Privacy notice

This platform (“Parod”, “we”, “us”) is operated by Horizontal Solutions Limited, company number 14279893, a company registered in England & Wales with its registered office at [registered address].

For the personal data described in this notice we act as a data controller in respect of account and marketing data, and as a data processor in respect of the content our customers’ organisations choose to store in the platform (the customer organisation is the controller of that content).

We are registered with the UK Information Commissioner’s Office (ICO) under registration number [ICO registration number]. Our data protection contact is [DPO / privacy contact name] — [privacy@yourdomain].

• Account data — name, email address, organisation membership, role, authentication identifiers, and multi-factor authentication settings.
• Content you provide — meetings, agendas, minutes, risks, controls, performance metrics, actions, comments, and any documents you upload. These may contain personal data you choose to include.
• Usage and device data — pages visited, feature interactions, approximate location derived from IP, browser and device type, collected through product analytics.
• Audit and security logs — records of significant actions (who changed what and when) retained for governance and security purposes.

• Contract — to provide the platform to you and the organisation you belong to.
• Legitimate interests — securing the service, preventing abuse, maintaining audit trails, and improving the product through analytics, balanced against your rights.
• Legal obligation — where we must retain or disclose data to comply with the law.
• Consent — for non-essential analytics cookies on our public pages, and where otherwise indicated. You can withdraw consent at any time.

We use the following third parties to deliver the service. Where data is transferred outside the UK/EEA, we rely on appropriate safeguards (UK International Data Transfer Agreement / Addendum or EU Standard Contractual Clauses, plus supplementary measures where required).

Document content uploaded to the platform may be sent to our AI sub-processors (Google Gemini, Anthropic) to provide search and assistant features. We do not sell personal data, and our AI providers are contractually prohibited from using your content to train their models.

Account data is retained for the life of your account. Content is retained for as long as your organisation maintains it in the platform; deleted records are soft-deleted and recoverable for [retention period] before being purged. Audit and security logs are retained for [audit retention period]. When you ask us to erase your data we remove or irreversibly anonymise it, subject to records we are legally required to keep.

Under UK GDPR you have the right to access, rectify, erase, restrict, and object to processing of your personal data, and the right to data portability. Where processing is based on consent you may withdraw it at any time.

To exercise any of these rights, contact [privacy@yourdomain]. If your data is held within a customer organisation’s workspace, we may direct your request to that organisation as the controller. You also have the right to lodge a complaint with the ICO (ico.org.uk).

We use strictly necessary cookies to keep you signed in and to operate the service. On our public pages we use product-analytics cookies only with your consent, which you can accept or decline via the banner shown on your first visit. Fonts and other assets are served from our own infrastructure; we do not load them from third-party content delivery networks.

We protect data with encryption in transit, access controls scoped to your organisation, multi-factor authentication options, and audit logging. No system is perfectly secure, but we take appropriate technical and organisational measures and review them regularly.

We may update this policy from time to time. Material changes will be communicated through the platform or by email. The date at the top reflects the latest revision.

Questions about this policy or our handling of personal data: [privacy@yourdomain], [registered address].