Privacy Policy

Who We Are

• Requio is a B2B requirements management platform operated by Requio Ltd.
• Requio Ltd is a company registered in England and Wales (company number 16755307), with its registered office at 71-75 Shelton Street, London WC2H 9JQ. VAT registration number GB 531 0644 28.
• Contact email: hello@requio.co.uk
• Website: https://requio.co.uk
• If you have any questions about this policy or your data, you can contact us using the details above.
• Requio is a business product. It is not intended for, or directed at, children under 16.

Our Role: Controller and Processor

Requio holds two different kinds of personal data, and our responsibilities differ between them.

• Controller — for account, billing and marketing data, and for the details we hold about people we contact about Requio. This is information about you as a Requio user, subscriber or someone we have emailed, and we decide how it is used.
• Processor — for the content your organisation puts into the platform. Requirements, packs and uploaded documents often name real people: your colleagues, customers or stakeholders. Your organisation remains the controller of that content, and we process it only on their instructions.
• If you are named inside content held by one of our customers, that organisation is responsible for your data. Please contact them directly to exercise your rights, and we will support them in responding.

Information We Collect

We keep what the platform needs to work, and little else.

• Account — your name, work email address, the name of your workspace, and the roles you have been given within it.
• Password — stored only as a salted hash. We cannot see or recover your password.
• Account status — whether your email has been verified, and the date you were last active, which we use to send inactivity reminders you can turn off.
• Billing — your workspace plan, seat count and billing method, plus a Stripe customer and subscription reference. Card details go to Stripe directly and never reach our systems.
• Audit records — a history of actions taken in your workspace: who did what, to which item, and when. This is the review and approval trail the product exists to provide, so it cannot be switched off.
• Refused sign-ins — when someone tries and fails to sign in to your workspace, we record the email address that was typed, the reason it was refused, and the IP address and browser it came from. This is a security record, so that a Workspace Admin can see attempts to get into their workspace; only a Workspace Admin can see it. No person is named as having done it, because an attempt on an account may not have been made by its owner.
• Successful sign-ins — the time of each sign-in, and the IP address and browser it came from. We use these to protect accounts and to spot an account being shared between people, which our Terms do not allow. Only Requio can see them; they are not shown to your Workspace Admin.
• AI usage records — which AI feature was used, which model answered, and how many tokens it cost. We do not keep the content of AI requests or responses in these records.
• Marketing — your email address if you subscribe to our newsletter, and your email preferences.

Content You Put Into Requio

Most of what Requio holds is your own working material rather than personal data about you.

• Projects, Digital Requirements Packs, requirements, user stories, process maps, comments and supporting notes.
• Documents you upload, including reference material used to ground AI suggestions.
• Documents submitted by people outside your workspace through a secure upload link. For these we collect the name they give, their organisation if they provide one, and the file with its name, size and type. Files are scanned for malware before they can be used.
• This content may contain personal data about other people. Please include only what is necessary, and do not put special category data (such as health or biometric information) into the platform.

What We Do Not Collect

• We do not collect telephone numbers, team size, or demographic information. We do not collect job titles from people using the platform; the one place we hold a job title is when we contact someone about Requio — see If We Contact You About Requio.
• We do not record IP addresses or browser user-agent strings as you use the platform, though our hosting providers may log them briefly for security and abuse prevention. There are three exceptions: a refused sign-in and a successful sign-in, both recorded as security measures — see Information We Collect; and our public website, where analytics receives your IP address to derive an approximate location, and only if you accept cookies — see Website Analytics.
• We do not knowingly collect special category personal data.
• We do not sell your data, and we do not use it for advertising or ad targeting.

How We Collect Your Data

• Directly from you, when you create a workspace, accept an invitation, or use the platform.
• From your colleagues, when an administrator invites you to a workspace or assigns you a role.
• Automatically as you use the service, in the form of audit records, AI usage counts and error diagnostics.
• From our public website and sign-up pages, if you accept analytics cookies — see Website Analytics.
• From external contributors who submit documents to a workspace through a secure upload link.
• When you subscribe to our newsletter or contact us directly.
• From Apollo.io, a business contact database, when we look for people at UK companies who may find Requio useful — see If We Contact You About Requio.

How We Use Your Data

• Run the platform: your workspace, projects, packs and the review and approval workflow.
• Authenticate you and keep your account secure.
• Provide AI assistance, such as suggestions, quality checks, summaries and process maps.
• Take payment, manage your subscription, and apply the limits of your plan.
• Send service messages you cannot opt out of while you hold an account: email verification, password resets, invitations, and notices about your account or billing.
• Send marketing email where you have opted in, which you can stop at any time.
• Email people at UK companies whose job suggests Requio could help them, and follow up a few times if they do not reply — see If We Contact You About Requio.
• Diagnose faults, prevent abuse, and improve reliability.
• Meet legal and regulatory obligations.

If We Contact You About Requio

We email a small number of people at UK companies whose job suggests Requio could help them, mainly business analysts and the people who lead them. If you received one of these emails, this section explains what we hold about you and why.

• What we hold — your name, work email address, job title and employer, the emails we send you, and any reply you send. We also note your employer's public website and its record at Companies House.
• Where it comes from — your work contact details come from Apollo.io, a business contact database. We check your employer against Companies House, the UK public register of companies, and contact only people who work for companies and other incorporated organisations. We do not use personal email addresses, and we do not contact sole traders or ordinary partnerships.
• Why we are allowed to — our legitimate interest in telling people about a product that is relevant to their work, by a short email to their work address that they can stop at any time. We think this is something you would reasonably expect in your role, and that it does not override your interests or rights. UK law (PECR) allows this kind of email to company addresses, provided we say who we are and give you a simple way to opt out.
• Who helps us — service providers that help us write, send and manage these emails, some of them based in the United States. Our own records are held on Amazon Web Services in London.
• No decisions about you — the only effect on you is whether you receive an email. Anything unusual in a reply, including any question about your data, is read and answered by a person.
• How long we keep it — 12 months after the last email between us, in either direction. If you become a Requio customer, the normal rules for accounts apply instead.
• How to stop it — reply "no thanks", or anything that says no, or email support@requio.co.uk. We stop straight away and add your address to a do-not-contact list, which we keep so that you are never contacted again. You can object to this kind of email at any time, and we will always stop.
• Your other rights — you can ask what we hold about you, or ask us to delete it, at support@requio.co.uk. We reply within one month.

AI Processing

Requio uses AI to draft and check requirements content. This means some of your content leaves our systems, so it is worth being precise about what happens.

• When you use an AI feature, the content needed for that specific request is sent to Google's Gemini API, processed, and the response is returned to you. Only what the request needs is sent.
• We do not use your content to train AI models. Requio has no model-training pipeline of any kind.
• We use the paid Gemini API, not the free tier. Google's terms for paid use state that content submitted through it is not used to train or improve their models.
• Google does not restrict this processing to a particular country. Their terms for paid use say the data may be stored temporarily or cached in any country in which Google or its agents maintain facilities.
• We record that a request happened and what it cost in tokens, but not what it contained.
• Workspaces on eligible plans may supply their own AI provider key, in which case requests are made against that key instead of ours.
• AI output is generated automatically and can be wrong. It is a drafting aid: nothing becomes part of an approved pack without a person reviewing and approving it.
• We do not make decisions about you by automated means that produce legal or similarly significant effects.

Legal Basis for Processing (UK/EU GDPR)

• Contract — to provide the platform to you and your organisation and to take payment for it.
• Consent — for marketing email, and for analytics cookies on our public website. You may withdraw either at any time without affecting your account.
• Legitimate interests — to secure the service, prevent abuse (including accounts shared between people), diagnose faults, and improve the product in ways you would reasonably expect.
• Legitimate interests — to email people at UK companies about Requio where their role suggests it is relevant to their work. You can object at any time, and we will stop.
• Legal obligation — where the law requires it.
• Where we act as a processor for customer content, we process it on our customer's documented instructions under our agreement with them.

Sub-Processors

We use the following providers to run Requio. Each may process personal data on our behalf, is permitted to act only on our instructions, and is bound by appropriate data protection terms.

Several of these providers process data outside the UK — see International Transfers below. Each of them in turn uses its own suppliers: in particular Loops, which sends our review notices and marketing email, passes contact data to its suppliers, which include an AI provider and a data-enrichment service, and publishes that list at loops.so/subprocessors. Providers we use only for contacting people about Requio are described by category in If We Contact You About Requio. We keep our own list current when we change providers.

Data Storage and Security

• Data is hosted on Amazon Web Services in their London region (eu-west-2). Traffic is encrypted in transit using TLS, and our database is encrypted at rest.
• Passwords are stored as salted bcrypt hashes and are never stored in plain text.
• Access to a workspace is limited to the people your administrators invite, with permissions determined by the role they are given.
• Files submitted through secure upload links are scanned for malware before they can be opened or indexed.
• We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure.

Data Retention

• Account data is kept for as long as your workspace is active.
• Content belongs to your organisation and is kept until they delete it or close their workspace.
• Audit and version history is kept for the life of the workspace, because it is the record of who approved what and when.
• Records of refused sign-ins are kept for the life of the workspace too, as part of that same history.
• Records of successful sign-ins are deleted automatically after 90 days.
• Cancelling a paid plan does not delete anything. The workspace moves to the Free plan and its content stays where it is.
• When a workspace is closed at your request, we delete its content, accounts and history within 30 days of the request. Our database backups are kept for 7 days, so the last copies are gone within a further 7 days.
• Copies of the database taken by hand, for example before a release, are deleted within 30 days.
• Billing records, such as invoices and payment history, are kept for six years, because UK tax law requires it.
• Our server logs, which can include an email address or IP address, are deleted automatically after 90 days.
• Marketing contacts are kept until you unsubscribe, after which we keep a minimal record of the fact that you opted out so we do not contact you again.
• If we contacted you about Requio, your details and our emails are deleted 12 months after the last email between us, unless you become a customer. People we found but never emailed are deleted 12 months after we found them. If you asked us to stop, we keep your email address on a do-not-contact list so we never contact you again.
• If you want your account closed or your personal data deleted, contact support@requio.co.uk and we will action it, subject to any records we must keep by law.

International Transfers

• Your workspace and its content are held in the UK, on Amazon Web Services in London. Several of the providers listed above, however, process data outside it.
• Stripe processes billing data in the United States. Loops, which sends our review notices and our marketing and lifecycle email, processes contact data and the content of those notices in the United States. Vercel, which hosts our website, processes requests primarily in the United States. Google may process AI requests in any country in which it operates. Some of the service providers that help us contact people about Requio, and Apollo.io, where their work contact details come from, are based in the United States.
• Where data is transferred internationally, we rely on appropriate safeguards — standard contractual clauses, the UK International Data Transfer Addendum, or the EU–US and UK–US Data Privacy Frameworks, depending on the provider.

Your Rights (UK/EU)

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing
• Object at any time to being emailed about Requio, which always stops it
• Withdraw consent at any time
• Request data portability
• To exercise your rights, contact support@requio.co.uk.
• If your data sits inside a customer's workspace, we will pass your request to that organisation, as they control it.
• You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local EU data protection authority.

US Privacy Rights

• If you are located in the United States, you may have rights under applicable state privacy laws (such as the CCPA/CPRA), including the right to request access to or deletion of your personal information.
• We do not sell personal data and do not engage in targeted advertising based on sensitive personal information.

Error Monitoring

• We use Sentry, a third-party error-monitoring service, to help us detect and fix technical issues with our website and application. Our Sentry account is hosted in the EU, and this data is processed in Germany.
• When an error occurs, Sentry may capture a replay of your on-screen session in the moments around that error (such as page interactions) to help us diagnose the problem. This is used solely to improve the reliability of our service, and does not use cookies.

Website Analytics

We measure how people find and move through our public website and sign-up pages, so we can see where it is confusing and fix it. This runs only if you accept cookies, and never inside the platform itself.

• We use PostHog, an analytics provider. Our PostHog project is hosted in the EU, and this data is processed in Frankfurt, Germany.
• Nothing is recorded, and no information about you leaves your browser, until you accept our cookie banner. Until you do, the analytics software is not even downloaded to your device — so if you reject it, nothing is ever loaded, nothing is ever sent, and no cookies are set.
• We record a small, fixed set of moments: which of our public pages you visit, and the steps of signing up — starting the form, submitting it, reaching the "check your inbox" page, and verifying your email address.
• We do not record what you type. Your name, email address, workspace name and password are never sent to our analytics provider.
• Your IP address is used to derive an approximate location, such as country or region. We do not build a profile against a named person.
• None of this runs on pages inside the platform. Once you are signed in and working on your projects, nothing there is measured by analytics.
• You can change your mind at any time using the "Cookies" link in our website footer.

Cookies and Browser Storage

• We use analytics cookies on our public website and sign-up pages, and only where you have accepted them. They let us see which pages people visit and where they give up while signing up — see Website Analytics.
• We do not use advertising or ad-targeting cookies, and we do not sell your data.
• To keep you signed in, we store an access token in your browser local storage. This is strictly necessary for a service you have asked for and does not require consent under UK PECR.
• A small number of strictly necessary cookies may be set to operate the site, for example to remember a preview or access setting. These are not used to track you.
• Your answer to the cookie banner is remembered in your browser so you are not asked on every visit. The "Cookies" link in our website footer re-opens that choice at any time. Rejecting stops any further analytics immediately; where analytics was running, our provider keeps one small entry in your browser for the sole purpose of remembering that you opted out, and where it was not, any entry left by an earlier acceptance is removed.

Changes to This Policy

• We may update this Privacy Policy from time to time as Requio evolves. The latest version will always be available on our website, with the updated date shown at the top.