Privacy policy
Last updated: [Date to be confirmed]
This policy explains how NxGen AI Ltd collects and uses personal data when you visit the Ember Loop website, ask us about access, or sign in to Ember Loop.
Who we are
Ember Loop is a product of NxGen AI Ltd, a company registered in England and Wales.
- Company number: [Company number to be confirmed]
- Registered office: [Registered office to be confirmed]
- ICO registration number: [ICO registration number to be confirmed]
Our two roles
Ember Loop holds two kinds of personal data, and our responsibilities differ for each.
Workspace data. Each customer organisation has its own workspace. The records it keeps there, such as clients, contacts, tasks, meetings, time entries, leave and cost rates, are controlled by that organisation. We process that data only on its instructions, under a data processing agreement. If you are an employee or contact of one of our customers and have a question about that data, please contact the organisation first. We will help them respond.
Account and website data. We are the controller for the data we need to run the service itself: your account and sign-in details, security and audit records, error logs, backups, invitations, and messages you send us. The rest of this policy is about this data.
What we collect
- Account details: your name, work email address, the organisation and workspace you belong to, and your role.
- Sign-in details: the sign-in method you use (Microsoft, Google, your organisation's single sign-on, or email and password), a secure record of your password if you use one, and multi-factor authentication settings.
- Security and audit records: when you sign in, actions you take that change workspace settings or access, approvals, and related timestamps.
- Technical data: IP address, browser and device type, and error reports when a page fails, used to keep the service secure and working. Error reports are filtered to exclude passwords and other secrets.
- Invitations: the name and email address an administrator enters to invite you.
- Messages: what you send us if you email hello@emberloop.co.uk to ask about access or support@emberloop.co.uk for help.
We do not use advertising or tracking cookies, and we do not sell personal data.
Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing your account and the workspace your organisation pays for | Legitimate interests: delivering the service your organisation has contracted for. Where you contract with us directly, performance of a contract |
| Keeping the service secure, preventing misuse, and investigating incidents | Legitimate interests: protecting our customers' data and our systems |
| Sending invitations and service messages | Legitimate interests: giving invited people access and telling users about changes that affect them |
| Fixing faults from error reports | Legitimate interests: keeping the service reliable |
| Replying to access requests and support emails | Legitimate interests: responding to people who contact us |
| Keeping records we are required to keep | Legal obligation |
Where we rely on legitimate interests, we have considered your interests and rights and believe they are not overridden. You can ask us for details of that assessment.
Who we share it with
We use the following service providers to run Ember Loop. Each acts on our instructions under a written contract.
- Lovable (Lovable Cloud): application hosting.
- Supabase: database and sign-in services.
- Microsoft Azure (UK South): encrypted nightly backups.
If you choose to sign in with Microsoft or Google, that provider handles your sign-in under its own privacy policy and tells us who you are. Your organisation may also connect its own single sign-on provider.
We may also disclose data if the law requires it, or to protect the rights and safety of our customers, users or the public. If NxGen AI Ltd or Ember Loop is sold or reorganised, data may pass to the new owner under the same protections.
Where your data is stored
[Hosting region to be confirmed] Backups are stored in the UK. Where data is transferred outside the UK, we use safeguards recognised under UK law, such as the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework. You can ask us for a copy of the relevant safeguard.
How long we keep it
These periods are being finalised.
- Account details: while your account is active, then up to 12 months after your access ends, after which your name in past records is shown as "Former member".
- Security and audit records: 2 years.
- Error reports: 90 days.
- Expired invitations: 90 days.
- Backups: 35 days, then automatically deleted.
- Access and support emails: as long as needed to deal with your enquiry, and no longer than 2 years.
- Workspace data: under our customer's instructions, and deleted within 60 days after their contract ends.
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased;
- restrict or object to how we use it;
- receive your data in a portable format;
- withdraw consent where we rely on it.
Some rights depend on the lawful basis and the circumstances. To use any of them, contact us using the details below. We will reply within one month. If your request is about workspace data, we will pass it to the organisation that controls it and help them respond.
You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to deal with your concern first.
Security
We protect data with encryption in transit, separate workspaces checked on the server for every request, invitation-only access, multi-factor authentication for platform administrators, and encrypted backups. No system is completely secure, and we will tell you and the ICO about a personal data breach where the law requires it.
Automated decisions
We do not make decisions about you using solely automated processing that have legal or similarly significant effects.
Children
Ember Loop is a business service and is not intended for anyone under 18.
Cookies
We only use storage that the service needs to work. See our cookies policy.
Changes to this policy
We will update this page when our practices change and show the date of the latest version at the top. We will tell account holders about significant changes.
Contact us
Email: hello@emberloop.co.uk
Post: NxGen AI Ltd, [Registered office to be confirmed]
[Data protection officer statement to be confirmed]