Privacy Policy

PolicySight Limited

First Floor, 81-85 High Street, Brentwood, Essex, England, CM14 4RR

Last updated: 30 June 2026

Who We Are

PolicySight Limited is a UK company that helps organisations get more out of Microsoft 365. We design SharePoint sites, build automations, and create business applications that run inside an organisation's own Microsoft environment. Governance Hub, our committee governance software, is the first of these applications.

Our website is for information and enquiries. We do not sell anything directly through it. We are committed to protecting your personal data and respecting your privacy rights under UK GDPR and the Data Protection Act 2018.

What Personal Data We Collect

We collect and process the following personal data:

Enquiry Information:

Your name and email address
The service you select and the message you send us
Any file you choose to attach to your enquiry

Assistant Information:

If you chat with Polly, our website assistant, a record of that conversation

Account Information (administrators only):

We maintain a small number of accounts for our own team to manage enquiries and respond to messages
We do not offer public account sign-up on the website

Technical Information:

IP address and browser information (for security and basic functionality)
Cookies necessary for website operation, plus optional analytics cookies if you enable them

Legal Basis for Processing

We process your personal data under the following legal bases:

Legitimate Interests: To respond to your enquiries, provide and improve our website and services, and keep our systems secure
Consent: For optional analytics cookies, which are off by default
Contract: Where we are providing services to you under an agreement
Legal Obligation: To maintain records as required by UK law

How We Use Your Data

We use your personal data to:

Respond to your enquiries and provide the information or services you ask for
Run and improve our website and services
Keep our website and systems secure and prevent fraud
Comply with our legal and regulatory obligations

We do not use your data for marketing or advertising. With your consent, we use privacy-friendly Google Analytics to understand how the website is used and improve it. This is optional, off by default, and you can decline it.

Data Sharing

We share your data only with the service providers who help us run our website and services, and only as necessary:

Supabase: Hosts our database and securely stores enquiry and assistant data
Vercel: Hosts our website and provides privacy-friendly, aggregate usage and performance measurement
Resend: Delivers email, such as our replies to your enquiry
ElevenLabs: Powers Polly, our website assistant
Google Analytics (only if you enable analytics): Processes anonymised usage data under its own terms, with IP anonymisation on and personalised advertising off
Legal Requirements: We may disclose data if required by law or court order

We do not sell or rent your personal data, and we do not share it for anyone else's marketing.

Governance Hub

Governance Hub is our committee governance software. It works differently from the rest of our website in one important way: it runs inside your own organisation's Microsoft 365 tenant.

Your data stays with you. Governance Hub stores its data (committees, members, meetings, actions and documents) in your own Microsoft environment: your Dataverse, your SharePoint, and your Azure subscription. That data does not leave your tenant and is not sent to PolicySight.
You are the data controller. For all governance and member data in Governance Hub, your organisation is the data controller and Microsoft is your processor. PolicySight is neither.
What PolicySight can access. We do not access your Governance Hub data as a matter of course. Any support access is limited, agreed with you in advance, and covered by our support agreement. Diagnostic files you send us are designed to exclude secrets and personal data.
What PolicySight does collect. If you enquire via the Microsoft Marketplace or contact us, we receive your contact details (name, email, organisation) and any support messages, used only to respond to you and manage our relationship.

Your Rights

Under UK GDPR, you have the right to:

Access your personal data
Rectify inaccurate data
Erase your data (subject to legal retention requirements)
Restrict processing in certain circumstances
Data portability - receive your data in a structured format
Object to processing based on legitimate interests
Withdraw consent where processing is based on consent

To exercise these rights, contact us

Data Retention

We retain your data for the following periods:

Enquiry and contact messages: Up to 2 years
Website assistant conversations: Up to 24 months, or until you ask us to delete them
Administrator account data: While the account is active, then deleted within 30 days
Technical logs: 12 months

Data Security

We implement appropriate technical and organisational measures to protect your data, including:

Secure hosting infrastructure
Encrypted storage of data and passwords
Regular security monitoring
Access controls limiting data access to essential personnel only

Cookies

We use essential cookies necessary for website functionality:

Session cookies to maintain your login
Security cookies to prevent fraud
Functional cookies to remember your preferences

We use essential cookies so the website works. We also offer optional analytics cookies (Google Analytics, with IP anonymisation and no personalised advertising), which stay off unless you choose to enable them. We do not use advertising or cross-site tracking cookies. For full detail, see our Cookie Policy.

International Transfers

While we primarily serve UK and EU customers, some of our service providers may process data outside the UK. Where they do, the transfer is covered by appropriate safeguards (such as the UK International Data Transfer Agreement or standard contractual clauses) so that your data keeps an equivalent level of protection under UK GDPR.

Children's Privacy

Our services are not intended for individuals under 16. We do not knowingly collect personal data from children under 16.

Changes to This Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. We will notify you of material changes by email or a prominent notice on our website.

Contact Us

For any privacy-related questions or to exercise your data protection rights:

Email: Contact Us

Post: PolicySight Limited, First Floor, 81-85 High Street, Brentwood, Essex, England, CM14 4RR

Complaints

If you believe we have not handled your personal data appropriately, you can lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk

Phone: 0303 123 1113

Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF