Privacy Policy

1. Who we are

Seghu is run by hibretOne CIC, a Community Interest Company registered in England and Wales (company number 14228154), whose registered office is Studio 9, 50-54 St Paul's Square, Birmingham B3 1QS. hibretOne CIC is the data controller for personal data collected through this platform, and is registered with the Information Commissioner's Office under registration number ZB679491.

Contact us at: info@hibretone.org

2. What data we collect

We collect the following categories of personal data:

• Account data: name, email address, and password (hashed) when you create an account.
• Organisation data: your responses to the Structure Assessment, Funding assessment, and any documents you generate or upload. This data is linked to your account.
• Filing details: the names, dates of birth, nationalities and addresses of directors, members or trustees that you enter so we can prepare Companies House and Charity Commission documents.
• Usage data: pages visited, features used, and session duration. This is collected from our own server logs, and, only if you accept analytics cookies, from our analytics providers in your browser. See section 7.
• Audit events: a record of security-relevant actions on your account, such as signing in, changing your password and requesting deletion.
• Contact data: any information you send us when you contact us by email (for example, hello@seghu.org).

You have to give us a name, email address and password to create an account: without them we cannot provide the platform. Everything else is optional, but if you leave out the filing details a document needs, we cannot generate that document for you. We do not collect payment card details directly.

3. Why we process your data

Where we rely on legitimate interests, those interests are keeping the platform secure and working, improving it, and answering the people who contact us.

4. Who we share your data with

We share your data only with suppliers who process it on our instructions:

• our cloud database and authentication provider, hosted in the EU (Ireland);
• our web hosting and application server providers;
• an AI gateway and the model hosts it routes your text to, for the drafting features described in section 9;
• our product analytics and session recording providers, which load only if you accept analytics cookies;
• our transactional email provider, used to send password reset emails.

We do not sell your personal data to any third party. Our cookie details page names the services that set cookies on your device. If you would like the full list of our other suppliers by name, including where each one is based, email us at info@hibretone.org and we will send it to you.

5. How long we keep your data

We keep everything in your account, including anything you upload, for as long as your account is open. If you delete your account, it is hidden from the platform immediately and permanently erased 30 days later. Emails you send us are kept for up to 2 years.

6. Your rights

Under UK GDPR you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate data we hold about you.
• Erasure: request deletion of your data (the "right to be forgotten").
• Restriction: ask us to limit how we use your data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: turn analytics cookies off again at any time, without affecting anything we did while consent was in place.

To exercise any of these rights, email us at info@hibretone.org. We answer requests within one month.

You can also download a machine-readable copy of your account data at any time from Settings → Privacy & Data within the platform. To delete your account, email us and we will erase your data within 30 days.

You also have a right to complain to us about how we handle your personal data. Email info@hibretone.org with "data protection complaint" in the subject line. We will acknowledge it within 30 days, investigate, and tell you the outcome. You can complain to the Information Commissioner's Office at ico.org.uk whether or not you come to us first.

7. Cookies, local storage and analytics

We keep you signed in using an authentication token stored in your browser's local storage (not a cookie), which is sent with each request to identify you. It is essential to running the platform, so it is set without asking, and it is cleared when you sign out.

If you accept analytics cookies, we use two analytics services. One counts visits and records what happens on screen as you use each page: clicks, scrolling and the pages you move between. Anything you type into a form is masked, but other text shown on the page can appear in a recording. When you are signed in, it links this to your account. The other measures overall use of the platform and receives only an account number, not your name or email. Our cookie details page lists each cookie, how long it lasts, which service provides it and where the data is kept.

Neither service is loaded until you accept analytics cookies. If you reject them, no analytics cookies are set and no session is recorded. You can change your choice at any time using Cookie settings at the bottom of our pages, or in Settings → Privacy & Data. We do not use advertising or cross-site tracking cookies.

8. Where your data is processed

Your data is processed in the United Kingdom and the European Economic Area, and by some suppliers based in the United States. Where a supplier is in the United States, we rely either on its certification under the UK Extension to the EU-US Data Privacy Framework, or on UK-approved contract clauses.

Email info@hibretone.org for a copy of the safeguards that apply to a particular supplier.

9. AI and automated decision-making

Some parts of the platform can draft or improve text for you. That text is sent to an AI provider through our gateway. The routes we use by default are set to zero retention with training refused, so your text is not kept by the model host and is not used to train any model. A fallback route, used only when those fail, retains prompts for up to 30 days.

No personal data is sent to any AI provider when we generate your incorporation and governance documents. Those are produced on our own servers from the answers you have saved. If you upload a business plan, we do send its text to a model to pull out the details, and that text can include people's names and addresses.

AI never makes a decision about you. The structure, funding and funder-matching scores are rule-based calculations run on our own servers from the answers you give us. They are there to inform you, they produce no legal or similarly significant effect, and the decision is always yours. How we use AI explains all of this in full, including which features use AI and which do not.

10. Security

Passwords are hashed before storage. All data is transmitted over HTTPS. Access to production systems is restricted to authorised personnel only.

11. Changes to this policy

We will update this policy as the platform evolves. Material changes will be communicated by email or by a notice on the platform. The date at the top of this page reflects the most recent revision.