Privacy Notice
This notice explains how v6o analytics collects and uses personal data when you visit our website, create an account, or use our service. It also explains the difference between the data we decide how to use (where we are the “controller”) and the data you upload for analysis (where we act on your instructions as a “processor”).
1. Who we are
v6o analytics is a trading name of V60 Studio Ltd, registered in England & Wales (company no. 17344826). Our registered office is as shown on the Companies House register for that company number. V60 Studio Ltd is the controller of the personal data described in Section 3.
- Contact: Sef Ahmed, sef@v60studio.co.uk
- Data protection officer: we are not required to appoint a statutory DPO. Data-protection queries go to the contact above.
2. Two roles — please read this first
v6o analytics handles personal data in two different capacities:
- As a controller — for the account, billing, website and support data described below. This notice governs that data.
- As a processor — for the spreadsheets and files you upload for analysis. That data is processed only on your instructions, for your purposes. You (our customer) are the controller of it, and your privacy notice governs the individuals in it. Our handling of it is set out in our Data Processing Agreement, not this notice — see Section 5.
3. Personal data we collect (as controller)
| Category | Examples | Source |
|---|---|---|
| Account data | Name, work email, company name, role | You, at sign-up |
| Billing data | Billing contact, subscription and payment records (card details are handled by our payment provider, not stored by us) | You / our payment provider |
| Usage & technical data | IP address, device/browser, log data, actions in the app | Automatically, when you use the service |
| Support & communications | Emails, messages, enquiry details | You, when you contact us |
| Marketing preferences | Opt-in/opt-out status | You |
We do not seek special-category data (e.g. health data) in account/website data.
4. How we use your data, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Create and manage your account; provide the service | Contract — Art. 6(1)(b) |
| Take payment and keep billing/tax records | Contract; and legal obligation — Art. 6(1)(c) |
| Keep the service secure; prevent fraud/abuse; keep audit/security logs | Legitimate interests — Art. 6(1)(f) |
| Understand usage to maintain and improve the product | Legitimate interests — Art. 6(1)(f) |
| Respond to your enquiries and provide support | Contract / legitimate interests |
| Send marketing about v6o analytics (if you opt in / are an existing customer) | Consent — Art. 6(1)(a), or soft opt-in |
Where we rely on legitimate interests, we have balanced those against your rights; you can ask us for details or object (Section 9).
5. Data you upload for analysis (our processor role)
When you upload a spreadsheet or file, we analyse it on your instructions to produce your dashboards, workbook and insights. For that data:
- You are the controller; v6o analytics is the processor.
- We process it only to provide the service you asked for. We do not use it to train AI models, and we do not use it for our own purposes.
- Our processing terms, security measures, breach-notification commitments and sub-processor list are in our Data Processing Agreement.
- Please do not upload special-category data (e.g. health records). Our terms ask you to confirm you won't, and we apply technical measures to flag likely sensitive fields.
6. Who we share data with (sub-processors)
We use a small number of trusted providers to run v6o analytics. Each is bound by a data-processing agreement. The current list is published on our sub-processor page. We will give at least 30 days' notice before adding a new sub-processor, and you may object.
We do not sell your personal data.
7. International transfers
Some of our providers are based outside the UK (mainly the US). Where personal data is transferred internationally, we rely on appropriate safeguards — the UK extension to the EU–US Data Privacy Framework, and/or the UK International Data Transfer Agreement / Standard Contractual Clauses — together with a data-processing agreement. Your uploaded files are stored at rest in the UK. They are sent to our AI sub-processor (Anthropic) in the US only for the analysis step; we delete each uploaded file immediately after its analysis completes, and Anthropic retains data in its analysis container for up to 30 days.
8. How long we keep data
| Data | Retention |
|---|---|
| Account data | For the life of your account, then up to 12 months |
| Uploaded files & outputs (processor) | Deleted on your request or at the end of your contract; you can export/delete at any time |
| Billing/tax records | 6 years, to meet UK tax/company-law requirements |
| Security/audit logs | 12 months; retained under a legal-obligation/legitimate-interest basis (a documented exception to erasure) |
| Support communications | 24 months |
9. Your rights
Under UK GDPR you have the right to: access your data; rectify inaccurate data; erase data (“right to be forgotten”); restrict or object to processing; data portability; and to withdraw consent at any time where we rely on it.
To exercise any right, email sef@v60studio.co.uk. We will respond within one month.
If your data is in a file another company uploaded to v6o analytics, we are only the processor — please contact that company (the controller); we will assist them in responding to you.
You also have the right to complain to the Information Commissioner's Office (ICO) — ico.org.uk, or 0303 123 1113 — though we'd appreciate the chance to help first.
10. Cookies
The marketing website at v60studio.co.uk does not currently set any cookies. Once you create an account, the service uses a small number of cookies, described below.
| Cookie / type | Purpose | Category | Consent needed? | Typical retention |
|---|---|---|---|---|
| Session / authentication | Keeps you signed in and secures your session (Firebase Authentication) | Essential | No | Session – up to 30 days |
| Security / anti-abuse (CSRF, rate-limit) | Protects the service against fraud and attacks | Essential | No | Session |
| Load balancing / preferences | Routes requests and remembers UI preferences (e.g. theme) | Essential / functional | No | Up to 12 months |
| Error monitoring (Sentry) | Diagnoses crashes and errors (PII minimised) | Analytics / functional | Yes, where non-essential | Up to 90 days |
We do not use advertising or cross-site tracking cookies. If we introduce a product-analytics tool, a cookie banner and an updated table will go live before it does.
11. Security
We protect your data with encryption in transit and at rest, access controls, and audited infrastructure. No system is perfectly secure, but we work to industry standards and will notify you of a relevant breach in line with our agreement and the law.
12. Changes to this notice
We may update this notice. We'll post the new version here with an updated date, and tell you about significant changes.