⚠️ Template Notice: This privacy policy is intended as a starting point only. Review the company details, providers, hosting locations, retention periods and every section to ensure they reflect your actual data practices before going live. This does not constitute legal advice — consult a qualified legal professional.

Privacy Policy

Effective date: 8 October 2026

Welcome to IQ EV (the "Service"), operated by Calvium Ltd ("we", "us", or "our"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit https://clvm-iq-ev-staging.pages.dev and use our Service. This policy provides information about our handling of personal data; it does not ask for your consent to that processing.

1. Information We Collect

1.1 Information You Provide Directly

Account information — when you register, we collect your email address and any profile details you choose to provide.
Authentication — you sign in directly with your email address and password through Supabase Auth. We do not currently offer sign-in through Google, GitHub, or other external identity providers.
User content — any content you create or submit through the Service.
Organisation information — organisation memberships, roles and invitations. An organisation administrator or another user may provide information about you, for example when inviting you. Items and comments may also contain personal information about other people.
Communications — if you contact us for support, we retain those communications.

1.2 Information Collected Automatically

Technical and log data — hosting and security services may process your IP address, browser details, requested URLs and timestamps. Application logs can include technical errors and identifiers needed to investigate them.
Cookies and browser local storage — we use these for authentication, security and remembering your preferences, as explained below.
Analytics — We do not currently use analytics to track your use of the Service.

1.3 Cookies, Local Storage and Your Choices

We use cookies and browser local storage to keep you signed in, support multi-factor authentication, and remember settings such as your selected organisation and sidebar layout.

Authentication storage is necessary to use the signed-in Service. Preference storage helps you return to your previous settings without selecting them again. These preferences are enabled by default.

You can turn off Remember my preferences in this browser in Settings → Details. Turning it off clears saved preferences and stops saving them again while the setting remains off. You can still make selections during a visit, but features that remember those selections between visits will stop working. Sign-in and multi-factor authentication continue to work. You can turn remembering preferences back on at any time from the same setting.

Your choice applies to the browser on the device where you make it. We retain a cookie named remember-preferences for one year to record your choice, including when you opt out. Clearing that cookie resets the setting to its default, so you may need to turn it off again.

We do not use advertising trackers.

2. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the Service
Create and manage your account
Respond to comments, questions, and support requests
Send transactional emails (e.g. password resets, account notifications)
Detect, prevent, and address technical issues or fraudulent activity
Comply with legal obligations

We will not sell your personal information to third parties.

Your email address is required to create an account and receive account emails. Providing other profile details is optional.

2.1 Who Is Responsible for Your Information

Calvium Ltd is the controller for personal information we use to administer accounts, operate and secure the Service, respond to support requests and meet our own legal obligations. This means we decide why and how that information is used for those purposes.

Where your organisation decides what information to submit and how to use it, it is the controller for personal information in that content. We act as its processor when storing and processing that content on its instructions. Your organisation is responsible for its reasons for using that information and for informing the people concerned. Contact your organisation about its use of your information; you can also contact us for help identifying the appropriate contact or with a request relating to our own processing.

2.2 Our Lawful Bases

For personal information we process as a controller, we rely on:

Legitimate interests (Article 6(1)(f) UK GDPR) — administering access for your organisation, sending necessary account and invitation emails, answering support requests, and operating, maintaining and securing the Service. Our interests, and those of customer organisations, are to provide a functioning service, support its users and protect accounts and information. This basis applies only where the processing is necessary and those interests are not overridden by your interests or fundamental rights and freedoms.
Legal obligation (Article 6(1)(c) UK GDPR) — where processing is required to meet an applicable legal duty, including responding to data protection rights requests and legally binding disclosure requirements.
Consent (Article 6(1)(a) UK GDPR) — where we specifically ask for your consent to an additional use or disclosure. You can withdraw that consent by contacting us.

These bases concern Calvium's own processing. Your organisation determines the lawful basis for personal information in content that we process on its behalf. A contractual licence to submit content does not replace the need for a lawful basis for personal data, or any additional condition required for sensitive personal data.

We may share your information with:

Supabase — we use Supabase for authentication and database hosting. Account information and data stored in the Service's database are processed by Supabase, hosted in the eu-west-2 (London) region.
Cloudflare — hosts and delivers the Service and connects it to the database. Requests pass through Cloudflare, which processes information needed to deliver and secure them, including network information and request content.
Resend — delivers transactional emails, including invitations, account verification and password-reset emails. It processes recipient email addresses and email content, which can include names, organisation details and account links.
Other users in your organisation — can access organisation content according to their permissions. This can include items and comments you make visible to the organisation.
Legal requirements — if required by law or in response to valid legal processes.
Business transfers — in connection with a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as a business asset.
With your consent — in any other case where you have given explicit consent.

The London hosting location above describes our primary Supabase resources. It does not establish the location of all processing by Cloudflare, Resend or other providers, including support access and processing by their own service providers.

3.1 International Processing and Transfers

Some provider processing takes place outside the UK. Resend stores email content and delivery information in the United States. Cloudflare operates internationally, and Supabase may use international support operations and service providers even where the primary resources are in London.

The providers' published data-processing terms include safeguards for restricted international transfers, including the European Commission's Standard Contractual Clauses with the UK Addendum for transfers covered by UK data protection law. These clauses impose contractual data-protection obligations on the recipient. The published terms are available from Supabase, Cloudflare and Resend. Contact us at hello@calvium.com for information about the safeguards applicable to your data or a copy of the relevant terms.

4. Data Retention

Accounts: We retain your account information until you delete your account.
Account deletion: You can delete your account in account settings. This removes your login, profile, avatar, memberships and comments from the live Service. Organisation items remain until deleted, including any personal information in those records.
Organisation deletion: An organisation administrator can manually delete the organisation and any associated data at any time in Organization → Settings. Members' accounts and data in other organisations remain.
Invitations: Invitation links expire after seven days. We keep invitation records, including the recipient's email and intended role, until accepted, declined or revoked, or the organisation is deleted.
Application logs: These are streamed live and are not stored.
Database backups: Standard daily backups are kept for seven days. Deleted data may remain in these backups until they expire.

Contact hello@calvium.com for help with deletion or to request removal of personal information remaining in organisation records.

5. Security

We use technical and organisational safeguards to protect your personal information against unauthorised access, loss, alteration, or disclosure. Multi-factor authentication (MFA) is available for account security but is not required for all users of this Service.

Calvium's system administrators can access all data held in the Service, including account information and organisation content.

6. Children's Privacy

The Service is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have inadvertently done so, we will delete that information promptly.

7. Your Rights

Under UK data protection law, you have rights regarding your personal information. Some rights apply only in particular circumstances and are subject to legal exceptions:

Access — the right to request a copy of the personal data we hold about you.
Correction — the right to request correction of inaccurate data.
Deletion — the right to request that we delete your personal data.
Portability — the right to receive your data in a structured, commonly used format.
Restriction — the right to request that we restrict certain processing activities.
Withdrawal of consent — where processing relies on your consent, the right to withdraw it at any time, without affecting the lawfulness of earlier processing.

Your right to object: where processing relies on legitimate interests, you can object on grounds relating to your particular situation. Contact us at hello@calvium.com to raise an objection.

To exercise any of these rights, please contact us at hello@calvium.com.

You also have the right to complain to the UK Information Commissioner's Office (ICO) about our handling of your personal information. Visit ico.org.uk/make-a-complaint or call 0303 123 1113. You do not need our permission to make a complaint. If you live outside the UK, you may also have rights under local law and a right to complain to your local data protection authority.