Privacy Policy

1. Introduction

We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

Belonge Limited is a company registered in England and Wales (Company No. 16713221) and is registered with the Information Commissioner's Office (ICO Registration No. ZC071681).

By using Belonge, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

Account & Authentication Data

When you create an account or sign in, we collect:

• Name, email address, and login credentials (passwords are securely hashed and never stored in plain text)
• Profile information, preferences, and workplace situation details you choose to share

AI Companion Interactions

When you use our AI-powered workplace companion, we collect:

• Messages and conversation history with the AI assistant
• Context you provide about your workplace situation to personalise guidance

Journal & Incident Records

When you use our journaling or incident-documentation features, we collect:

• Journal entries, incident descriptions, and related notes you create
• Dates, categories, and any tags you assign to entries

Uploaded Documents & Files

When you upload files (e.g. evidence, contracts, or other documents), we collect:

• The files themselves and associated metadata (file name, size, upload date)
• These files are stored securely and only accessible to you unless you explicitly choose to share them

Payment & Transaction Data

When you make a purchase (e.g. guides, templates, or subscriptions), we collect:

• Billing name and email address
• Transaction history and purchase records
• We do not store your full card details. All payment processing is handled securely by a trusted third-party payment processor

Device & Mobile App Data

When you access Belonge via our mobile app or progressive web app (PWA), we may additionally collect:

• Push notification tokens (if you opt in to notifications)
• Device type, operating system, and app version
• Crash reports and performance data to improve the app experience

Usage Data

We automatically collect certain information when you access our platform, including:

• Device and browser information
• IP address and location data
• Pages visited and features used
• Time and date of access

3. Legal Basis for Processing

Under the UK GDPR and EU GDPR, we process your personal data on the following lawful bases:

• Contract: Processing necessary to provide you with the Service (account management, AI companion, journaling, document storage, and purchased guides/templates)
• Consent: Where you have opted in, such as push notifications, marketing emails, and cookie preferences. You may withdraw consent at any time
• Legitimate Interest: Platform security, fraud prevention, service improvement, and analytics, where our interests do not override your rights
• Legal Obligation: Where we are required to process data to comply with applicable laws (e.g. tax records for transactions, responding to lawful requests from authorities)

4. How We Use Your Information

We use your information to:

• Provide, maintain, and improve our services
• Personalise your experience and recommendations
• Process transactions and send related information
• Send you updates, security alerts, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyse trends, usage, and activities
• Detect, investigate, and prevent fraudulent activities

5. Automated Decision-Making & AI Processing

Our AI companion uses your conversation inputs to generate personalised workplace guidance. You should be aware that:

• AI-generated responses are suggestions only and do not constitute legally binding decisions
• No automated decisions with legal or similarly significant effects are made about you without human oversight
• Your AI conversation data may be used in anonymised, aggregated form to improve the quality of the service
• You have the right to request human review of any AI-generated guidance by contacting us

6. Data Sharing and Disclosure

We do not sell your personal information. We may share your information with the following categories of third-party processors:

• Payment Processors: Trusted third-party payment providers who securely handle transactions on our behalf
• AI Service Providers: Third-party AI language model providers used to power the workplace companion (your prompts are sent to generate responses; we do not share your identity with these providers)
• Infrastructure Providers: Cloud hosting, database, and authentication service providers (hosted in the UK/EU)
• Legal Requirements: When required by law, court order, or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you have given us explicit permission to share

7. International Data Transfers

Your data is primarily stored and processed in the United Kingdom and the European Union. However, some of our third-party processors operate outside the UK/EEA:

• Payment processors (United States): Transfers are protected under Standard Contractual Clauses (SCCs) and compliance with UK/EU data protection frameworks
• AI service providers (United States): AI prompts are transmitted for processing. Transfers are governed by SCCs and data processing agreements

We ensure that all international transfers are subject to appropriate safeguards as required by UK GDPR Article 46, including Standard Contractual Clauses, adequacy decisions, or equivalent protections.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:

• Account data: Retained for the lifetime of your account and deleted within 30 days of account closure, unless required by law
• AI companion conversations: Retained while your account is active; deleted upon account closure
• Journal entries & uploaded documents: Retained while your account is active; permanently deleted within 30 days of account closure
• Payment & transaction records: Retained for 7 years after the transaction date to comply with UK tax and accounting obligations
• Usage & analytics data: Retained in anonymised form for up to 24 months
• Marketing consent records: Retained for as long as consent is valid, plus 12 months after withdrawal for audit purposes

9. Data Security

We implement appropriate technical and organisational security measures to protect your personal information, including:

• AES-256 encryption at rest and TLS (HTTPS) encryption in transit
• Primary data storage located in the UK with EU-based backup and redundancy
• Regular security assessments and access controls
• Securely hashed passwords (never stored in plain text)

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Your Rights

Under the UK GDPR, EU GDPR, and Nigeria's NDPR (2019), you have the following rights:

• Right of Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Request limitation of processing
• Right to Data Portability: Request transfer of your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interest or direct marketing
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing

To exercise any of these rights, please contact us at dataprotection@belonge.co.uk. We will respond within one month of receiving your request.

11. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority:

We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first at dataprotection@belonge.co.uk.

12. Cookies

We use cookies and similar tracking technologies. For more information about how we use cookies, please see our Cookie Policy.

13. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us and we will take steps to delete such information promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will notify you via email or an in-app notification. We encourage you to review this policy periodically.

15. Data Protection Contact

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your data protection rights, please contact us at: