What we collect, and why

Who we are

ScopeAgreed Ltd ("ScopeAgreed", "we", "us") is a company registered in England and Wales. We are the data controller for personal data collected through scopeagreed.com and the ScopeAgreed app.

For data your clients provide when they approve or decline a change request, you (our customer) are the controller and we act as your processor under the terms of service.

What we collect

We collect only what we need to run the service:

• Account details: your name, email address, business name and password (stored hashed).
• Project data: baselines, change requests, goodwill entries, milestones, fees and any documents you upload, such as signed proposals.
• Client contact details: the names and email addresses of the clients you send approvals to.
• Approval records: who approved or declined a change, when, and from which IP address, so the record stands up later.
• Billing: your plan, invoices and the last four digits of your card. Full card details are held by our payment provider, never by us.
• Usage and device data: pages visited, features used, browser and device type, collected through the cookies described in our cookie policy.
• Messages: anything you send us through the contact form, support centre or email.

How we use it

We use your data to:

• Provide the service: store baselines, send approval emails, log decisions and generate reports.
• Send transactional email, such as approval requests, reminders and receipts. These are part of the service and cannot be switched off while you have an account.
• Send product updates and tips. You can opt out of these at any time from the email or your settings.
• Bill you for your plan and prevent fraud.
• Understand how the product is used so we can improve it.
• Produce aggregated, anonymised statistics and benchmarks, such as typical rates of scope change. These are combined across many accounts and stripped of anything that could identify a person or business, as described in the terms.
• Meet our legal obligations, including tax and accounting rules.

We do not sell personal data, and we do not use your project data to train machine-learning models.

Our legal bases

Under UK GDPR we rely on:

• Contract: to provide the service you signed up for.
• Legitimate interests: to secure the service, prevent abuse, understand usage and tell existing customers about relevant changes. We balance this against your interests and you can object at any time.
• Consent: for optional analytics cookies and for marketing email where consent is required.
• Legal obligation: to keep financial records.

Your clients' data

When you send a change request, your client receives an email with a link to approve or decline. They do not need an account. We store their name, email, decision, timestamp and IP address so you have a reliable record.

We process this data on your instructions. You are responsible for having a lawful basis to share their details with us, which in practice is the contract you already have with them. Clients can contact us directly to exercise their rights and we will involve you where we need to.

Who we share it with

We share data only with the providers we need to run ScopeAgreed, each bound by a data processing agreement:

• Cloud hosting and database providers in the UK and EU.
• An email delivery provider for approval emails, reminders and receipts.
• A payment provider for billing.
• An analytics provider, where you have consented to analytics cookies.
• A geolocation lookup service, which receives a shortened form of visitor IP addresses to resolve a country and city for our own visit statistics. The shortened address does not identify a device.
• Professional advisers and authorities, where the law requires it.

If ScopeAgreed is acquired or merges with another company, your data would transfer with the service, under the same protections.

International transfers

Your data is stored in the UK and the European Economic Area. Where a provider processes data outside those regions, we rely on the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

• Account and project data: for as long as your account is open, then 90 days after you close it so you can change your mind or export.
• Approval records: kept with the project. Because they exist to prove what was agreed, we keep them until you delete the project or close your account.
• Billing records: seven years, as required by UK tax law.
• Support messages: three years from the last message.
• Analytics data: aggregated after 14 months.

Your rights

You can ask us to:

• Give you a copy of your personal data.
• Correct anything that is wrong.
• Delete your data, where we have no legal reason to keep it.
• Restrict or object to how we use it.
• Export your project data in a portable format. You can also do this yourself from Settings.
• Withdraw consent for anything you consented to.

Email info@scopeagreed.com and we will respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put things right first.

Security

Data is encrypted in transit and at rest. Access inside ScopeAgreed is limited to the people who need it to support you, and is logged. Passwords are hashed and never stored in plain text. If we ever have a breach that puts you at risk, we will tell you and the ICO within 72 hours of becoming aware of it.

Changes to this policy

When we make a material change we will email account holders and show a notice in the app at least 14 days before it takes effect. The date at the top shows when this version was last updated.