equate
Sign in

Privacy Policy

Effective date: 15 June 2026

This policy explains how equate ltd (“equate”, “we”, “us”) collects, uses, and protects personal data in connection with the equate platform. We are the data controller for the personal data we collect about you as a user.

For personal data that you upload to equate as part of your business operations (such as data within invoice documents or booking records), you are the data controller and we act as your data processor. This is covered by our Data Processing Agreement.

1. Who we are

equate ltd is registered in England and Wales. Our registered office is 167–169 Great Portland Street, London, England, W1W 5PF. We are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data we collect

Account and contact data

When you create an account or contact us, we collect your name, email address, password (hashed), and any other information you choose to provide. If your organisation uses our invitation feature, we collect the email addresses of invited users.

Billing data

If you subscribe to a paid plan, payment is handled by Stripe. We do not store your card details. We receive and retain billing metadata such as your invoice history, subscription tier, and matched booking usage.

Business data

When you use the Service, you upload supplier invoices, booking records, and related documents. This data may contain personal data relating to your customers, staff, or suppliers. You are the controller for this data; see our Data Processing Agreement.

Usage data

We collect information about how you use the Service, including log data, feature usage, page visits, IP addresses, browser type, and error reports. This data is used to operate, improve, and secure the Service.

Cookies

We use strictly necessary cookies to maintain your authenticated session. We do not use advertising or tracking cookies. Analytics are collected in aggregate by Vercel Analytics without cookies.

3. How we use your data

We use personal data to:

  • create and manage your account;
  • provide, operate, and improve the Service;
  • process payments and manage subscriptions;
  • send transactional emails (account confirmation, invoices, alerts);
  • investigate security incidents and enforce our Terms of Service;
  • comply with legal obligations.

4. Legal basis for processing

We rely on the following legal bases under UK GDPR:

  • Contract performance for processing necessary to provide the Service to you (account management, billing, service delivery).
  • Legitimate interests for operating and improving the Service, detecting fraud, and ensuring security, where these interests are not overridden by your rights.
  • Legal obligation for processing required to comply with applicable laws.
  • Consent where we specifically ask for it, such as for optional marketing communications.

5. Who we share data with

We use a small number of trusted third-party processors to run the Service. These cover the following categories of processing:

  • Cloud database, authentication, and file storage.
  • Application hosting and edge compute.
  • Payment processing.
  • Transactional email delivery.
  • Error monitoring and operational logging.

An up-to-date list of our processors, including their names and locations, is available on request by contacting us at the address below.

We do not sell your personal data or share it with third parties for their own marketing purposes.

We may disclose personal data if required by law, court order, or to protect the rights, property, or safety of equate, its users, or the public.

6. International transfers

Some of our processors are based outside the UK or EEA. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or standard contractual clauses approved by the ICO or European Commission.

7. How long we keep data

We retain account data for as long as your account is active and for a reasonable period afterwards to comply with legal obligations, resolve disputes, and enforce our agreements. Business data (invoices, booking records, extraction results) is retained for the duration of your subscription and deleted 30 days after account closure, unless you request earlier deletion.

8. Your rights

Under UK GDPR, you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data deleted in certain circumstances;
  • restrict or object to our processing of your data;
  • receive your data in a portable format;
  • withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at hello@equatetravel.ai.

9. Security

We use industry-standard security measures including AES-256 encryption at rest and TLS 1.3 in transit. Access to personal data is restricted to staff who need it to operate the Service. We maintain an audit log of all actions taken within the platform.

10. How to complain

If you have a concern about how we handle your personal data, please contact us first at hello@equatetravel.ai. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

11. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or by displaying a notice in the Service. The effective date at the top of this page shows when the policy was last updated.

12. Contact

For any questions about this policy or your personal data, please contact us at hello@equatetravel.ai or write to us at 167–169 Great Portland Street, London, England, W1W 5PF.