PegSquared logoBeta
Sign in
← Back

Privacy Policy

Version 2026-10-11 · Last updated 2026-10-11

This policy explains how Peg Squared Ltd ("we", "us") collects, uses and protects your personal data when you use Peg² (the "Service") at profile.pegsquared.co.uk. We are committed to handling your data in line with the UK GDPR and the Data Protection Act 2018.

1. Who we are

Data controller: Peg Squared Ltd, 21 Chelmerton Avenue, CM2 9RF, United Kingdom. We are registered with the UK Information Commissioner's Office (ICO).

For any privacy question or to exercise your rights, contact tania@pegsquared.co.uk.

2. What data we collect

  • Account data: name, email address, hashed password, sign-in metadata.
  • Profile data: your answers to the Brain Profile self-reflection tool and the ratings totalled from them.
  • Anonymous profile records: when you complete the self-reflection tool, or part of it, we save your answers, ratings, the date, the tool version and how far you got, whether or not you create an account. These records do not include your name, email address, IP address or device identifiers, and do not include free-text answers.
  • Organisation codes: if you open the Service through a link or QR code provided by an organisation (for example, during a training session), we record that organisation's code with your profile.
  • Working context: answers about how and where you work (location, hours, team setup, biggest challenge). Your answer about your biggest challenge is only saved if you create an account.
  • Profile reflections and conversations: free-text reflections, exploration conversations with our AI assistant, and toolkit choices.
  • Technical data: IP address, browser, device and error logs, used for security only. IP addresses are never stored with profile records.
  • Analytics (with your consent): Google Analytics information about how you use the Service.

Peg² is an informational tool. It is not a medical, clinical or diagnostic service, and we do not ask you to provide special-category data (health, biometrics, etc.). Please do not include such information in free-text fields.

3. Why we use your data and our lawful basis

  • To deliver your account and profile — lawful basis: performance of a contract with you.
  • To generate AI-assisted reflections and toolkit suggestions — lawful basis: consent (given when you submit content) and contract.
  • To save anonymous profile records. Lawful basis: our legitimate interest in understanding how the Service is used and improving it. Once saved, these records cannot identify you.
  • To research and improve the tool's reliability and fairness. We use anonymous profile records for this. If you have an account, we only use your account data for research if you tick the research consent box; you can withdraw this at any time in Settings. Lawful basis: legitimate interest (anonymous records) and consent (account data).
  • To provide organisation reports. If you used an organisation's link, that organisation may receive combined figures for everyone who used its link. We only share these once at least 5 people have completed the self-reflection tool, and organisations never see individual answers or who took part. Lawful basis: our legitimate interest in supporting organisations to improve their working practices.
  • To secure the Service and prevent abuse — lawful basis: our legitimate interest in operating a safe product.
  • To send service emails (sign-up confirmation, password reset, important changes) — lawful basis: contract.
  • To send occasional PegSquared updates — only if you opt in; lawful basis: consent. You can withdraw at any time.
  • Analytics — lawful basis: consent. Off by default; controlled via the cookie banner.

We keep an anonymous count of completed profiles and, if you choose to answer it, your response to one optional feedback question. This information is stored without any personal details or link to your answers, and is used only to understand how helpful the tool is and to improve it.

4. Who we share data with

We do not sell your data. We share it only with the processors we need to run the Service:

  • Lovable Cloud — hosting, database and authentication. Data is stored in the EU.
  • Anthropic, PBC — provides the AI model that generates reflections from your profile and conversation content. Processed in the United States under Standard Contractual Clauses (SCCs). Anthropic does not use this data to train its models.
  • Google Ireland Ltd (Google Analytics) — only loaded if you consent to analytics cookies. International transfers are covered by SCCs and the UK Extension to the EU–US Data Privacy Framework.

Organisations: organisations whose link you used receive combined figures only, as described in Section 3. They do not receive any personal data.

5. International transfers

Some of our processors are based outside the UK. Where data leaves the UK, we rely on the UK Government's adequacy decisions, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum.

6. How long we keep your data

Account and associated data: we keep your account details, saved profiles, working-context information, profile reflections, AI conversations and toolkit choices while your account remains open. We review retention annually and delete personal data that is no longer needed to provide the Service.

Account deletion: when you delete your account, we remove your account and all associated personal data from our live systems immediately. This includes profile records linked to your account, saved working-context information, reflections, AI conversations and toolkit choices. Residual copies in backups are overwritten within 30 days. They are not used for normal operations, and relevant deletions are reapplied if a backup is restored.

Anonymous profile records: we keep genuinely anonymous profile records, including partially completed profiles, for up to six years from the date of collection. We use these to evaluate the Brain Profile's reliability, validity and fairness, compare tool versions, and improve the Service. We review annually whether these records remain useful for these purposes and delete them earlier where they are no longer needed.

Deleting your account also deletes profile records that remain linked to it. Any separate research records that have already been irreversibly anonymised may remain for the research retention period described above. Because these records can no longer be linked to you, we cannot retrieve, correct or delete them individually.

Email-service logs and security logs: we keep these for up to 12 months and delete them earlier where they are no longer needed.

Data exports: occasionally we download data for administration or analysis. Exports used for research contain no names or email addresses. Exports containing contact details are stored securely on encrypted, access-controlled devices, are only accessible to Peg Squared Ltd, and are deleted within 30 days or once no longer needed. Deletion requests apply to these copies too.

7. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Have inaccurate data corrected.
  • Have your data erased ("right to be forgotten").
  • Receive your data in a portable format.
  • Restrict or object to processing.
  • Withdraw consent at any time (does not affect prior processing).
  • Complain to the ICO at ico.org.uk.

You can exercise most of these yourself in Settings — download a copy of your data or delete your account at any time. For anything else, email tania@pegsquared.co.uk and we will respond within one month.

Anonymous profile records cannot be linked back to you, so we cannot find, correct or delete them on request. This does not apply to records linked to your account, which you can manage in Settings.

8. Cookies and similar storage

We use the minimum number of cookies and local-storage entries needed:

  • Strictly necessary — keep you signed in (your sign-in session) and remember an organisation code while you build your profile. Always on.
  • Analytics (Google Analytics) — only loaded if you accept. You can change your choice any time via "Cookie settings" in the footer.

9. Security

Data is encrypted in transit (TLS) and at rest. Access is restricted via role-based access control and row-level security. Passwords are hashed; we cannot see them. Despite our precautions, no online service is 100% secure — please use a strong, unique password.

Only Peg Squared Ltd can access the admin area. We do not view individual profiles, reflections or AI conversations.

10. Children

The Service is intended for adults aged 18+. We do not knowingly collect data from children.

11. Changes to this policy

We will update this page when our practices change, and update the version number above. If the change is material, we will notify you by email or in-app.

12. Contact

Peg Squared Ltd, 21 Chelmerton Avenue, CM2 9RF, United Kingdom. Email tania@pegsquared.co.uk.