Privacy Policy
Last updated: 13 June 2026 Effective from: 13 June 2026
This Privacy Policy explains how Xpectrum Ltd. (trading as Quematics, "we", "us", "our") collects, uses, and protects personal data when you use combeat.io (the "Service"). We are committed to processing your data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
We are the data controller for the personal data described in this policy.
1. Data We Collect
When you join the waitlist:
- Email address
- (Optional, if provided) Name, company name, role
- Date and time of signup
- Source (referring URL)
When the Service launches and you create an account:
- Account details (name, email, company, role)
- Billing information (full card details are not stored by us; payment processing is handled by a regulated payment processor)
- Service usage data (logins, features used, Moves approved, credits consumed)
- Content you submit (competitor lists, brand profile, connector configurations)
- Authorisation tokens for tools you choose to connect (held encrypted; never visible to us in plaintext)
- Communications with our support team
Automatic data:
- IP address (used for security and analytics; truncated where possible)
- Browser type, device type, operating system
- Pages visited, time spent, navigation patterns
- Cookies (see Cookie Policy at combeat.io/cookies)
2. Why We Process Your Data
We process personal data on the following legal bases:
Contract: to deliver the Service you've subscribed to (post-launch) or the waitlist sign-up you've requested.
Legitimate interest: to keep the Service secure, prevent abuse, debug issues, improve features, and communicate with you about the Service or relevant launch updates. We balance this against your rights and interests.
Consent: for non-essential cookies and any marketing communications beyond service updates. You can withdraw consent at any time.
Legal obligation: to comply with applicable law (e.g., tax records, lawful requests from authorities).
3. Categories of Recipients
We share personal data with the following categories of processors, each engaged under a Data Processing Agreement and bound by appropriate confidentiality and security obligations:
- Cloud hosting and database providers (data resident in the United Kingdom)
- Edge delivery and content distribution providers (global edge network)
- Payment and subscription billing providers (regulated processors in the UK and EU)
- Authentication and identity providers
- Transactional email delivery providers (EU-resident)
- AI inference providers for the Forward Intelligence engine
- Error monitoring and observability providers
We do not sell personal data. We do not share personal data with advertisers or data brokers. A list of specific subprocessors is available on request to enterprise customers at legal@combeat.io once the Service launches.
4. International Transfers
Personal data is primarily processed within the United Kingdom and European Economic Area. Where any processor is located outside the UK/EEA, we rely on Standard Contractual Clauses approved by the European Commission and the UK ICO addendum, supplemented by technical and organisational safeguards (encryption, access controls, audit trails).
5. How Long We Keep Data
| Data type | Retention period |
|---|---|
| Waitlist email | Until you unsubscribe, or 24 months of inactivity |
| Active account data | For the duration of your subscription + 90 days |
| Cancelled account data | 30 days after cancellation, then deleted (except where retained for legal or audit reasons — typically up to 7 years for tax records) |
| Server logs (anonymised) | 90 days |
| Billing records | As required by tax law (typically 7 years) |
| Support correspondence | 24 months after resolution |
6. Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten") where applicable
- Restrict processing in certain circumstances
- Object to processing based on legitimate interest
- Data portability — receive your data in a structured, commonly used format
- Withdraw consent at any time where processing is based on consent
- Complain to a supervisory authority (the UK Information Commissioner's Office, ico.org.uk)
To exercise any of these rights, email legal@combeat.io. We respond within 30 days.
7. Security
We protect personal data with:
- TLS encryption in transit
- Encryption at rest
- Per-tenant data isolation in our database
- Least-privilege access for staff (no developer access to production data without specific approval)
- Multi-factor authentication on all administrative accounts
- Regular security review and dependency monitoring
We will notify affected users and the ICO within 72 hours of becoming aware of a personal data breach that creates a risk to your rights.
8. Cookies
See our Cookie Policy at combeat.io/cookies.
9. Children
The Service is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact legal@combeat.io and we will delete it.
10. Changes to This Policy
We may update this policy. Material changes will be notified by email to active users and via a prominent notice on combeat.io. The "Last updated" date at the top of this policy indicates the most recent revision.
11. Contact
Privacy and data requests: legal@combeat.io General support: support@combeat.io Postal address: Xpectrum Ltd. — registered office on file with Companies House Supervisory authority: Information Commissioner's Office (ICO) — ico.org.uk
This policy is current as of the date above. Xpectrum Ltd. is registered in England and Wales.