Privacy policy

Last updated 23 July 2026

This policy explains what personal data QScope handles, why, and what rights you have. It covers UK GDPR and the Data Protection Act 2018.

Data controller for account data: Reltic BIM Ltd
Office 676, 60 Tottenham Court Road, London, W1T 2EW, England
Contact: support@qscope.co.uk

1. Two different roles, and why the distinction matters

QScope handles two kinds of personal data and our legal role is different for each.

Your account data: we are the controller

Your name, work email, password hash, practice name, plan, sign-in times and billing records. We decide how this is used, so we are the controller.

Your project data: we are the processor

Project records contain personal data about other people: client contacts, subcontractor contacts, site personnel, names on certificates and in correspondence, and anyone appearing in site photographs. You decide what goes in and why, so you are the controller and we act as your processor. We handle that data only on your instructions, which are given by your use of the service and by these terms.

This means you are responsible for having a lawful basis for the personal data you put into QScope, and for telling those people how their data is used, where that is required.

2. What we collect and why

Account and login so you can sign in and so the audit trail can record who did what. Lawful basis: performance of our contract with you.
Billing records so we can take payment and meet accounting obligations. Lawful basis: contract, and legal obligation for tax records.
Audit trail recording which user changed which figure and when. This is a deliberate feature: certificates carry legal weight and traceability is expected of professional practice. Lawful basis: legitimate interests, in providing a professionally credible record.
Support correspondence when you contact us. Lawful basis: legitimate interests, in answering you.
Server logs including IP address, kept for security and fault diagnosis. Lawful basis: legitimate interests, in keeping the service secure.

We do not sell personal data, we do not use it for advertising, and we do not use your project data to train machine learning models.

3. Cookies

QScope uses a session cookie to keep you signed in and a token to protect against cross-site request forgery. Both are strictly necessary for the service to work, so no consent banner is required. We do not use advertising or analytics cookies.

4. Who else processes your data

We use a small number of sub-processors. Each is bound by contract to protect the data and to use it only for the service it provides:

Hostinger – hosting and database storage.
Stripe – subscription payments. Card details are entered on Stripe's own pages. QScope never sees or stores a card number.
Google – outbound email for invitations, guest access links and notifications, where email is enabled on the account.

We will tell you before adding a sub-processor that handles project data.

5. Where data is held

Project data and account records are stored on servers in the United Kingdom or the European Economic Area. Where a sub-processor transfers data outside the UK, that transfer relies on UK adequacy regulations or on the International Data Transfer Addendum to the EU standard contractual clauses.

6. How long we keep it

Project data: for as long as your account is active. After cancellation it stays available for export for 60 days, then may be deleted.
Account data: for as long as your account is active, then up to 12 months.
Billing and tax records: six years, as required by HMRC.
Audit trail: for the life of the project record. It is deliberately not editable, because a record that can be quietly changed is worthless as evidence.

7. Security

All traffic is encrypted in transit over HTTPS.
Passwords are stored as salted hashes, never in a readable form. We cannot see your password.
Each practice's project files are stored in a separate area, keyed to the account.
Guest links give access only to the single project they were issued for, at the permission level you choose, and can be revoked at any time.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to people's rights, we will notify you without undue delay and report it to the Information Commissioner's Office where required.

8. Your rights

Where we are the controller, you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. You can also withdraw consent where we relied on it.

Write to support@qscope.co.uk. We will respond within one month.

If a person's data is in a project you control, send their request to the practice that holds the project, not to us. If you receive such a request and need our help to answer it, contact us and we will assist.

You can complain to the Information Commissioner's Office at ico.org.uk. We would rather you came to us first so we can put things right.

9. Changes

If we make a material change to this policy we will tell you by email before it takes effect.