Privacy Policy

Who we are

InfoMetrIQ is a product by Lothringer. For any privacy-related queries, contact us at infometriq@lothringer.co.uk.

Lothringer is registered with the UK Information Commissioner's Office (ICO) under registration number ZC265630.

What data we collect

When you create an account we collect:

• Username — chosen by you at registration
• Email address — used to identify your account
• Who the account is for — whether you're an individual, a business, a charity, an education provider, a public sector organisation or something else; for businesses, optionally the sector and how many people work there
• Password — stored as a salted hash using scrypt; we never store your password in plain text

When you use the canvas editor we store the survey data you create (question nodes, links, and labels) so that your work can be saved and retrieved.

We also record standard server logs (IP address, request path, timestamp) for security and diagnostic purposes.

If you accept analytics cookies, Google Analytics collects information about how you use the site (pages visited, approximate location, device and browser type). See our Cookie Policy.

How we use your data

• To authenticate you and maintain your session
• To save and display your surveys
• To suggest survey templates that fit your organisation, and to understand who uses InfoMetrIQ
• To allow administrators to manage the platform
• To investigate security incidents or abuse
• With your consent, to understand how the site is used and improve it (Google Analytics)

We do not sell, share, or use your data for advertising or profiling.

Legal basis

We process your data on the basis of the contract formed when you create an account (providing the service you signed up for) and our legitimate interest in keeping the platform secure and operational. We use your account type, and your business sector and size if you choose to give them, on the basis of our legitimate interest in tailoring the service to you and understanding who uses it. Analytics cookies are used only with your consent, which you can withdraw at any time via Cookie settings in the footer.

Data retention

Your account data is retained for as long as your account is active. Survey data is retained until you or an administrator deletes it. You may request deletion of your account and all associated data at any time by contacting us.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict processing
• Lodge a complaint with the ICO (ico.org.uk)

To exercise any of these rights, email infometriq@lothringer.co.uk.

Security

Passwords are hashed with scrypt and a random salt before storage. Sessions are managed server-side with an HTTP-only cookie. Connections to our database use TLS.

Cookies

We use a small number of strictly necessary cookies and, only if you accept them, Google Analytics cookies. See our Cookie Policy for details.

AI features

Some features use AI provided by Anthropic (the Claude models). Data is only sent when you choose to use one of them:

• AI survey generation — the topic and any instructions you type are sent so a draft survey can be produced.
• First-survey wizard — what your survey is for, what you hope to learn, who will answer it and the tone you pick are sent so a first draft can be produced. We keep your answers only until you accept the draft, then keep just the options you chose (not the text you typed) to understand how the wizard is used.
• AI analysis of results — your survey's questions, its aggregated results and, if you choose a free-text analysis, the free-text answers respondents gave. Answers to email-address questions are never sent.

Anthropic processes this data only to return the result to us. Under its commercial terms it does not use it to train its models, and it deletes it after a limited retention period. Anthropic processes data in the United States (see Sub-processors below).

Free-text answers can contain whatever respondents chose to type, including personal information. If you plan to analyse free-text answers with AI, avoid asking respondents for personal details in those questions. If your survey asks about health or other sensitive topics, only use free-text AI analysis if your respondents were told about it.

For each AI request we record the feature used, the number of AI tokens and the cost against your account, so we can apply plan limits and prevent abuse. We store the analysis reports you generate with your survey; we do not store the content of AI requests separately.

Emails we send

We send emails only to run your account and to reply to you:

• Account emails — email address verification (with up to two reminders if you haven't confirmed your address yet), a welcome email and password reset links.
• Contact and pricing requests — when you use the contact form or ask about a plan, what you write is emailed to us so we can reply.

We do not send marketing emails or newsletters. Emails are sent through Microsoft Azure Communication Services, with data stored in the United Kingdom.

Customer contacts (CRM)

Storing customer contacts and sending surveys to them by email is not available yet. No customer contact data is collected or stored today. We will update this policy before this feature launches.

Survey respondents

People who answer a survey do not need an account. For each response we store the answers given and when they were given. We do not store respondents' names, IP addresses or device details with their answers, and survey pages never use analytics cookies. Our standard server logs (see What data we collect) still record IP addresses for security.

A survey's owner decides what it asks and is responsible for the responses: the owner is the controller of that data, and we process it on their behalf. If a survey asks for personal information, such as an email address, that answer is stored like any other. Responses are kept until the survey owner deletes them or deletes the survey. Some surveys ask about health or other sensitive topics. The survey owner is responsible for that data and for asking for your consent where it is needed.

If you answered a survey and want to access or delete your answers, contact the organisation that asked you to take part; we will help them respond.

Sub-processors

We use the following service providers to run InfoMetrIQ. Each one processes personal data only on our instructions and under a written agreement with us.

Provider	What they do for us	Where the data is processed
Microsoft Azure (App Service, Azure Database for PostgreSQL)	Hosts the application and stores all account, survey and response data.	United Kingdom (UK West)
Microsoft Azure Communication Services	Sends account emails (verification, welcome, password reset) and forwards contact and pricing requests to us.	United Kingdom
Anthropic, PBC	AI survey generation and AI analysis of results, only when you use these features.	United States, under Anthropic's Data Processing Addendum, which includes the UK International Data Transfer Addendum
Google (Google Analytics 4)	Website analytics, only if you accept analytics cookies.	European Union and United States, under the UK Extension to the EU–US Data Privacy Framework

We will update this list before we start using a new sub-processor.

Changes to this policy

We may update this policy from time to time. The date at the top of this page will reflect any changes.