Raq.com

Raq.com Privacy Policy

Effective date: 28 February 2026. Last updated: 11 November 2026

This Privacy Policy explains how Vu AI Ltd (we, us, our) collects and uses personal data when you use Raq.com and related services (the Services).

Delete your account and data

To delete your Raq.com account and its data, email privacy@raq.com from the address you sign in with, using the subject Account deletion request. You do not need the app. We may ask you to confirm the account is yours, and we respond within one month.

This applies to Time Tracker by Raq.com, Raw by Raq.com, 280daily: Raq.com Journal, Agent Operator HQ and our other Raq.com apps. You can also delete your account in the app. In Time Tracker, Raw and 280daily, choose Settings > Account > Delete account. In Agent Operator HQ, choose Account > Delete Account, then Delete Profile, and confirm with the code we email you. One sign-in covers all our apps, so deleting it closes your account in each of them. If you are the only owner of a shared workspace, transfer ownership or close that workspace first.

When you delete your account, we remove your sign-in access and anonymise your name, email address and connected sign-ins. Your personal data, including personal time records and location stamps, is removed within 120 days. We keep an encrypted contact record for up to 90 days to answer support and audit queries.

Records you shared with a team, such as timesheets, project records and Raw recordings, can stay with that workspace while it is active, attributed to an anonymised user. Billing and tax records are kept for seven years. Pseudonymous security records and account history summaries, which do not name you, are kept indefinitely. Section 8 lists our other retention periods. You can also ask us to delete particular data without closing your account.

1. Controller and contact

  • Data controller: Vu AI Ltd
  • Registered office: Suite 15, 1666 High Street, Knowle, Solihull, United Kingdom, B93 0LY
  • Privacy contact: privacy@raq.com
  • ICO registration: ZB712921

If you have questions or requests, contact us using the details above.

2. Personal data we collect

We may collect the following categories of personal data:

Account and profile data

  • name, email address, password hash, profile details
  • organisation and workspace details
  • roles, permissions, and team membership.

Payment and billing

  • billing contact details and transaction metadata
  • payment status and invoices.

Payments are typically processed by third-party payment processors, and we do not store full card details.

Usage and device data

  • log data (IP address, browser type, timestamps, pages viewed, error logs)
  • device and session identifiers, approximate location derived from IP
  • usage metrics (tool usage, subscription usage, performance and reliability data).

Content you provide

  • any text, prompts, files, images, documents, messages, and other materials you upload or create
  • outputs generated from your inputs
  • for collaboration or community features, data you post or share with others.

Time Tracker data and optional location

Time Tracker stores your work entries, project and activity selections, notes, tags, timesheet submissions and time-off requests. These records are associated with your account and workspace.

Location is recorded only on projects set up to record clock-in location. On those, the mobile app asks for location permission while it is in use and records your location when you start, switch or stop a timer: approximate, or precise when the project checks you are on site. It never tracks your location in the background, and other projects collect no location.

Location records include coordinates, accuracy and the site-check result, and can be seen by you and people allowed to review that project's time. You can turn location off in your device settings, though a project that requires it may then refuse a new timer.

If you use AI quick add, your description and relevant project, activity, tag and recent-work context are sent to an AI provider to suggest entries. You review the suggestions before saving. The AI processing information below also applies to this feature.

Time Tracker extension for Chrome

The Raq.com Time Tracker extension starts and stops your Time Tracker timer from a Chrome side panel. To sign you in, it sends your email address to Raq.com, which emails you a code. The extension then keeps a sign-in token that works only for Time Tracker in that browser profile. It is not synced and is sent only to raq.com.

When you open the panel on a supported ClickUp, Asana, Jira Cloud, monday.com or Notion task, the extension sends that task's web address to Raq.com so it can find the linked task. It also sends your timer actions: start and stop times, the project or task and any note you add. It does not read page content, record your browsing history, take screenshots or log keystrokes, and it sends nothing to the project sites or anyone else. Access to the project sites is optional and can be turned off in the extension's settings. Disconnect signs that browser out.

Raw recordings, photos and optional location

Raw by Raq.com records video, audio and your screen, takes photos and scans documents, on your phone or in the browser. It stores what you record or import, with its titles, markers, notes, transcripts and text read from photos and pages, when it was recorded, and your device type, operating system version and app version. Recordings stay on the phone until they upload to your workspace.

Where the phone supports it, transcripts and page text are made on the phone and only the text is sent to Raq.com. The Android document scanner is provided by Google Play services.

Location is off unless you turn on Location for Walk and Talk in Raw's settings. The app then asks for location permission while it is in use and adds your precise location to Walk and Talk recordings. Raw does not collect location for other recordings or at any other time.

A recording is private to you unless you share it with your team in that workspace. On paid plans you can also create a public link, and anyone with the link can watch or listen until you remove it. If you connect an AI agent of your own to Raq.com, it can read your recordings and their text when you ask it to, and its provider handles that data under its own terms.

On a free plan, recordings are deleted 30 days after they upload. On a paid plan they are kept until you delete them, unless you choose automatic deletion after 7, 30 or 90 days or a year.

AI transcripts and a short brief are available on paid plans and are off by default. Each person can turn them on in Raw's settings after a confirmation that says what will be sent. While they are on, Raq.com sends the following through OpenRouter to third-party AI model providers (currently Google's Gemini models): the sound of recordings the phone did not transcribe, photos from photo sets whose text the phone could not read, and a recording's transcript, title and markers to write its brief. The video picture is never sent. Results are stored with the recording, and turning the setting off stops new requests. The AI processing information below also applies.

Agent Operator HQ and Nature Work AI features

Agent Operator HQ, and the Nature Work tool on the web, show the terminal sessions that an agent you install on your own computer streams to Raq.com. Raq.com stores what that agent sends and what you add: terminal output, session names, the prompts you queue or send, files you attach and review files from your coding agents.

The AI features write session summaries and tab titles, check whether a queued prompt can be sent, suggest snooze times and turn voice input into text. When they run, Raq.com sends recent terminal text and your prompts through OpenRouter, which passes them to AI model providers such as OpenAI and Google, and sends your speech to Deepgram to be transcribed.

The Agent Operator HQ iOS and Android apps ask before any of this happens. Until you choose Allow, Raq.com makes no AI requests with your Agent Operator HQ data, and Not now keeps the features off. You can change your choice at any time in the app under Account > AI features, or on the web under Profile > Preferences. If you have only used Nature Work in a browser, the features stay on unless you turn them off there. The AI processing information below also applies.

Bookings calendar connections (Google and Microsoft)

In Bookings, a team member can choose to connect their own Google Calendar or Microsoft 365 calendar. Only that person can connect it, and they can disconnect it at any time from the Bookings team page.

Once connected, Raq.com reads the start and end times, status and free or busy setting of events on that calendar, so the booking page does not offer times when the person is busy. We do not request or store event titles, descriptions, locations or other attendees. Raq.com also creates, updates and removes one event in that calendar for each booking made in Raq.com, and can add a Google Meet or Microsoft Teams link to video bookings.

We store the email address of the connected calendar account, encrypted access and refresh tokens, the busy times read from the calendar and the IDs of the events we created. Disconnecting deletes the tokens and the stored busy times. Events already added to the calendar stay there unless the person removes them.

Raq.com's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use calendar data only to provide this feature. We do not sell it, use it for advertising or use it to train AI models, and people at Raq.com do not read it unless you ask us to, it is needed for security, or the law requires it.

Sales modules: contacts, prospecting and messages

Email Marketing, Sales Sequences and B2B Prospecting hold details of the people our customers contact: names, email addresses, phone numbers, job titles, company details, consent records, and the messages sent and received. For these contacts the customer decides who to contact and why, and is the controller. Raq.com processes the data on the customer's behalf. If a business that uses Raq.com contacted you and you want to know how your details are used, contact that business. You can also use the unsubscribe link in a marketing email.

B2B Prospecting searches company information from the Companies House register and can find people at a company by job title in public professional profiles compiled by a business contact data provider. When a user asks Raq.com to find a person's work email address, we send that person's name and company to the contact-finding and verification providers listed on our subprocessors page, and UK phone numbers can be screened against the Telephone Preference Service registers. Personal details found this way that the account does not export, add to its CRM, contact or enrol within 30 days are deleted. Retained Prospecting records are deleted after 24 months of observed inactivity. Active work, unfinished privacy notices and review holds can extend this period; new activity restarts it. This cleanup leaves separate CRM records and do-not-contact decisions in place.

To keep sending safe, Raq.com records deliveries, bounces, complaints, unsubscribes and STOP replies, and checks sending domains and links against blocklist and reputation services. We keep a suppression record of people who opted out, bounced, complained or asked for their details to be erased, so they are not messaged again, including after a contact is deleted. Opens and clicks are linked to a named person only when they allow tracking; otherwise they are counted without names. We may share information about abuse with the providers involved and with regulators, as our Acceptable Use Policy for Sending describes.

When a person asks a business to erase their details, the business can do so in Raq.com. Their consent records are deleted, and their address, name and message content are removed from that business's message history, campaigns, automations, sequences and inbox. Their B2B Prospecting records are deleted, and matching CRM contacts are renamed "Erased contact" with the personal details cleared. Counts and delivery statistics stay. A coded form of the address, which is not shown to the business, is kept so the person is not messaged again.

Communications

  • support requests, feedback, survey responses, and other communications with us.

3. How we use personal data

We use personal data to:

  • provide and operate the Services, including tool features and collaboration
  • authenticate users and secure accounts
  • process payments and manage subscriptions
  • respond to support requests and communicate service notices
  • monitor, prevent, and investigate abuse, fraud, security incidents, and unlawful activity
  • improve and maintain the Services (including debugging, testing, and performance monitoring)
  • comply with legal obligations and enforce our Terms.

4. Legal bases

Under UK GDPR, we rely on:

  • contract: to provide the Services you request
  • legitimate interests: to secure and improve the Services, prevent abuse, and operate our business (balanced against your rights)
  • consent: where required (for example certain marketing or non-essential cookies, if used)
  • legal obligation: to comply with law (for example tax, accounting, lawful requests).

5. AI and third-party processing

Some tools process your inputs to generate outputs using automated systems, including AI.

Connecting an external assistant

If you connect Raq.com to an external assistant such as ChatGPT, that service sends tool requests to Raq.com and receives the workspace records needed to answer your request or carry out an action. These can include tasks, project notes, customer records, messages, time entries, form answers and document information. Relevant records may contain personal data, including names, contact details or personal information you have entered in their content. Access is limited by your Raq.com permissions and the connection's approved scope.

For ChatGPT connections, OpenAI receives these requests and results under its own terms and privacy policy. Raq.com's built-in AI Privacy and Zero Data Retention settings do not control how an external assistant handles data. You can revoke a connection in Settings > AI Connections; this stops future access but does not delete information the external service has already received.

Processing within Raq.com

This may involve sending relevant portions of your Content to third-party service providers such as:

  • AI model and inference providers
  • file processing providers (for example document parsing or image processing)
  • hosting, storage, and infrastructure providers
  • communications providers (email, messaging)
  • payment processors.

Important: Third-party providers may be located outside the UK. We limit the data shared to what is necessary to provide the relevant feature.

AI provider data protection

Raq.com uses multiple categories of AI provider. Data handling varies by provider type.

Text and chat AI

By default, core text and chat AI requests are routed through provider endpoints that enforce Zero Data Retention (ZDR). This means these providers cannot store, retain, or use your prompts and responses for model training. This protection is enabled by default for every account.

Live web search is controlled separately in AI Privacy settings. If enabled, requests that need current public web results may use standard provider routing for the search lookup itself instead of ZDR.

Users may disable this protection in their account's AI Privacy settings to access a wider range of text AI models. When disabled, text AI providers may store and process data according to their own privacy policies.

Image and video generation

Image and video generation requests are processed by external providers under their API terms. Providers receive your prompt, generation settings and any reference files needed for the request, including uploaded images or videos that may contain personal data. Providers may retain these inputs and generated files under their API terms. We save generated files to Raq.com-managed storage after generation.

Voice synthesis and transcription

Voice and transcription requests are processed by external providers that may retain data under their API terms. Raq.com opts out of model training where the provider offers that option. Generated audio and transcription results are downloaded to Raq.com's own storage. Raq.com does not send personal data beyond the text or audio files necessary to perform the requested operation.

Regardless of provider type, Raq.com maintains its own request logs for billing, service quality, and debugging purposes. These logs are stored securely and are not shared with AI providers.

For more information, see our Privacy and Security page.

You should not submit sensitive personal data to AI tools unless you have a lawful basis and it is strictly necessary. If you do, you do so at your own risk.

6. Who we share data with

We may share personal data with:

  • service providers that help us operate the Services (hosting, storage, email delivery, payments, customer support, security, and AI processing)
  • professional advisers (lawyers, accountants, auditors) where necessary
  • authorities where required by law or to protect rights and safety
  • other users where you choose to share Content through collaboration, public links, widgets, or community features.

We do not sell your personal data.

For our current subprocessors, see our Subprocessor List. Subprocessors that process personal data are named there. Specialist providers for optional writing features receive only text submitted to those features, are not used for personal data and are described by function.

7. International transfers

If personal data is transferred outside the UK (and where applicable the EEA), we use appropriate safeguards such as:

  • UK International Data Transfer Agreement (IDTA) and/or addendum
  • adequacy regulations where available
  • other lawful transfer mechanisms.

8. Retention

We keep personal data only for as long as necessary for the purposes described in this Policy. Specific retention periods:

  • Account data: deleted within 120 days of account closure
  • Deleted files: our storage provider keeps a hidden copy for up to 30 days in case of a mistaken deletion, then removes it permanently
  • Recovery copy: we keep a second copy of stored files with the same storage provider, in the same region, to recover from faults. A file you delete is removed from it on the same schedule
  • Billing and tax records: retained for 7 years per UK tax law
  • AI request logs: retained for 12 months for billing accuracy and service quality
  • Support communications: retained for 24 months after last contact
  • Usage and analytics data: retained for 12 months, then anonymised or deleted.

Where possible, we delete or anonymise data. Data may be retained longer where required by law.

9. Security

We implement technical and organisational measures designed to protect personal data, including encryption in transit, encrypted server disks and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Data breach notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

11. Your rights

Depending on your location and applicable law, you may have rights to:

  • access your personal data
  • correct inaccurate data
  • delete data (in some cases)
  • restrict or object to processing
  • data portability
  • withdraw consent (where processing is based on consent).

You can exercise rights by contacting us at privacy@raq.com. We will respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ICO).

12. Automated decision-making

Some of our tools use AI and automated processing to generate outputs from your inputs. These tools assist you but do not make decisions that produce legal effects or similarly significantly affect you without your active involvement. You always control what inputs you provide and how you use any outputs.

If you believe an automated process has significantly affected you, contact us at privacy@raq.com.

13. Cookies and similar technologies

We may use cookies and similar technologies to:

  • keep you signed in and maintain sessions
  • enable core site functionality and security
  • remember preferences.

If we use non-essential cookies (for example analytics or marketing), we will request consent where required. You can also control cookies through your browser settings.

For a full list of cookies we use, including names, purposes, and durations, see our Cookie Policy.

14. Children

The Services are not intended for children under 18, and we do not knowingly collect personal data from children.

15. CorporateDB records

CorporateDB, at corporatedb.com and in the CorporateDB module in Raq.com, is a directory of records about companies and other organisations, copied from official company registers, charity registers, government sanctions lists and other official lists of organisations, such as tax exemption, securities filer and business number registers. This section covers personal data that appears in those records. It applies to anyone a CorporateDB record names or identifies, not only to Raq.com users, and gives the information required by Article 14 of the UK GDPR and the EU GDPR when personal data is not collected from the person it is about.

Where the information comes from

We collect records from the public registers, lists and open data portals listed on the CorporateDB coverage page. They include company registers such as Companies House, INSEE Sirene, the Brønnøysund Register Centre and GLEIF, the charity registers of the Charity Commission for England and Wales and the Scottish Charity Regulator (OSCR), the sanctions lists published by the UK government (the UK Sanctions List) and the U.S. Treasury (the OFAC SDN List), the U.S. Internal Revenue Service's list of tax-exempt organisations, the U.S. Securities and Exchange Commission's EDGAR filer records and the Australian Business Register. For UK companies we also collect company notices published in The Gazette and UK public contract awards published on Find a Tender and Contracts Finder. Each record links to the register, list or notice it came from. We do not collect this information from you directly.

What personal data the records can contain

CorporateDB lists companies, charities and other organisations, not people. We leave out sole traders, individual entrepreneurs and other entries that registers hold under a person's own name. From sanctions lists we collect designated organisations only, not designated individuals, and from EDGAR we collect operating and investment companies only, not individual filers. Where a register mixes those personal entries with companies, as Norway's and Latvia's do, we may keep a restricted entry with only its register number and status, without a name or address, so that it is never published. We do not collect officers, trustees, registered agents, founders, beneficiaries, signatories, individual shareholders or the people an organisation's post is sent in care of from any source, and we do not collect phone numbers or email addresses.

Two UK sources are published about events rather than organisations, and we keep only part of each:

  • Gazette company notices: for notices such as winding-up petitions and orders that give a company's registered number, we keep the notice type, publication date, edition, issue, notice number and a link. We never keep a notice's text, so we do not keep the liquidators, petitioners, officers or other people a notice can name, although the notice we link to on The Gazette can name them.
  • UK contract awards: for awards to suppliers that the notice identifies by a Companies House number, we keep the buyer's name, the contract title, the award and contract dates, the award value, how many suppliers share the award and a link to the notice. Supplier contact details, addresses, contract descriptions and suppliers without a company number, such as sole traders, are never kept. Buyers write the titles, so a title can occasionally name a person or a place; we withhold any title that gives a street address and keep the award without it.

Some records can still identify a person, for example:

  • an organisation named after one or more people, such as a partnership or a charitable trust
  • a registered address, or an address on a sanctions list, that is also someone's home address
  • a website address that a register lists for an organisation
  • other names and aliases that a register or sanctions list gives for an organisation
  • earlier versions of those names and addresses in a record's history
  • a contract title that names a person or a place, as described above.

Why we use it and our lawful basis

We use these records to run a searchable directory that shows where each record came from, and to let Raq.com customers save lists, follow changes and export records. Our lawful basis is legitimate interests: ours in providing sourced information about organisations, and our users' interest in identifying and checking the organisations they deal with, including whether an organisation is a registered charity or is on a sanctions list. Registers and governments publish this information so that organisations can be identified. We limit what we republish to what the register or list makes public, leave out records about individuals and records a register restricts, and do not combine the records with other information to build profiles of people.

Who can see it

CorporateDB records are public on corporatedb.com. Raq.com customers can also save them to lists, export them as CSV files and read them through AI assistants they connect. Records from sources whose licence or terms do not allow them to be used for marketing (Crossroads Bank for Enterprises (KBO/BCE), Belgium, Dirección General de Impuestos Internos (DGII), Dominican Republic, Register of Legal Entities (Registrų centras), Lithuania and Scottish Charity Register (OSCR)) are marked as such, left out of exports and cannot be added to a CRM, a task board or any other Raq.com sales or marketing module; our Terms of Service do not permit marketing use of them. Our hosting and storage providers process the records for us. They are named in our Subprocessor List, and section 7 covers transfers outside the UK.

How long we keep it

  • Current records: kept while CorporateDB runs, with the status the register gives them. When a register restricts a record, we remove it and its history from search, company pages and exports.
  • Record history: earlier versions are kept with each record to show what changed.
  • Original register files: we keep private, encrypted copies of the files we download so we can check and restore the directory: the last three editions of each, plus one a month for up to 24 months. Some of these files include sole traders and other entries we never publish.
  • Database backups: encrypted backups are kept for up to four months.
  • CSV exports: download files are deleted after 7 days.

Your rights

You have the rights listed in section 11. Because we rely on legitimate interests, you can object to our use of a record that identifies you. If you do, we will stop showing it, including in later imports from the register, unless we have compelling legitimate grounds to continue.

To object or ask us to remove a record, email privacy@raq.com with the link to the CorporateDB page. If our copy differs from the register, tell us through raq.com/contact and include the CorporateDB link and the source reference. To change the official record itself, contact the register linked on that record. We respond within one month, and you can also complain to the UK Information Commissioner's Office (ICO) or your local data protection authority.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will apply from the date it is posted (or the later date stated).