Draft. This document hasn't been checked by a legal adviser yet, and some details are still marked in [square brackets].

Integrator by integrAIt

Privacy policy

Last updated 24 October 2026

This policy explains how Integrait Workflows Ltd (“we”, “us”, trading as integrAIt) handles personal data in Integrator, our software for small businesses. We're registered with the UK Information Commissioner's Office (ICO) under number [ICO registration number].

Two kinds of data, two roles

• Your account data – the details of the people who sign up and use Integrator (name, email, password, billing details, how you use the app). For this we are the data controller.
• Your business's data – the customers, jobs, bookings, invoices, members, candidates and other records you put into Integrator. Your business is the controller of this data and we are your processor: we only use it to provide the service to you, under the data processing terms in our Terms of service.

What we collect about account holders

• Name, email address and password (stored only as a secure one-way hash – nobody, including us, can read it).
• Your business name, industry and the answers to the setup questions.
• Billing details. Card payments are handled by Stripe; we never see or store your full card number.
• How you use the app (for example which tools are switched on and how many AI actions you've used), and technical logs (IP address, browser) kept for security and to fix problems.
• If you switch on phone notifications, a device address from your browser's push service.

Why we use it (and our lawful basis)

• To provide your account and the service – contract.
• To take payment and keep financial records – contract and legal obligation.
• To keep the service secure, prevent abuse and fix faults – legitimate interests.
• To tell you about important changes to the service – legitimate interests. We'll only send marketing emails if you've agreed, and you can unsubscribe at any time.

Who we share data with

We use trusted suppliers (“sub-processors”) to run Integrator. Each only receives what it needs:

• Supabase – database, file storage and sign-in. Data is stored in the EU (Frankfurt, Germany).
• Vercel – hosting the app.
• Stripe – subscription billing, and card payments your customers make to you.
• Resend – sending emails (invoices, booking confirmations, reminders).
• Anthropic – the AI features (for example drafting quotes, descriptions and replies). Only the information needed for the request is sent, and Anthropic's commercial terms don't allow it to train its models on that data.
• Companies House, Hunter and Google – public company information and business contact details when you use the lead tools.
• Your browser's voice typing – if you press the microphone in a text box, your browser turns your speech into text. In Chrome and Edge the audio is sent to Google or Microsoft to do this; Integrator never receives or keeps the recording, only the words that appear in the box.
• Browser push services (Google, Apple, Mozilla, Microsoft) – delivering phone notifications you've switched on. Only a short summary is sent.
• Accounts you link yourself – if you link Google Calendar, Outlook, Xero, QuickBooks, GoCardless, Twilio, Google Business Profile or your own mailbox, we exchange only what each link needs with that service (for example your diary times, invoices and payment statuses, or the text you choose to send), under your own agreement with them. Sign-ins and keys are stored encrypted, and you can unlink them at any time.
• The government EPC register – a property's postcode, when an estate agent looks up its energy rating.
• AI tools you connect yourself – if you create an API key and connect Claude, ChatGPT, Zapier or similar, the data you ask them to access is shared with that provider under your own agreement with them.

We don't sell personal data, and we don't use your business's data to advertise to anyone.

International transfers

Some suppliers process data outside the UK (mainly in the EU and the USA). Where they do, we rely on UK adequacy regulations (including the UK–US data bridge) or the ICO's International Data Transfer Agreement / Addendum to protect it.

How long we keep it

• Account data: while your account is open, then up to 90 days after you close it (so you can come back), unless you ask us to delete it sooner.
• Billing records: 6 years, as UK tax law requires.
• Your business's data: until you delete it or close your account. You can delete individual records at any time, and export them before you leave.
• Backups are kept for a short period and then overwritten.

Keeping it safe

Each business's data is kept separate by database security rules, connections are encrypted, passwords are hashed, API keys are stored only as hashes, and access to production systems is limited. No system is perfectly secure, but we'll tell you and the ICO promptly if a breach affects your data.

Cookies

We only use cookies that are needed for Integrator to work – keeping you signed in, remembering which workspace you're using, and protecting forms. We don't use advertising or tracking cookies. Some settings (like a remembered tab, or today's schedule for no-signal use) are stored in your own browser and wiped when you sign out.

Your rights

You can ask to see, correct, delete, restrict or move your personal data, and object to how we use it. Email [privacy email, e.g. privacy@yourdomain.co.uk] and we'll reply within one month. If you're a customer of a business that uses Integrator, please contact that business first – they control your data and we'll help them respond.

If you're unhappy with how we've handled your data, you can complain to the ICO at ico.org.uk or on 0303 123 1113.

Contact

Integrait Workflows Ltd, [registered office address]. Email [privacy email, e.g. privacy@yourdomain.co.uk].

Integrait Workflows Ltd · Company number [company number] · [registered office address] · Privacy · Terms