Privacy Notice
Version 1.0 — effective 15 October 2026
This notice explains how Neosphyr Ltd ("we", "us") handles personal data in connection with FloatSight (app.floatsight.com and floatsight.com). We are a company registered in England and Wales with company number 17473213 and registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are registered with the Information Commissioner's Office (ICO) under registration number ZC255589.
For questions or to exercise your rights, email info@floatsight.com with "Privacy" in the subject line.
1. Our two roles
- Controller. We decide how to use the personal data we need to run FloatSight as a business: account and login details, billing records, support correspondence, security logs and website data. This notice covers that data.
- Processor. The programmes, documents, minutes and other files that customers upload ("Customer Data") can contain names and work contact details of people working on projects. We process that data only on behalf of, and on the instructions of, the customer organisation, under our Data Processing Addendum. If your details appear in a customer's project, that customer is the controller: please contact them first. We will pass on any request we receive.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Full name, work email, job title (optional), company name, hashed password, role, project memberships | You, or the account owner who invites you |
| Verification and trial data | Email confirmation tokens (stored hashed), trial start and end dates, email domain used for the trial | Generated by the Service |
| Session and security data | Session identifiers (stored hashed), browser user agent, IP address in server logs, security and audit events (for example log-ins, uploads, downloads, deletions) | Generated when you use the Service |
| Billing data | Billing contact, organisation name and address, plan, invoices, payment status and payment provider customer reference. Card details are collected by Stripe and never reach us | You and our payment provider |
| Support and correspondence | Emails and messages you send us, and our replies | You |
| AI usage data | The questions you ask the Programme Assistant, the answers and the number of AI credits used | Generated when you use the Service |
We do not knowingly collect special category data and we ask customers not to upload it.
3. How and why we use it
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating and running your account, providing the Service, enforcing one free trial per person and business | Performance of a contract with you or your organisation; legitimate interests in operating the Service and preventing trial abuse |
| Sending service emails: email confirmation, security notices, trial and data deletion notices, changes to terms | Performance of a contract; legitimate interests |
| Billing, accounting and tax records | Performance of a contract; legal obligation |
| Keeping the Service secure, preventing fraud and misuse, investigating incidents, rate limiting | Legitimate interests in protecting the Service, our customers and us |
| Responding to support requests and complaints | Legitimate interests; performance of a contract |
| Establishing, exercising or defending legal claims | Legitimate interests |
| Improving the Service using aggregated statistics that do not identify you | Legitimate interests |
We do not sell personal data, we do not use it for advertising, and we do not send marketing emails unless you have opted in. We do not carry out automated decision-making that produces legal or similarly significant effects on individuals.
4. Artificial intelligence
When you use the AI Programme Assistant, your question and the relevant extracted programme information are sent to our AI provider, Anthropic, to generate an answer. Anthropic's commercial terms do not permit it to train models on this content. Questions that the Service can answer with its own rules are answered without sending anything to the AI provider. We do not use your data to train AI models.
5. Who we share it with
We share personal data only with service providers who process it for us under contract (our sub-processors), professional advisers (lawyers, accountants, insurers) under a duty of confidence, a buyer of our business, and authorities where the law requires. The current list of service providers, what they do and where they process data is at Sub-processors.
6. International transfers
Our application and database are hosted in Frankfurt, Germany, and uploaded files are stored in Cloudflare's European Union jurisdiction. The UK recognises the EEA as providing adequate protection. Some providers (for example our email and AI providers) process data in the United States. Where that happens, transfers rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the provider's security measures.
7. How long we keep it
| Data | Retention |
|---|---|
| Unverified sign-ups | Deleted 7 days after sign-up if the email address is not confirmed |
| Trial project data | Deleted 30 days after the trial ends, unless a paid plan is chosen (we warn the account owner by email beforehand) |
| Account data | For as long as the account is open, then deleted within 90 days of closure, except as below |
| AI Programme Assistant conversations | Content deleted after 90 days |
| Security and audit events | For as long as the account exists and up to 6 years afterwards, to protect against and defend legal claims |
| Server logs | Up to 30 days |
| Billing and tax records | 6 years after the end of the financial year to which they relate |
| Support correspondence | 3 years after the last message, unless needed for a dispute |
| Backups | Overwritten in the ordinary course, within 30 days |
8. Security
We use encryption in transit (HTTPS) and at rest, passwords stored with a modern one-way hashing algorithm, secure session cookies, server-side access controls between organisations and projects, a database reachable only through a private network, and a private file store that is never publicly accessible. No system is perfectly secure; if a personal data breach is likely to put your rights at risk, we will tell you and, where required, the ICO.
9. Your rights
Under UK data protection law you have the right to access your personal data; to have it corrected; to have it erased; to restrict or object to our use of it (including where we rely on legitimate interests); to data portability; and to withdraw consent where we rely on consent. To exercise them, email info@floatsight.com. We will respond within one month, and may need to verify your identity. Some rights are subject to legal exceptions.
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
10. Cookies
FloatSight uses only cookies and similar storage that are strictly necessary to provide the Service you request. We do not use analytics or advertising cookies. See our Cookie Notice.
11. Children
FloatSight is a business service and is not intended for anyone under 18.
12. Changes
We may update this notice. The version and effective date at the top show the latest version. We will tell account owners about material changes by email or in the Service.