds your name and surname, your email address, your organisation, and your activity and conversations in the member app, including what its assistant remembers.
Your sign-in
Your email address, the name you gave when you signed up (your email address stands in for it if you left it blank, or the name on your Google account), whether your address is verified, how you sign in (with a password or with Google), and your signed-in sessions, which the sign-in service records with the IP address and browser each came from.
Who processes it. Neon, which hosts the sign-in service and sends the codes. Google, only if you choose to sign in with Google.
How long. Until you delete your account.
Your profile
Your first name, your surname, the name you want to be called, and your photo if you upload one.
Who processes it. Neon, which hosts the database.
How long. Until you delete your data or your account.
Your organisation
The organisation you belong to and your role in it, requests to join, and invitations you send (which hold the colleague's email address). The organisation's own record holds its name, Companies House number, email domain and logo.
Who processes it. Neon. Companies House, when you search for your company: that sends the company's name or number to the public register, and nothing about you.
How long. Your membership until you delete your data. An invitation nobody answered is deleted 90 days after it was sent, and a revoked one 30 days after it was revoked; an accepted one is kept as the record of how that person joined.
Your company record
The company you confirmed and the figures you give or tap to confirm (headcount, turnover, balance sheet, year end and others), with the history of every change, and which version of the workspace terms you ticked.
Who processes it. Neon. If you ask the assistant to read your company's filed accounts, Interfaze reads that public document from Companies House to pull out the figures; nothing about you is sent. If your organisation switches on its API or a webhook, the organisation's record (not your name) goes to whoever holds its key, or to the address it sets.
How long. Until you delete your data or your account.
Your activity and conversations
Your messages to the assistant and its replies, your threads and their titles, what you kept in your working file, your plan board and its history, the steps behind each reply, and the text of any tender you upload (never the file itself).
Who processes it. Neon stores it. Vercel hosts the workspace and Railway runs the assistant. Each message, with the context the assistant needs, goes through the Vercel AI Gateway to the model that writes the reply (by default Anthropic's Claude).
How long. Until you delete your data or your account.
What the assistant remembers
Your own words, and the values you confirmed, held as a memory graph so the assistant can recall them in a later conversation. The assistant's replies are not sent to it, and neither is the text of a tender.
Who processes it. Zep, our memory provider.
How long. Until you delete your data or your account; it is erased first, before anything else.
Company look-ups and Slack
When the assistant looks your company up in public sources, the company's name and website, which go to a search provider; nothing else about you is in the search. If your organisation connects Slack, the link between your Slack user and your account, and the Slack threads the assistant answers in.
Who processes it. Exa and Tavily, the search providers. CopilotKit, which relays Slack messages to the assistant and holds those threads. Slack holds the messages under your organisation's own agreement with Slack.
How long. The Slack link and the relayed threads until you delete your data or your account.
Service records
Traces of what the product did (timings, which tool ran, errors, and your account and thread IDs, but not the content of your messages), request logs (IP address, browser, page and time), counters of how many messages your account sent in a minute and in a day, and, if your organisation uses the API, a log line and a counter per request with its IP address.
Who processes it. Pydantic Logfire (traces), Vercel and Railway (request logs), Neon (the counters and the API log).
How long. API request lines for 90 days. Traces and request logs for the periods Logfire, Vercel and Railway set. The counters have no deletion period set yet. None of these is deleted with your account.
That is a summary of the account; the full notice, with the purpose and lawful basis of each item, is the uksrs.org.uk privacy policy.
You can do each of these yourself, in Settings on uksrs.org.uk:
- See and correct: every figure on your company record can be edited, and the old value stays in the history.
- Export: Settings → Privacy → Export as JSON downloads your email, profile, organisation and company record. It does not include your conversations or the assistant's memory; ask us for those and we will send them.
- Delete your data: Settings → Privacy → Delete everything we hold about you erases every store in the account, the assistant's memory first. It leaves your sign-in, so signing in again gives you an empty account.
- Delete your account: Settings → Account → Delete account does all of that and then removes your sign-in. If the sign-in service refuses that last step, the screen says so and you can ask us to finish it.
For anything else about your account, write to hello@uksrs.org.uk.
Your rights
Ask, correct, delete
You can ask us what information we hold about you, ask us to correct it, or ask us to delete it, by emailing hello@uksrs.org.uk.
We will respond promptly.
We may update this policy from time to time, and the date below changes when we do.
The terms of use cover the rest of how the site works.