Privacy notice
Contents
1. Who we are
Every Thing Right HR is a trading name of Fraser Reading, who is the controller of your personal data. Address: 203 West Street, Fareham, Hampshire, PO16 0EN. Contact: hello@everythingright.co.uk.
2. Calculators and documents
Everything you type into a calculator stays on your device. The figures are worked out in your browser, and PDFs, Word letters and spreadsheets are made there too. None of it is sent to us.
Your answers are kept in your browser while the tab is open, so you can go back and change them. Close the tab and they're gone. If you upload a spreadsheet for a bulk run, it's read in your browser and isn't uploaded.
3. What we do collect
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Purchase records: product, reference, payment reference, your email address, and when you agreed to immediate download. For the redundancy Statement and Pack, also a one-way code made from the date of birth you entered (not the date itself) | To supply what you bought, handle refunds and disputes, and keep tax records. The code lets you update your documents later while stopping one purchase being reused for someone else | Contract; legal obligation | 6 years |
| Card and billing details | Taken and held by Stripe, not by us | Contract | Under Stripe's policy |
| Business accounts: email, plan, renewal date and organisation name (a logo stays on your device) | To run your plan | Contract | While active, then 6 years for billing |
| Enquiries (letters, mediation, the Business plan, working with us or listing, rates updates and general questions): name, email, phone if given, organisation, what you need, the page you were on, and a scrambled (hashed) form of your connection address to stop spam | To reply, quote, and pass a mediation enquiry to our partner if you ask us to | Legitimate interests; steps before a contract | 2 years |
| Partner listings: your sign-in email, the profile you write, your regulator or membership number, your subscription status, and monthly counts of how often the listing was shown and clicked | To run, check and show your listing, and to bill for it through Stripe | Contract | While listed, then 6 years for billing |
| Email log: a scrambled (hashed) form of each address we email, and when | So the site can't be used to flood anyone with email | Legitimate interests | 30 days |
| Help messages and figure reports | To answer you and fix mistakes | Legitimate interests | Until resolved, then 1 year |
| Marketing emails and the April rates update, only if you ask for them | Occasional HR tools and guides | Consent | Until you unsubscribe |
4. Agree it in writing
We keep the names and email addresses of both people in an agreement, its status, the reply-by date, when each person joined and last opened it, and whether it has been paid for, so we can send reminders and keep it running.
What you write is encrypted on your device with a key that only you and the other person hold, in your private links. We can't read it, and our emails never include it. We also keep a scrambled (hashed) form of the connection address that started it, to stop misuse. We delete each agreement 90 days after it closes, or 180 days after it goes quiet.
The lawful basis is contract for the person who starts and pays, and for the invited person once they join. The invitation itself is sent from the starter's own email, not by us. If you were invited and don't want to take part, just ignore it: you'll get at most two reminders. Your details are deleted with the agreement.
Please keep health details and allegations out of what you write. If you include them, they're protected by the same encryption.
5. Mediation
If you ask about mediation, we pass your enquiry to our accredited mediation partner with your permission. Our partner is a separate controller for the mediation itself and will explain how they handle your information.
6. Who we share data with
We use these providers to run the site. Each acts on our instructions under a data processing agreement.
- Stripe: payments
- Lovable Cloud (Supabase): hosting, database, server functions and sign-in emails
- Resend: receipts, enquiry replies, agreement updates and reminder emails
- Umami: cookie-free visitor statistics, where switched on
- Cal.com: booking calls, where offered
Some of these providers process data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or the UK's approved contract terms. We don't sell personal data, and we don't share it for advertising.
8. Your rights
You can ask for a copy of the personal data we hold about you, and ask us to correct it, delete it, restrict how we use it, or send it to you in a portable form. You can object to our use of it based on legitimate interests, and withdraw consent for marketing at any time by replying to any email from us or contacting us.
Email hello@everythingright.co.uk. We'll reply within one month. We can't provide or delete anything stored only on your own device, but you can clear it from your browser.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
9. Security and changes
Our database is reached through our own server functions. The only thing a browser can read directly is a signed-in person's own account record. Payments are checked on the server, and the owner account needs a confirmed email address. We'll update this notice when what we do changes, and show the date at the top. See also our terms of use.