Privacy Policy

Privacy Notice and Cookies Policy

Version 1.2 — Last updated 6 October 2026

This notice explains how Insequa Limited (“Insequa”, “we”, “us” or “our”) collects, uses and protects personal information. It applies to the activities below. We update this notice when our processing changes; the current version is available on our website.

This policy applies to visitors to insequa.co.uk, clients of Insequa (consulting), and customers of Insequa AI Solutions (our AI-assisted software for social care providers).

Who we are

Insequa Limited is a company registered in England and Wales under company number 08174453, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We trade as Insequa for our consulting services and Insequa AI Solutions for our software products.

We are controller for personal information used for our website, consulting business, account, billing, business-contact support and marketing activities, and our minimised security, contract-accountability and legal audit records. For Customer Content and customer activity history held solely on behalf of a care provider, including limited service quality checks, that organisation is controller and Insequa is processor under the Customer DPA.

How to contact us

Our Data Protection Officer is Bill Watson, contactable at billwatson@insequa.co.uk. For general privacy queries, email enquiries@insequa.co.uk or call 0115 896 3999.

You may complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk. We welcome the opportunity to resolve concerns first, but contacting us does not restrict your right to complain to the ICO.

What we collect

We may collect the following information:

• Name and job title
• Contact information, including email address and phone number
• Demographic information such as postcode, preferences and interests
• Information relevant to enquiries, customer surveys or offers
• AI Solutions account information, including your name, business email address, role, Location assignments, credentials and authentication records. Authentication is managed through Supabase Auth; passwords, where used, are salted and hashed and are not stored in plain text.
• Information you enter into Insequa AI Solutions about your social care service, including details of staff and residents — see the section below for how this is handled
• Relevant public CQC registration information for the Locations selected by your organisation, including registered manager names and roles where relevant. We obtain and use it on the organisation’s instructions for onboarding and PIR drafting. The organisation is responsible as controller for its lawful basis and required privacy information, including Article 14 information where data is obtained indirectly; we assist it with source information and requests. Public availability does not remove those obligations.
• Website usage data, such as pages visited and basic browser information. This includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access our website.
• Records of our communications with you
• Data about residents, staff, and third parties. If you use Insequa AI Solutions, you may enter or upload information about your staff, residents, and other individuals. Those individuals are not our customers and have not provided their data to us directly. Your organisation (as the controller) is responsible for ensuring you have an appropriate lawful basis for entering that data and for providing those individuals with information about how their data is used, including the fact that it may be processed by Insequa and its sub-processors as part of the PIR drafting service and Insequa AI Solutions product.
• We also collect, use and share aggregated data such as statistical or demographic data which is not personal information as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals' Usage Data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.

What we do with the information we gather

We use this information to understand your needs and provide you with a better service. In particular:

• To respond to enquiries
• To register you as a customer and user of our services
• To provide consulting services or software products
• For internal record keeping
• To manage our relationship with you
• To improve our website and services using business information and genuinely anonymised, aggregated usage data. Limited human quality checks of Customer Content are performed only under the customer’s instructions described below; identifiable content is not used for unrelated research or general product development.
• To administer and protect our business, services and website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)
• To send you marketing emails about new products, offers, or information we think you may find interesting — only where you have agreed to receive these
• To contact you occasionally for market research, where you have agreed to be contacted
• To tailor the website according to your interests
• To meet our legal and regulatory obligations

Our lawful basis for using your information

Under UK GDPR, we must have a lawful basis for processing your personal information. We rely on the following:

• Contract — where processing is necessary to perform our contract with you as an individual, including account management, service delivery, payments and support.
• Legitimate interests — to provide and administer services for organisational customers and authorised contacts, respond to enquiries, secure systems, prevent misuse, maintain proportionate contract-accountability records and establish, exercise or defend legal claims, and improve our website using appropriate usage information. We assess necessity and balance these purposes against individuals’ rights and interests; the right to object applies.
• Consent — for marketing emails and for non-essential cookies. You can withdraw consent at any time by clicking "unsubscribe" in any marketing email or by emailing enquiries@insequa.co.uk.
• Legal obligation — for example, where we are required to keep records for tax or regulatory purposes

For resident and staff information entered into AI Solutions, the customer care provider determines the Article 6 lawful basis. Where special category data is involved, it must also identify an appropriate Article 9 condition, for example health or social care under Article 9(2)(h) where its conditions and applicable UK legal requirements are met. Insequa processes that data on the customer’s documented instructions under the DPA.

How long we keep your information

We will only keep your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

When deciding retention, we consider the nature and sensitivity of the information, why it is needed, the risks of retaining it and applicable legal requirements. Our standard periods are:

• Necessary client contractual, billing and business records: during the relationship and for seven years afterwards, for accounting, legal and operational purposes. Prospective-client enquiries are retained only for as long as needed to deal with the enquiry and any related lawful business purpose.
• Marketing: until you withdraw consent, plus a reasonable suppression list retention period to ensure we do not contact you again
• AI Solutions account and billing records: necessary records retained for seven years from account closure or Subscription lapse, whichever occurs first. Statutory erasure rights apply, subject to lawful retention requirements.
• AI Solutions Customer Content (inputs, uploads and generated drafts): while the Subscription is active, then retained for twelve months after account closure or Subscription lapse, whichever occurs first, on the customer organisation’s documented instruction to support returning customers. The customer may instruct earlier deletion or return at any time; requests are actioned without undue delay. Data may remain in protected Supabase backups for up to 14 days after primary deletion. The DPA sets out provider-specific retention and legal exceptions.
• Insequa acts as Controller for minimised audit records retained for its own system security, prevention of misuse, contract accountability and establishment, exercise or defence of legal claims. These may record relevant actions, timestamps, model identifiers, outcomes and responsible user identifiers, but exclude prompts, uploaded documents and generated content. The standard maximum retention is seven (7) years from creation, only for as long as necessary for those purposes. Insequa reviews necessity periodically and deletes or anonymises records earlier when no longer needed. A specific legal obligation or documented legal hold may require longer retention. The Privacy Notice sets out the lawful bases and individual rights. This period does not apply automatically to all operational or technical logs.
• Customer activity history held solely on your organisation’s behalf: processed as Processor and subject to the Customer Content period and earlier deletion or return instructions. Acceptance of the DPA instructs limited post-termination storage; this history is not subject to the seven-year controller audit period.
• Inngest retains workflow state, including event payloads and step results, while runs are active. Insequa uses Inngest’s Pro plan, under which completed run, trace and log history is retained for seven (7) days. These technical records are separate from the minimised controller audit records described in the Customer DPA and Privacy Notice.
• Sentry error-monitoring records are retained for 90 days.
• ElevenLabs retains text-to-speech input text, generated audio and generation history by default, with no published fixed automatic expiry. This data is managed in accordance with the Customer Content retention arrangements and the applicable provider agreement. Backup copies may remain for up to 30 days after deletion. Related debugging or moderation data is subject to separate provider retention arrangements, with no published fixed retention period.
• Resend publishes 30-day retention for email and log data on its Free, Pro and Scale plans; any different agreed plan-specific retention applies where relevant. After termination of Insequa’s Resend account, remaining customer data is deleted within 90 days. These supplier account-termination arrangements are distinct from closure of a customer’s Tilly account.
• Website analytics data: per the cookies section below.

In some circumstances we will anonymise your personal information (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Insequa AI Solutions

Tilly is our Insequa AI Solutions product, which helps social care providers prepare their Provider Information Return (PIR) and related regulatory documentation. This section explains its data processing.

The customer organisation is controller for Customer Content and relevant public CQC registration information obtained for its selected Locations. Insequa acts as processor under the Customer DPA accepted by an authorised person on the organisation’s behalf at sign-up. Individuals can exercise their rights through that organisation; we assist it with requests and source information.

To operate the product we use Anthropic for draft generation; OpenAI for evaluation, refinement and real-time voice where used; paid Google Gemini as an AI fallback; ElevenLabs for text-to-speech; Supabase for primary database, authentication and file storage; Vercel for hosting; Inngest for live workflow orchestration and run state; Stripe for payments and billing; Resend for transactional email; and Sentry for error monitoring. Supplier details and safeguards are set out in Schedule 2 of the Customer DPA and are available from us on request.

AI-generated content is a draft requiring customer review. The product does not make automated decisions about individuals with legal or similarly significant effects. The customer instructs necessary access by authorised Insequa personnel for support, incident investigation and limited human sampling to assess accuracy, reliability and quality of the drafting service provided to that customer and identify service errors. Sampling is proportionate and uses anonymised or redacted material where practicable; personal and special category data are limited to what is strictly necessary. Access is confidential, restricted and logged. Working copies follow the customer’s retention and deletion instructions and are deleted when the check is complete unless needed for ongoing support or an incident. Sampling does not approve every draft, replace customer verification, disclose content to other customers or authorise unrelated research, general product development using identifiable content, or training providers’ general models.

Commercial Anthropic, OpenAI and paid Google Gemini API data is not used to train the providers’ general models. Zero Data Retention is not represented as enabled. Standard Anthropic and OpenAI request or abuse-monitoring retention may be up to 30 days; Gemini API abuse-monitoring data may be retained for 55 days. Provider safety or legal exceptions and any feature-specific stored state may have different periods. Insequa minimises retained content and applies deletion controls available under the applicable provider agreement.

ElevenLabs is used for text-to-speech. Insequa’s workspace-wide model training and improvement opt-out applies to new submissions from 6 October 2026. It does not apply retrospectively to previously submitted data or reverse any earlier model training. Standard provider retention continues to apply; Zero Retention Mode is not represented as enabled.

International transfers of personal data

The AI Solutions primary database and storage are hosted by Supabase in London, UK. Other providers process data outside the UK; UK primary storage does not mean all data remains in the UK. Relevant overseas processing includes:

• Anthropic, OpenAI and paid Google Gemini AI requests, ElevenLabs voice synthesis, Inngest workflow payloads and history, and Resend email delivery: United States
• Vercel hosting and Sentry error monitoring: EU, with relevant US support or provider access. Supabase’s contracting entity is in Singapore and its support/sub-processor chain may involve Singapore and the US. Stripe operates in the EU/UK with relevant overseas processing under its contractual safeguards.

For transfers outside the UK we use an applicable lawful mechanism:

• UK adequacy regulations, where the destination or recipient is covered; or
• Appropriate safeguards, including the UK Addendum to EU Standard Contractual Clauses where required. We assess relevant transfer risks and apply supplementary measures as necessary. You can request information about the safeguards by contacting our DPO.

Security

We implement appropriate technical and organisational measures to safeguard personal information against accidental loss and unauthorised access, alteration or disclosure. Personal data is encrypted in transit using TLS and at rest using the applicable hosting and storage providers’ encryption controls. Primary Supabase storage is encrypted at rest. We restrict access to authorised employees, contractors and providers with a legitimate business need, under confidentiality obligations and appropriate contractual safeguards. Customer Content accessed for support or quality checks remains subject to the customer’s DPA instructions.

We have put in place procedures to deal with any suspected personal information breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Marketing emails and email tracking

Marketing emails may use tracking to measure opens and link clicks only where the required consent has been obtained. You can withdraw marketing consent using “unsubscribe” or by emailing enquiries@insequa.co.uk. Cookie or similar tracking preferences are managed separately where applicable.

Transactional emails relating to your account, support, or invoicing are not marketing and will continue to be sent on the basis of the contract between us.

Who we share information with

We share personal information only where there is a clear reason and a lawful basis. The categories of recipients we use are:

• Providers that help deliver our services, including the AI and infrastructure suppliers identified above, and payment providers such as Stripe. The current AI Solutions supplier details are in Schedule 2 of the Customer DPA and are available on request.
• Professional advisers such as accountants, lawyers, and auditors
• HMRC, regulators, and law enforcement where required by law
• A buyer or successor in connection with the sale or restructuring of our business

We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes.

Links to other websites

Our website may contain links to other websites of interest. Once you have used these links to leave our site, we no longer have any control over the other website. We cannot be responsible for the protection and privacy of any information you provide while visiting such sites. You should exercise caution and look at the privacy policy applicable to the website in question.

Children's information

Our website and AI Solutions product are intended for adults acting for care providers. We do not seek information directly from children. A customer’s care records may contain information about a child; the customer is responsible as controller for that processing. If you have a concern, contact us and we will respond directly for our own data or assist the relevant customer as appropriate.

Your rights

Under UK GDPR you have the following rights in relation to your personal information:

• The right to be informed about how your information is being used
• The right of access — to ask for a copy of the personal information we hold about you
• The right to rectification — to ask us to correct inaccurate or incomplete information
• The right to erasure — to ask us to delete your personal information in certain circumstances
• The right to restrict processing — to limit how we use your information in certain circumstances
• The right to data portability — to ask for a copy of your information in a structured, commonly used format
• The right to object to processing based on legitimate interests, and to direct marketing at any time
• Rights related to automated decision-making and profiling — we do not carry out automated decision-making with legal or similarly significant effects on you

To exercise any of these rights, please contact us at enquiries@insequa.co.uk or write to us at Insequa Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

We may request proportionate information to confirm your identity and clarify the request. We respond within the statutory timescale, normally one calendar month. Where a lawful extension is needed because a request is complex or several requests have been made, we will explain it within the initial response period. Requests concerning a care provider’s Customer Content are handled by that provider as controller, with our assistance.

Cookies

A cookie is a small file placed on your device that helps the website work properly and helps us understand how the site is used. Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site.

Our CookieYes consent manager lets you choose whether to allow non-essential cookies and similar storage technologies. Use the “Consent Preferences” control on the website to see the current inventory, durations and categories and to change your choices. Strictly necessary technologies support functions you request; other technologies require the applicable consent before use.

Strictly necessary cookies

Necessary technologies support security, essential website functions, authentication and consent preferences. They include CookieYes’s consent record and the authentication technologies needed to sign in to Tilly. A technology is not exempt from consent simply because it is anonymous or uses local storage instead of a cookie.

Analytics cookies

Analytics technologies, including Google Analytics, HubSpot tracking and Vimeo analytics, measure website or embedded-video use. They require consent where applicable; HubSpot visitor and session tracking is not treated as essential merely because a session cookie is involved.

Advertising and marketing cookies

Advertising and marketing technologies include Google Ads/DoubleClick, relevant YouTube identifiers and visitor-identification tools such as Lead Forensics. They support advertising measurement, attribution or understanding which organisations visit the site, and require consent before use.

Browser storage and application authentication

Tilly uses browser storage for functional preferences, such as voice mode, and processing progress. Authentication storage keeps authorised users signed in. Strictly necessary storage is used to provide a function the user requests; storage for other purposes is subject to the applicable consent requirement. Persistent storage remains until its configured expiry or until it is removed or cleared through the application or browser. You can sign out and clear browser storage, although this may reset preferences or interrupt access.

Managing your cookie preferences

Use the website’s “Consent Preferences” control to update your choices or consult its current inventory. Browser settings also let you block or clear cookies and local storage. Blocking necessary authentication or security technologies may prevent the website or application functioning correctly.

For general guidance on managing cookies in popular browsers, visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie and storage durations vary by technology. Session items end with the browser session; persistent items last for their stated period or until cleared. The main technologies listed in the website’s CookieYes inventory on 5 October 2026 are set out below. The consent manager provides the current inventory, including third-party technologies associated with embedded content. Cookie duration is distinct from how long a provider retains resulting analytics or other server-side data.

Changes to this policy

We may update this privacy policy from time to time, for example if we change how we use personal information or to reflect changes in the law. When we make material changes we will post the updated notice on our website and, where you are an active customer, notify you by email.

Last updated:

6 October 2026