Raq.com Privacy Policy

Effective date: 28 February 2026. Last updated: 20 October 2026

This Privacy Policy explains how Vu AI Ltd (we, us, our) collects and uses personal data when you use Raq.com and related services (the Services).

Delete your account and data

To request deletion of your Raq.com account and associated data, email privacy@raq.com from the email address you use to sign in. Use the subject Account deletion request and tell us which account you want deleted. You do not need to install or open the app. We may ask you to verify ownership before we act, and we respond within one month.

This applies to Time Tracker by Raq.com and our other Raq.com apps. In Time Tracker, you can also choose Settings > Account > Delete account. Deleting your sign-in profile affects the other Raq.com apps you use with that profile. If you are the only owner of a shared workspace, transfer ownership or close that workspace first.

On deletion, we remove your sign-in access and anonymise your profile details, including your name, email address and connected sign-in identities. Personal account data, including personal time-tracking records and location stamps, is removed through our account-closure process within 90 days. An encrypted deletion-contact record is kept for up to 90 days to handle support and audit queries.

Records shared with a team, such as its timesheets and project records, can remain while that workspace is active, attributed to an anonymised user. Billing and tax records are retained for seven years. Pseudonymous security records and lifecycle summaries are retained indefinitely after closure. The retention section below explains our other retention periods. You can also email us to request deletion of particular data without closing your account; describe the data and workspace concerned.

1. Controller and contact

Data controller: Vu AI Ltd
Registered office: Suite 15, 1666 High Street, Knowle, Solihull, United Kingdom, B93 0LY
Privacy contact: privacy@raq.com
ICO registration: ZB712921

If you have questions or requests, contact us using the details above.

2. Personal data we collect

We may collect the following categories of personal data:

Account and profile data

name, email address, password hash, profile details
organisation and workspace details
roles, permissions, and team membership.

Payment and billing

billing contact details and transaction metadata
payment status and invoices.

Payments are typically processed by third-party payment processors, and we do not store full card details.

Usage and device data

log data (IP address, browser type, timestamps, pages viewed, error logs)
device and session identifiers, approximate location derived from IP
usage metrics (tool usage, subscription usage, performance and reliability data).

Content you provide

any text, prompts, files, images, documents, messages, and other materials you upload or create
outputs generated from your inputs
for collaboration or community features, data you post or share with others.

Time Tracker data and optional location

Time Tracker stores your work entries, project and activity selections, notes, tags, timesheet submissions and time-off requests. These records are associated with your account and workspace.

For projects configured to record clock-in location, the mobile app explains the request and asks for foreground location permission. An approximate reading can be used for a location stamp; a site-area check asks for precise location. A start or switch can send the reading to Raq.com. A stop can include a recent reading already held by the app, but does not start a new location lookup. The mobile app does not track your location in the background. Projects without a location policy do not collect these readings.

Location records include coordinates, reported accuracy and the site-check result. They are linked to the timer and can be viewed by you and people permitted to review that project's time. You can change location permission in your device settings; a project that requires location may then refuse a new start.

If you use AI quick add, your description and relevant project, activity, tag and recent-work context are sent to an AI provider to suggest entries. You review the suggestions before saving. The AI processing information below also applies to this feature.

Bookings calendar connections (Google and Microsoft)

In Bookings, a team member can choose to connect their own Google Calendar or Microsoft 365 calendar. Only that person can connect it, and they can disconnect it at any time from the Bookings team page.

Once connected, Raq.com reads the start and end times, status and free or busy setting of events on that calendar, so the booking page does not offer times when the person is busy. We do not request or store event titles, descriptions, locations or other attendees. Raq.com also creates, updates and removes one event in that calendar for each booking made in Raq.com, and can add a Google Meet or Microsoft Teams link to video bookings.

We store the email address of the connected calendar account, encrypted access and refresh tokens, the busy times read from the calendar and the IDs of the events we created. Disconnecting deletes the tokens and the stored busy times. Events already added to the calendar stay there unless the person removes them.

Raq.com's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use calendar data only to provide this feature. We do not sell it, use it for advertising or use it to train AI models, and people at Raq.com do not read it unless you ask us to, it is needed for security, or the law requires it.

Communications

support requests, feedback, survey responses, and other communications with us.

3. How we use personal data

We use personal data to:

provide and operate the Services, including tool features and collaboration
authenticate users and secure accounts
process payments and manage subscriptions
respond to support requests and communicate service notices
monitor, prevent, and investigate abuse, fraud, security incidents, and unlawful activity
improve and maintain the Services (including debugging, testing, and performance monitoring)
comply with legal obligations and enforce our Terms.

4. Legal bases

Under UK GDPR, we rely on:

contract: to provide the Services you request
legitimate interests: to secure and improve the Services, prevent abuse, and operate our business (balanced against your rights)
consent: where required (for example certain marketing or non-essential cookies, if used)
legal obligation: to comply with law (for example tax, accounting, lawful requests).

5. AI and third-party processing

Some tools process your inputs to generate outputs using automated systems, including AI.

This may involve sending relevant portions of your Content to third-party service providers such as:

AI model and inference providers
file processing providers (for example document parsing or image processing)
hosting, storage, and infrastructure providers
communications providers (email, messaging)
payment processors.

Important: Third-party providers may be located outside the UK. We limit the data shared to what is necessary to provide the relevant feature.

AI provider data protection

Raq.com uses multiple categories of AI provider. Data handling varies by provider type.

Text and chat AI

By default, core text and chat AI requests are routed through provider endpoints that enforce Zero Data Retention (ZDR). This means these providers cannot store, retain, or use your prompts and responses for model training. This protection is enabled by default for every account.

Live web search is controlled separately in AI Privacy settings. If enabled, requests that need current public web results may use standard provider routing for the search lookup itself instead of ZDR.

Users may disable this protection in their account's AI Privacy settings to access a wider range of text AI models. When disabled, text AI providers may store and process data according to their own privacy policies.

Image and video generation

Image and video generation requests are processed by external providers under their API terms. Providers receive your prompt, generation settings and any reference files needed for the request, including uploaded images or videos that may contain personal data. Providers may retain these inputs and generated files under their API terms. We save generated files to Raq.com-managed storage after generation.

Voice synthesis and transcription

Voice and transcription requests are processed by external providers that may retain data under their API terms. Raq.com opts out of model training where the provider offers that option. Generated audio and transcription results are downloaded to Raq.com's own storage. Raq.com does not send personal data beyond the text or audio files necessary to perform the requested operation.

Regardless of provider type, Raq.com maintains its own request logs for billing, service quality, and debugging purposes. These logs are stored securely and are not shared with AI providers.

For more information, see our Privacy and Security page.

You should not submit sensitive personal data to AI tools unless you have a lawful basis and it is strictly necessary. If you do, you do so at your own risk.

6. Who we share data with

We may share personal data with:

service providers that help us operate the Services (hosting, storage, email delivery, payments, customer support, security, and AI processing)
professional advisers (lawyers, accountants, auditors) where necessary
authorities where required by law or to protect rights and safety
other users where you choose to share Content through collaboration, public links, widgets, or community features.

We do not sell your personal data.

For our current subprocessors, see our Subprocessor List. Subprocessors that process personal data are named there. Specialist providers for optional writing features receive only text submitted to those features, are not used for personal data and are described by function.

7. International transfers

If personal data is transferred outside the UK (and where applicable the EEA), we use appropriate safeguards such as:

UK International Data Transfer Agreement (IDTA) and/or addendum
adequacy regulations where available
other lawful transfer mechanisms.

8. Retention

We keep personal data only for as long as necessary for the purposes described in this Policy. Specific retention periods:

Account data: deleted within 90 days of account closure
Billing and tax records: retained for 7 years per UK tax law
AI request logs: retained for 12 months for billing accuracy and service quality
Support communications: retained for 24 months after last contact
Usage and analytics data: retained for 12 months, then anonymised or deleted.

Where possible, we delete or anonymise data. Data may be retained longer where required by law.

9. Security

We implement technical and organisational measures designed to protect personal data, including TLS in transit, encrypted disks on our dedicated application and database servers, access controls, and secure storage. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Data breach notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

11. Your rights

Depending on your location and applicable law, you may have rights to:

access your personal data
correct inaccurate data
delete data (in some cases)
restrict or object to processing
data portability
withdraw consent (where processing is based on consent).

You can exercise rights by contacting us at privacy@raq.com. We will respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ICO).

12. Automated decision-making

Some of our tools use AI and automated processing to generate outputs from your inputs. These tools assist you but do not make decisions that produce legal effects or similarly significantly affect you without your active involvement. You always control what inputs you provide and how you use any outputs.

If you believe an automated process has significantly affected you, contact us at privacy@raq.com.

13. Cookies and similar technologies

We may use cookies and similar technologies to:

keep you signed in and maintain sessions
enable core site functionality and security
remember preferences.

If we use non-essential cookies (for example analytics or marketing), we will request consent where required. You can also control cookies through your browser settings.

For a full list of cookies we use, including names, purposes, and durations, see our Cookie Policy.

14. Children

The Services are not intended for children under 18, and we do not knowingly collect personal data from children.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will apply from the date it is posted (or the later date stated).