Privacy
What we hold about you
In plain English, because you should be able to check it.
SECR Quest is a reference site with no sign-in and no account, and it holds almost nothing about you.
The account for this family of sites lives on uksrs.org.uk, which has its own policy.
Who we are
The controller
Fractional Quest Ltd, company no. 17322105, 71–75 Shelton Street, London WC2H 9JQ.
We are the data controller for everything on this page.
Privacy questions and requests to exercise any of the rights below go to hello@uksrs.org.uk, or in writing to that address.
Scope
Which site this covers
This policy covers secr.quest.
It is one of the UK sustainability reporting sites operated by Fractional Quest Ltd; there is one account across them, and it lives on uksrs.org.uk.
SECR Quest has no sign-in, no registration and no member area, so nothing here creates an account.
The sign-in link in the header takes you to uksrs.org.uk; everything about what an account holds, who processes it and how to delete it is on the uksrs.org.uk privacy policy, summarised below.
Signing in
If you sign in on uksrs.org.uk
This site has no sign-in of its own.
The sign-in link in the header takes you to uksrs.org.uk, where the one account for this family of sites is made and held by Fractional Quest Ltd.
Signing in there does not sign you in here: no cookie crosses from uksrs.org.uk to this site.
If you make an account, it holds your name and surname, your email address, your organisation, and your activity and conversations in the member app, including what its assistant remembers.
Your sign-in
Your email address, the name you gave when you signed up (your email address stands in for it if you left it blank, or the name on your Google account), whether your address is verified, how you sign in (with a password or with Google), and your signed-in sessions, which the sign-in service records with the IP address and browser each came from.
Who processes it. Neon, which hosts the sign-in service and sends the codes. Google, only if you choose to sign in with Google.
How long. Until you delete your account.
Your profile
Your first name, your surname, the name you want to be called, and your photo if you upload one.
Who processes it. Neon, which hosts the database.
How long. Until you delete your data or your account.
Your organisation
The organisation you belong to and your role in it, requests to join, and invitations you send (which hold the colleague's email address). The organisation's own record holds its name, Companies House number, email domain and logo.
Who processes it. Neon. Companies House, when you search for your company: that sends the company's name or number to the public register, and nothing about you.
How long. Your membership until you delete your data. An invitation nobody answered is deleted 90 days after it was sent, and a revoked one 30 days after it was revoked; an accepted one is kept as the record of how that person joined.
Your company record
The company you confirmed and the figures you give or tap to confirm (headcount, turnover, balance sheet, year end and others), with the history of every change, and which version of the workspace terms you ticked.
Who processes it. Neon. If you ask the assistant to read your company's filed accounts, Interfaze reads that public document from Companies House to pull out the figures; nothing about you is sent. If your organisation switches on its API or a webhook, the organisation's record (not your name) goes to whoever holds its key, or to the address it sets.
How long. Until you delete your data or your account.
Your activity and conversations
Your messages to the assistant and its replies, your threads and their titles, what you kept in your working file, your plan board and its history, the steps behind each reply, and the text of any tender you upload (never the file itself).
Who processes it. Neon stores it. Vercel hosts the workspace and Railway runs the assistant. Each message, with the context the assistant needs, goes through the Vercel AI Gateway to the model that writes the reply (by default Anthropic's Claude).
How long. Until you delete your data or your account.
What the assistant remembers
Your own words, and the values you confirmed, held as a memory graph so the assistant can recall them in a later conversation. The assistant's replies are not sent to it, and neither is the text of a tender.
Who processes it. Zep, our memory provider.
How long. Until you delete your data or your account; it is erased first, before anything else.
Company look-ups and Slack
When the assistant looks your company up in public sources, the company's name and website, which go to a search provider; nothing else about you is in the search. If your organisation connects Slack, the link between your Slack user and your account, and the Slack threads the assistant answers in.
Who processes it. Exa and Tavily, the search providers. CopilotKit, which relays Slack messages to the assistant and holds those threads. Slack holds the messages under your organisation's own agreement with Slack.
How long. The Slack link and the relayed threads until you delete your data or your account.
Service records
Traces of what the product did (timings, which tool ran, errors, and your account and thread IDs, but not the content of your messages), request logs (IP address, browser, page and time), counters of how many messages your account sent in a minute and in a day, and, if your organisation uses the API, a log line and a counter per request with its IP address.
Who processes it. Pydantic Logfire (traces), Vercel and Railway (request logs), Neon (the counters and the API log).
How long. API request lines for 90 days. Traces and request logs for the periods Logfire, Vercel and Railway set. The counters have no deletion period set yet. None of these is deleted with your account.
That is a summary of the account; the full notice, with the purpose and lawful basis of each item, is the uksrs.org.uk privacy policy.
You can do each of these yourself, in Settings on uksrs.org.uk:
- See and correct: every figure on your company record can be edited, and the old value stays in the history.
- Export: Settings → Privacy → Export as JSON downloads your email, profile, organisation and company record. It does not include your conversations or the assistant's memory; ask us for those and we will send them.
- Delete your data: Settings → Privacy → Delete everything we hold about you erases every store in the account, the assistant's memory first. It leaves your sign-in, so signing in again gives you an empty account.
- Delete your account: Settings → Account → Delete account does all of that and then removes your sign-in. If the sign-in service refuses that last step, the screen says so and you can ask us to finish it.
For anything else about your account, write to hello@uksrs.org.uk.
What we hold
If you just read this site
We hold nothing about you.
SECR Quest runs no analytics service and sets no analytics or preference cookies of its own.
If that ever changes, the tag will load only after you accept the cookie notice, and not before — declining, or never answering, means nothing is fetched.
Pressing OK on the cookie notice keeps a note in your browser’s local storage under the key cookie-consent, so you are not asked again; it stays on your device, is never sent to us, and is not consent to anything.
Our hosting provider’s standard server logs may record technical information such as IP address and browser type for security and reliability; we do not use them to build a profile of anyone.
Who else sees it
Booking a call, and emailing us
If you use the booking page, the booking widget is provided by Cal.com, which receives the details you enter and may set its own cookies to manage your scheduling session.
That processing is governed by Cal.com’s own privacy policy as well as this one.
If you email us, we hold that email and our reply in order to answer you; no fixed period is set for deleting them, and we will delete them if you ask.
Hosting logs, bookings and emails rest on our legitimate interests in running a secure site and answering what you asked us for (UK GDPR Article 6(1)(f)).
We do not send unsolicited marketing emails, and we do not share your information with third parties for marketing.
Nothing is sold, and nothing you send us trains a model.
Cookies
What the notice tells you
This site sets no cookies of its own and loads no tracking tags, whether or not you answer the cookie notice.
So the notice asks for nothing: it says what the site does, says where the account lives, and offers one button, OK.
Sign-in cookies are set by uksrs.org.uk on its own domain; none of them is set on, or read by, this site.
This site runs no analytics and sets no cookies of its own. Pressing OK keeps a note of that in your browser, so we do not ask again. Signing in happens on uksrs.org.uk, where an account holds your name and surname, email address and organisation, and your activity and conversations in the member app.
The rules are in the Privacy and Electronic Communications Regulations 2003, and the ICO’s guidance on cookies and similar technologies explains them.
Your rights
Your rights, and how to use them
Your rights over your personal data come from the Data Protection Act 2018 and the UK GDPR; the Information Commissioner’s Office explains them in plain terms.
To see, correct or delete anything we hold about you — in practice, an email you sent us — write to us and we will answer.
To object or to restrict how we use it, the same.
To complain. The ICO regulates us: you can complain to the ICO. We would rather you told us first.
Links out
Official sources this site links to
SECR Quest links to official UK government resources, which have their own privacy policies.
- The government’s environmental reporting guidelines, including SECR requirements.
- The Companies (Directors’ Report) and Limited Liability Partnerships (Energy and Carbon Report) Regulations 2018, which created SECR.
See also our terms of service, the cluster account terms, and the uksrs.org.uk privacy policy for the account.
Fractional Quest Ltd · Company No. 17322105 · 71–75 Shelton Street, London WC2H 9JQ · © 2026 Fractional Quest Ltd · Last updated 1 October 2026
Sources
The law this rests on
The legislation behind your rights, the regulator you can complain to, and the public record of who we are.
- legislation.gov.ukData Protection Act 2018
With the UK GDPR, the source of your rights over your personal data.
- legislation.gov.ukPrivacy and Electronic Communications (EC Directive) Regulations 2003
The rules on cookies and similar storage.
- Information Commissioner's OfficeFor the public — your data protection rights
- Information Commissioner's OfficeCookies and similar technologies
- Information Commissioner's OfficeMake a complaint
- Companies HouseFractional Quest Ltd — company 17322105
The public record of who runs this site.