Privacy Policy

1. Who we are and our two roles

This policy explains how Belt and Braces Ltd ("ButtonUp", "we") handles personal data. Company no. [Company No.], registered office [Registered office address]. Contact: [privacy@buttonupresearch.com].

For account holders and website visitors, we are the data controller — this policy covers that data.

For the research data our customers upload (including data about their participants), the customer is the controller and we are their processor. We process that data only on the customer's instructions, under our Data Processing Agreement. If you are a research participant, please contact the organisation that invited you (the controller); we will help them respond.

2. What we collect (as controller)

• Account data: name, email, hashed password, workspace and role, 2FA status.
• Billing data: plan, and limited payment metadata via our payment provider (we do not store full card details).
• Usage and device data: log data, IP address, pages and actions, approximate location from IP, cookies (see section 8).
• Support and comms: messages you send us and email engagement.

3. How and why we use it (and lawful bases)

• Provide, secure and support the Service, and manage your account and billing — performance of a contract.
• Keep the Service safe, prevent abuse, debug, and improve it — legitimate interests.
• Send service messages — contract / legitimate interests; optional product and marketing emails — consent (you can opt out anytime).
• Comply with legal obligations (e.g. accounting) — legal obligation.

4. AI processing

Some features send your content to our AI sub-processor to generate drafts and analysis. Before doing so we pseudonymise and redact direct identifiers (e.g. participant names, emails, phone numbers) so the AI provider does not receive them where avoidable. See section 6 for the provider and safeguards.

5. Who we share it with

We share personal data with sub-processors that help run the Service (hosting, database, email delivery, AI, payments), listed with their purpose and location on our sub-processors page. We require them to protect the data and use it only to provide their service. We may also disclose data if required by law, or in a business reorganisation or sale (with safeguards). We do not sell personal data.

6. International transfers

Our hosting, database and file storage are in the UK / EU. Our AI sub-processor (Anthropic) processes in the United States; such transfers are protected by appropriate safeguards (e.g. the UK International Data Transfer Agreement / EU Standard Contractual Clauses) and by the pseudonymisation in section 4.

7. How long we keep it

We keep account data while your account is active and for a reasonable period after closure to meet legal, accounting and dispute needs, then delete or anonymise it. Customer and research data is retained and deleted per the customer's settings and the DPA.

8. Cookies

We use strictly necessary cookies to run the Service (e.g. authentication). For analytics we use a privacy-friendly, cookieless tool (Plausible) that does not track you across sites. If we ever add non-essential cookies, we will ask for your consent first.

9. Your rights

Subject to UK GDPR, you can ask to access, correct, delete, restrict, port, or object to processing of your personal data, and withdraw consent at any time. Email [privacy@buttonupresearch.com]. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to help first.

10. Security

We protect personal data with encryption in transit and at rest, field-level encryption of sensitive participant identifiers, access controls, audit logging and EU-region hosting. No system is perfectly secure, but we work hard to protect your data.

11. Children

The Service is not intended for, and may not be used by, anyone under 18.

12. Changes and contact

We may update this policy and will post the new version with its date; we will notify you of material changes. Questions or requests: [privacy@buttonupresearch.com], Belt and Braces Ltd, [Registered office address].