Privacy policy

Who we are

Quadrano Ltd is the controller of your personal data. We are a company registered in England and Wales under company number 17517656. Our registered office and contact email are shown at the end of this page.

What this policy covers

This policy covers quadrano.com, the hosted Quadrano product, and Quadrano Local. It explains what information we collect, why we collect it, who we share it with, and the choices and rights you have.

Information we collect and why

We collect only what we need to run the service. This table sets out what we collect, why, and our lawful basis under the UK GDPR.

You can sign in with email and password, or with a magic link sent by email. One-time codes are used for some confirmations.

Quadrano Local

Quadrano Local runs entirely in your browser. Nothing you build there is sent to Quadrano.

When the hosted product later publishes validation scripts, those scripts run in visitors’ browsers, log to the browser Console only, and send no data.

Who we share it with

We share personal data only with the processors we use to run the service:

• Supabase hosts our database and authentication, in London (eu-west-2).
• Vercel hosts the application, with server functions in London.
• Resend sends account emails such as confirmation, magic link, password reset and invitation emails, from noreply@mail.quadrano.com.
• Cloudflare provides bot protection on sign-up and sign-in through Turnstile.
• Google. The Google Tag Manager container script loads on every page except sign-in, sign-up and password pages, before you choose. It sets no cookie and collects nothing for analytics, but fetching it sends your IP address and browser details to Google, as any request to a website does. Analytics tags in it stay off until you accept. Analytics is Google Analytics 4, through Google Tag Manager, only after you accept. Page views use addresses with your Organisation’s identifier removed. We run no advertising, no Google signals, and no user ID.

International transfers

Some of our processors may handle your data outside the UK. The safeguards each one provides are:

• Supabase hosts our database and authentication in London (eu-west-2). Its data processing addendum applies the UK Addendum to the EU standard contractual clauses to any transfer outside the UK.
• Vercel hosts the application, with server functions in London. Its data processing addendum applies the UK IDTA to any transfer outside the UK.
• Resend sends our emails from the United States. Its data processing addendum applies the EU standard contractual clauses as amended by the UK Addendum.
• Cloudflare runs Turnstile from its global network, including the United States. Its data processing addendum applies the EU standard contractual clauses as amended by the UK Addendum.
• Google processes analytics data in the United States. Its data processing terms apply the European Commission’s standard contractual clauses.

How long we keep it

Account data is kept while the account exists. Deleting the account, or asking us to, removes it within 30 days, apart from what the law requires us to keep.

Your rights, and how to exercise them

You have rights under the UK GDPR: the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. To exercise any of these rights, contact us using the details at the end of this page.

Cookies

We use strictly necessary cookies and, only with your consent, analytics cookies. See our cookie notice for the full list.

Changes

We may update this policy from time to time. The “Last updated” date at the top of this page tells you when it last changed. If a change matters, we will tell you by email or by a notice on the site at least 14 days before the change takes effect.

Contact and complaints

To contact us about this policy, use the contact details at the end of this page. You also have the right to complain to the Information Commissioner’s Office (the ICO) at ico.org.uk.