Privacy policy
Last updated 1 October 2026
Template wording. This page is a starting draft and has not been reviewed by a solicitor. The operator must replace it with final legal wording before relying on it.
Who we are
Quality Tracker is operated by Mercer Materials ([Registered company name, company number and registered office address]). For the personal data described in "Account data" below we are the controller. For the records your organisation enters into its workspace we act as a processor on your organisation's behalf, under our data processing agreement.
What we collect
- Account data: your name, work email address, password (stored only as a salted hash) and the organisations you belong to.
- Workspace records: the batch, certificate, test, delivery, supplier, customer and lab records and any files your organisation uploads. These may include names of your staff, suppliers and customers.
- Billing data: the billing contact, address and VAT number. Card details are collected and held by Stripe and never reach our systems.
- Technical data: sign-in times, an audit trail of changes to records, and error reports. We do not log the contents of your records.
How we use it and our lawful bases
- To provide the service you have signed up for (performance of a contract).
- To keep the service secure, prevent abuse and fix faults (legitimate interests).
- To bill subscriptions and keep accounting records (contract and legal obligation).
- To send service messages such as confirmations, invitations and scheduled reports you have set up (contract). We do not send marketing email without your consent.
Where data is stored
Workspace records and account data are stored in a database in London, United Kingdom (AWS eu-west-2), with daily backups. Some suppliers below may process limited data outside the UK under appropriate safeguards such as the UK International Data Transfer Addendum.
Who we share it with
| Supplier | Purpose |
|---|---|
| Supabase | Database, sign-in and file storage (London region) |
| Vercel | Hosting the web application |
| Stripe | Subscription payments and invoices |
| Resend | Sending service emails and scheduled reports |
| Sentry | Error monitoring (no record contents) |
We do not sell personal data. We disclose it only to these suppliers, or where the law requires.
How long we keep it
Workspace records are kept while your organisation has a workspace. If a subscription ends, records are kept read-only so you can export them, and are deleted on request or when the workspace is deleted. Billing records are kept for six years as required for tax. Backups roll off within 30 days.
Your rights
Under UK GDPR you can ask for access to, correction of, deletion of or a copy of your personal data, and object to or restrict some processing. For records in a workspace, please ask your organisation's workspace owner first, as they control that data. Contact us at sebastian@mercermaterials.uk. You can also complain to the Information Commissioner's Office (ico.org.uk).
Cookies
We use only the cookies needed to keep you signed in and remember which workspace you are using. We do not use advertising or tracking cookies.
Changes
We will post changes here and, for significant changes, tell workspace owners by email.