Peg²Beta
Sign in
← Back

Privacy Policy

Version 2026-06-11 · Last updated 2026-06-11

This policy explains how Peg Squared Ltd ("we", "us") collects, uses and protects your personal data when you use Peg² (the "Service") at profile.pegsquared.co.uk. We are committed to handling your data in line with the UK GDPR and the Data Protection Act 2018.

1. Who we are

Data controller: Peg Squared Ltd, 21 Chelmerton Avenue, CM2 9RF, United Kingdom. We are registered with the UK Information Commissioner's Office (ICO).

For any privacy question or to exercise your rights, contact tania@pegsquared.co.uk.

2. What data we collect

  • Account data: name, email address, hashed password, sign-in metadata.
  • Assessment data: your answers to the Brain Profiler questionnaire and the scores derived from them.
  • Working context: answers about how and where you work (location, hours, team setup, biggest challenge).
  • Profile reflections and conversations: free-text reflections, exploration conversations with our AI assistant, and toolkit choices.
  • Technical data: IP address, browser, device, error logs.
  • Analytics (with your consent): Google Analytics measurements about how you use the Service.

Peg² is an informational tool. It is not a medical, clinical or diagnostic service, and we do not ask you to provide special-category data (health, biometrics, etc.). Please do not include such information in free-text fields.

3. Why we use your data and our lawful basis

  • To deliver your account and results — lawful basis: performance of a contract with you.
  • To generate AI-assisted reflections and toolkit suggestions — lawful basis: consent (given when you submit content) and contract.
  • To secure the Service and prevent abuse — lawful basis: our legitimate interest in operating a safe product.
  • To send service emails (sign-up confirmation, password reset, important changes) — lawful basis: contract.
  • To send occasional PegSquared updates — only if you opt in; lawful basis: consent. You can withdraw at any time.
  • Analytics — lawful basis: consent. Off by default; controlled via the cookie banner.

4. Who we share data with (sub-processors)

We do not sell your data. We share it only with the processors we need to run the Service:

  • Lovable Cloud / Supabase — hosting, database and authentication. Data is stored in the EU.
  • Anthropic, PBC — provides the AI model that generates reflections from your assessment and conversation content. Processed in the United States under Standard Contractual Clauses (SCCs). Anthropic does not use this data to train its models.
  • Google Ireland Ltd (Google Analytics) — only loaded if you consent to analytics cookies. International transfers are covered by SCCs and the UK Extension to the EU–US Data Privacy Framework.

5. International transfers

Some of our processors are based outside the UK. Where data leaves the UK, we rely on the UK Government's adequacy decisions, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum.

6. How long we keep your data

  • Account, assessment, conversation and toolkit data: while your account is active.
  • On account deletion: removed from our live systems immediately. Backups are overwritten within 30 days.
  • Pending (pre-signup) assessment results: deleted automatically after 90 days if not claimed.
  • Email service logs and security logs: up to 12 months.

7. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Have inaccurate data corrected.
  • Have your data erased ("right to be forgotten").
  • Receive your data in a portable format.
  • Restrict or object to processing.
  • Withdraw consent at any time (does not affect prior processing).
  • Complain to the ICO at ico.org.uk.

You can exercise most of these yourself in Settings — download a copy of your data or delete your account at any time. For anything else, email tania@pegsquared.co.uk and we will respond within one month.

8. Cookies and similar storage

We use the minimum number of cookies and local-storage entries needed:

  • Strictly necessary — keep you signed in (Supabase auth session). Always on.
  • Analytics (Google Analytics) — only loaded if you accept. You can change your choice any time via "Cookie settings" in the footer.

9. Security

Data is encrypted in transit (TLS) and at rest. Access is restricted via role-based access control and row-level security. Passwords are hashed; we cannot see them. Despite our precautions, no online service is 100% secure — please use a strong, unique password.

10. Children

The Service is intended for adults aged 18+. We do not knowingly collect data from children.

11. Changes to this policy

We will update this page when our practices change, and bump the version number above. If the change is material, we will notify you by email or in-app.

12. Contact

Peg Squared Ltd, 21 Chelmerton Avenue, CM2 9RF, United Kingdom. Email tania@pegsquared.co.uk.