Legal
Privacy policy
What carbon.legal collects, who is responsible for it, and what you can ask for.
Last updated 1 October 2026.
Controller
Who is responsible
carbon.legal is operated by Fractional Quest Ltd, company no. 17322105, registered office 71–75 Shelton Street, London WC2H 9JQ.
Fractional Quest Ltd is the data controller for this site.
Accounts
There is no account on this site
carbon.legal has no sign-in, no password and no user account, and nothing you read here is tied to a person.
The account for this network lives on uksrs.org.uk, and everything about it — what it holds, what happens to it and what you can ask for — is in the privacy policy at uksrs.org.uk, summarised below.
Signing in
If you sign in on uksrs.org.uk
This site has no sign-in of its own.
The sign-in link in the header takes you to uksrs.org.uk, where the one account for this family of sites is made and held by Fractional Quest Ltd.
Signing in there does not sign you in here: no cookie crosses from uksrs.org.uk to this site.
If you make an account, it holds your name and surname, your email address, your organisation, and your activity and conversations in the member app, including what its assistant remembers.
Your sign-in
Your email address, the name you gave when you signed up (your email address stands in for it if you left it blank, or the name on your Google account), whether your address is verified, how you sign in (with a password or with Google), and your signed-in sessions, which the sign-in service records with the IP address and browser each came from.
Who processes it. Neon, which hosts the sign-in service and sends the codes. Google, only if you choose to sign in with Google.
How long. Until you delete your account.
Your profile
Your first name, your surname, the name you want to be called, and your photo if you upload one.
Who processes it. Neon, which hosts the database.
How long. Until you delete your data or your account.
Your organisation
The organisation you belong to and your role in it, requests to join, and invitations you send (which hold the colleague's email address). The organisation's own record holds its name, Companies House number, email domain and logo.
Who processes it. Neon. Companies House, when you search for your company: that sends the company's name or number to the public register, and nothing about you.
How long. Your membership until you delete your data. An invitation nobody answered is deleted 90 days after it was sent, and a revoked one 30 days after it was revoked; an accepted one is kept as the record of how that person joined.
Your company record
The company you confirmed and the figures you give or tap to confirm (headcount, turnover, balance sheet, year end and others), with the history of every change, and which version of the workspace terms you ticked.
Who processes it. Neon. If you ask the assistant to read your company's filed accounts, Interfaze reads that public document from Companies House to pull out the figures; nothing about you is sent. If your organisation switches on its API or a webhook, the organisation's record (not your name) goes to whoever holds its key, or to the address it sets.
How long. Until you delete your data or your account.
Your activity and conversations
Your messages to the assistant and its replies, your threads and their titles, what you kept in your working file, your plan board and its history, the steps behind each reply, and the text of any tender you upload (never the file itself).
Who processes it. Neon stores it. Vercel hosts the workspace and Railway runs the assistant. Each message, with the context the assistant needs, goes through the Vercel AI Gateway to the model that writes the reply (by default Anthropic's Claude).
How long. Until you delete your data or your account.
What the assistant remembers
Your own words, and the values you confirmed, held as a memory graph so the assistant can recall them in a later conversation. The assistant's replies are not sent to it, and neither is the text of a tender.
Who processes it. Zep, our memory provider.
How long. Until you delete your data or your account; it is erased first, before anything else.
Company look-ups and Slack
When the assistant looks your company up in public sources, the company's name and website, which go to a search provider; nothing else about you is in the search. If your organisation connects Slack, the link between your Slack user and your account, and the Slack threads the assistant answers in.
Who processes it. Exa and Tavily, the search providers. CopilotKit, which relays Slack messages to the assistant and holds those threads. Slack holds the messages under your organisation's own agreement with Slack.
How long. The Slack link and the relayed threads until you delete your data or your account.
Service records
Traces of what the product did (timings, which tool ran, errors, and your account and thread IDs, but not the content of your messages), request logs (IP address, browser, page and time), counters of how many messages your account sent in a minute and in a day, and, if your organisation uses the API, a log line and a counter per request with its IP address.
Who processes it. Pydantic Logfire (traces), Vercel and Railway (request logs), Neon (the counters and the API log).
How long. API request lines for 90 days. Traces and request logs for the periods Logfire, Vercel and Railway set. The counters have no deletion period set yet. None of these is deleted with your account.
That is a summary of the account; the full notice, with the purpose and lawful basis of each item, is the uksrs.org.uk privacy policy.
You can do each of these yourself, in Settings on uksrs.org.uk:
- See and correct: every figure on your company record can be edited, and the old value stays in the history.
- Export: Settings → Privacy → Export as JSON downloads your email, profile, organisation and company record. It does not include your conversations or the assistant's memory; ask us for those and we will send them.
- Delete your data: Settings → Privacy → Delete everything we hold about you erases every store in the account, the assistant's memory first. It leaves your sign-in, so signing in again gives you an empty account.
- Delete your account: Settings → Account → Delete account does all of that and then removes your sign-in. If the sign-in service refuses that last step, the screen says so and you can ask us to finish it.
For anything else about your account, write to hello@uksrs.org.uk.
Collection
What this site collects
carbon.legal loads no analytics or tracking script, so the cookie notice has one button, OK.
Pressing OK keeps a note in your browser’s local storage, under the key cookie-consent, so you are not asked again; it never leaves your device, and it is not consent to anything.
If an analytics tag is ever added, it will load only after you accept, and the notice will ask again; see the cookie policy.
Our hosting provider logs standard request metadata — IP address, browser type, page requested, time — in the course of serving the page.
The readiness check on this site runs in your browser; the figures you enter are not sent anywhere.
This site runs no analytics and sets no cookies of its own. Pressing OK keeps a note of that in your browser, so we do not ask again. Signing in happens on uksrs.org.uk, where an account holds your name and surname, email address and organisation, and your activity and conversations in the member app.
Today the site carries no analytics tag at all, so the notice asks for nothing.
If one is ever added, it will load only after you accept.
Bookings and email
If you book a call or email us
The booking page embeds Cal.com’s scheduler, and if you book, the name, email address and notes you give are processed by Cal.com under its own privacy policy.
If you email us, we hold what you send in order to reply; no fixed period is set for deleting it, and we will delete it if you ask.
Hosting logs, bookings and emails rest on our legitimate interests in running a secure site and answering what you asked us for (UK GDPR Article 6(1)(f)).
Rights
Your rights
Under UK data protection law you have rights to access, correct, erase, restrict or object to the processing of your personal data, and to data portability.
To exercise any of them, email hello@uksrs.org.uk.
You can also complain to the Information Commissioner’s Office.
Contact
How to contact us
hello@uksrs.org.uk · Fractional Quest Ltd · Company No. 17322105 · 71–75 Shelton Street, London WC2H 9JQ · © 2026 Fractional Quest Ltd.