Privacy policy
FreQNC Privacy Policy
Version 2.0 · 16 October 2026 · Replaces the Data Protection Position Statement (August 2026)
1. Who we are
FreQNC Limited, company number NI739835, 19 Arthur Street, Belfast, Northern Ireland, BT1 4GA. ICO registration C2052854. We follow the UK GDPR, the Data Protection Act 2018 and, for people in the EEA, the EU GDPR.
Privacy contact: Rachel McMullin, Founder and CEO, rachel@freqnc.co.
2. What we collect and why
FreQNC is the controller for everything in this table.
| Who | What | Why and lawful basis | Kept for |
|---|---|---|---|
| Website visitors | Usage data and cookies — this site sets no cookies and loads no analytics | Running the site (necessary). Analytics only with your consent | 12 months |
| Enquiries and business contacts | Name, work email, role, company, messages | Replying and arranging work (legitimate interests) | 12 months after last contact |
| Clients | Contact, contract and billing details | Delivering the contract; tax law | 6 years |
| Marketing contacts | Work email | Updates about our services (legitimate interests; unsubscribe any time) | Until you unsubscribe |
| Research participants | Contact details, recordings, transcripts, notes | Developing our services ([consent / legitimate interests]). Never quoted or named publicly without written agreement | 24 months, or sooner on request |
We don't sell personal data or make automated decisions with legal or similar effects.
3. The AI Bottleneck Diagnostic
The client is the controller and FreQNC is the processor, acting only on the client's written instructions. Engineers should also read their employer's privacy notice.
- Source: the client's own GitHub activity records, collected by the client on its own computer.
- We collect: for each change, the week opened, hours per step, size, top-level folder, number of reviewers, whether changes were requested, whether it was undone, any AI marker, and whether it was approved out of hours or during an outage. Plus team-level context from leadership.
- We never collect: code, comment or description text, names, usernames, anything that tracks a person, exact dates or times, or conversations with AI tools.
- Protecting individuals: we report on teams only. Where fewer than 5 people review or release in a repository, we leave out timing and review-sharing figures. Clients agree in writing not to use findings in performance, disciplinary or team-size decisions.
- Deletion: all data, including any call recording made with the client's agreement, is deleted within 14 days of the report, and we confirm this in writing. Summary figures with all names removed are kept only if the client opts in.
Engineers can use their rights through their employer. We'll pass on any request we receive.
4. Who we share data with
Only the suppliers below, each under a written contract. We tell clients before adding a supplier that handles Diagnostic data.
| Supplier | Purpose | Diagnostic data | Location |
|---|---|---|---|
| Microsoft (OneDrive) | Diagnostic file upload and storage | De-identified files | UK |
| Anthropic (Claude) | AI writing assistant; doesn't train on our data | Coded team-level findings only, never data files | US |
| Google Workspace | Email and documents | No | US |
| Notion | Planning | No | US |
| Zoom / Google Meet | Calls | Recordings only with agreement | US |
| HubSpot | Business contacts | No | EU |
| Lovable | Website | No | EU |
Transfers outside the UK use the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations.
5. Security and regulated clients
- Diagnostic files arrive through an expiring upload-only link and are stored with two-step login.
- Analysis happens on an encrypted, unsynced FreQNC laptop. Data files never go into online or AI tools.
- Our collection tool is readable before it runs, uses read-only GitHub access that expires in 7 days, and comes with a checksum.
- Only named FreQNC staff can access client data, under confidentiality obligations.
- We report personal data breaches to clients without undue delay, within the time set in our data processing agreement.
- We support clients' supplier due diligence, audits and impact assessments, including under FCA and PRA outsourcing rules, DORA and the NHS Data Security and Protection Toolkit.
6. Your rights and complaints
You can ask to access, correct, delete, restrict or move your data, object to its use, or withdraw consent. Email rachel@freqnc.co. We reply within one month, usually free of charge.
If you have a complaint, tell us first. We acknowledge complaints within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint or 0303 123 1113.
7. Changes
We review this policy yearly and when our services change. We tell clients first about any change affecting Diagnostic data.