Privacy Policy

Who we are

REGULEAD LTD is the controller of the personal information described in this policy. We are registered in England and Wales under company number 17420937. You can contact us at info@regulead.co.uk.

Information we collect

• Your email address, used for passwordless magic-link sign-in and account access.
• A first name or profile name, if you choose to provide one.
• Account and subscription information needed to operate subscriptions. Current records may include your account user ID, Stripe customer ID, Stripe subscription ID, Stripe price ID, subscription status, current period end and record timestamps.
• Information needed to keep you signed in, which may be stored in your browser. Ask also stores a local acknowledgement that you have seen its privacy notice.

ReguLead does not store payment card details. Stripe collects and handles payment details when its checkout is used.

Questions, learning and progress

Normal Ask ReguLead questions and answers are not stored by ReguLead. A question must be processed to produce an answer, including by the artificial-intelligence service used by Ask. That service is currently OpenAI, and ReguLead requests that responses are not stored by that service.

If Ask cannot answer because there is insufficient approved evidence, you can deliberately choose Send for Review. In that case, ReguLead stores the submitted question with your account user ID, timestamps, review status and internal review notes. The submission record does not copy your email address or profile name. Please do not include names or other unnecessary identifying details in a question.

Typed answers and reflections in Practise and Challenge Me are not currently stored. Progress activity is not currently stored.

How and why we use information

We use personal information only where needed to:

• create and secure your account, keep you signed in and provide the service;
• operate and maintain account and subscription records;
• process an optional Send for Review request and manage its internal review;
• protect ReguLead, prevent misuse and resolve technical problems; and
• meet legal, regulatory, accounting or security obligations where they apply.

Our lawful bases

UK data protection law requires us to have a lawful basis for each use of your personal information. In plain terms:

Performance of our contract with you. We rely on this where processing is necessary to create and authenticate your account and give you access to it; to process your Ask ReguLead questions so we can provide the answer you asked for; to maintain the account and subscription records needed to provide a subscription; and to process and manage subscription payments through Stripe.

Our legitimate interests. We may rely on this for optional profile personalisation where appropriate; for processing a question you deliberately submit through Send for Review, so we can identify gaps in our approved evidence and improve the service; for protecting ReguLead and its subscribers against misuse or unauthorised access; and for diagnosing technical problems and keeping the service reliable. Where we rely on legitimate interests, we consider whether those interests are proportionate and whether your own rights and interests override them.

Legal obligation. We rely on this only where we genuinely need to process or keep information to comply with a legal obligation — for example applicable company, tax or accounting record-keeping where genuine transactions take place.

Service providers and sharing

We share information only where necessary to operate ReguLead. Supabase provides authentication and database infrastructure. Stripe provides checkout and payment processing. OpenAI processes Ask prompts to generate responses. Hosting and other technical service providers may process limited information needed to deliver, secure and maintain the service.

We may also disclose information where the law requires it, to protect legal rights or safety, or in connection with a business reorganisation where appropriate safeguards apply. We do not sell personal information.

International processing and transfers

Some of the technology providers we use to operate ReguLead are international organisations, so your personal information may be processed outside the United Kingdom. This applies to Supabase, which provides authentication and database infrastructure; to Stripe, which provides checkout and payment processing; to OpenAI, which processes Ask prompts to generate responses; and to hosting and technical infrastructure providers where applicable.

Where UK personal information is transferred internationally, we expect the safeguards required by UK data protection law to apply through the relevant provider arrangements, such as recognised adequacy arrangements or approved contractual transfer mechanisms where applicable. We cannot guarantee a specific country of processing for every provider.

As explained above, requests sent to OpenAI ask that responses are not stored by that service.

Tracking and marketing

ReguLead currently has no advertising tracking or behavioural analytics system. It does not currently use Google Analytics, Meta Pixel, Microsoft Clarity, PostHog, Mixpanel, Plausible or an equivalent service. There is currently no newsletter or marketing-email system, and abandoned checkouts are not tracked.

Necessary browser storage, and authentication or session technology, may still be used to keep you signed in and remember the Ask privacy acknowledgement.

Necessary technical information may also be processed by our hosting and infrastructure providers in order to operate, secure and troubleshoot the service. That is part of running the service reliably and is not advertising or behavioural tracking.

How long we keep information

We keep account, profile, subscription and Send for Review information only for as long as reasonably needed for the purposes described above, including operating the service, resolving disputes, maintaining appropriate records and meeting legal obligations. The appropriate period depends on the type of information and why it is held. We do not claim a fixed deletion period where one has not yet been set.

Third-party service providers may retain information in accordance with their own applicable service terms, legal obligations and data-processing arrangements.

Your UK data protection rights

Depending on the circumstances, you may have rights to access, correct or erase your personal information; restrict or object to its use; and receive information you provided in a portable format. You may also complain to the UK Information Commissioner's Office.

To ask a privacy question or exercise a right, email info@regulead.co.uk. We may need to confirm your identity before acting on a request.

Changes to this policy

We may update this policy as ReguLead changes. The current version will be available on this page. You can also find our company details on the Contact page.

Last updated: 19 September 2026.