Your data, our duty.

1. Who we are

RateCalc.io is a trading name of MCR Labs Ltd ("we", "us", "our"), a company registered in England and Wales under company number 17228923, with registered office at 89 Chorley Road, Manchester, England, M27 4AA.

This policy sets out how we collect, use and protect your personal data when you use the RateCalc.io service. We act as data controller for the personal data of our customers (recruitment agencies and their consultants) and as processor for the client and candidate data those agencies enter into the platform.

2. What data we collect

Account data

When you sign up we collect your name, work email address, and a hashed password. If you create an agency we also collect agency name, address, phone, logo, and brand colours.

Subscription and payment data

Payment processing is handled entirely by Stripe. We do not see or store your card details. We store the resulting Stripe customer and subscription identifiers so we can match payments to your account.

Document and proposal data

Rate proposals and Terms of Business documents you create (including client company details, contact names, rate cards, and the contents of any uploaded ToB document) are stored against your agency account. Where a client signs a Terms of Business document, we record their name, role, signature image, IP address, browser user-agent and timestamp as evidence of acceptance.

Usage data

We log basic technical information (IP address, browser type, pages visited) to keep the service running, prevent abuse, and improve the product. If something breaks in your browser, an error report (the page, browser details and the error itself) is sent to Sentry so we can fix it. We measure page speed with Vercel Speed Insights, which doesn't use cookies. We do not use third-party advertising trackers.

Website visits and marketing

If you accept analytics cookies, we use Apollo.io's website tracker to see which companies visit our site, and we remember the page or campaign that first brought you here so we know which marketing works. Neither runs unless you say yes. See Cookies below.

Prospecting

We contact people at UK recruitment agencies about RateCalc.io by email. We get their business contact details (name, job title, work email, company) from Apollo.io and rely on our legitimate interest in telling relevant businesses about a product built for them. Every email lets you opt out, and we stop straight away if you reply asking us to, or email hello@ratecalc.io.

Support chat

If you use live chat, your messages and (if you're signed in) your name, email, agency name and plan are handled by Crisp so we can answer you.

3. How we use your data

• To provide the service you've signed up for (creating, sending and tracking proposals and Terms of Business).
• To process subscription payments and send billing receipts.
• To send transactional email (account confirmation, password resets, document responses, signature notifications).
• To respond to support enquiries and handle problems with the service.
• To detect and prevent fraud, abuse, or breach of our Terms of Service.
• To draft proposal wording with AI when you ask for it (see Anthropic below).
• To tell UK recruitment agencies about RateCalc.io, and to understand which of our marketing works.
• To meet our legal and regulatory obligations.

Our legal bases under UK GDPR are: contractual necessity (delivering the service you've subscribed to), legitimate interests (running and securing the service), and consent where required.

4. Who we share data with

We use a small number of carefully chosen sub-processors. Each is bound by a data processing agreement with us:

• Supabase: database and authentication. Data stored in the EU.
• Stripe: payment processing. Subject to its own privacy policy.
• Resend: transactional email delivery.
• Vercel: application hosting and edge network.
• Anthropic: AI features. When an agency uploads a Word document to the Terms of Business parser we send the document text for clause extraction, and when a consultant asks for AI-written proposal wording we send the context they've entered (agency, client, sector, roles and any notes). Processed in the US and not used to train models.
• Crisp: live chat and our help centre. EU (France).
• Sentry: error monitoring for the website and app. EU (Germany).
• Apollo.io: website visitor insights (only with your consent) and the business contact data we use for prospecting. US.
• Microsoft 365: our own email, including anything you send to hello@ratecalc.io.
• Xero: only if your agency connects its own Xero account. We then read invoice and contact data from Xero on your instruction.

We do not sell or rent personal data to third parties. We disclose data to law enforcement only where required by valid legal process.

5. Where your data is stored

Your data is stored in the European Union. Some sub-processors (notably Stripe, Anthropic and Apollo.io) may process data outside the UK / EU under appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations.

6. How long we keep your data

We retain account and document data for as long as your subscription is active and for a reasonable period afterwards, so you can resume your subscription without losing your work. If you delete your account, we delete your account and document data within 30 days, except where we're required to retain records for tax, accounting or legal purposes (typically up to 7 years).

7. Your rights

Under UK GDPR, you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted ("right to be forgotten");
• restrict or object to certain processing;
• port your data to another service;
• complain to the Information Commissioner's Office (ico.org.uk) if you think we've handled your data improperly.

To exercise any of these rights, email hello@ratecalc.io. We'll respond within one calendar month.

8. Cookies

Essential cookies keep you signed in and remember your choices. Everything else is optional and only loads if you say yes in the cookie banner. You can change your mind at any time: Cookie settings.

Sentry error reporting and Vercel Speed Insights don't store anything on your device. We don't use advertising cookies. The public proposal and Terms of Business pages agencies send to their clients load no optional cookies at all.

9. Security

We use industry-standard technical measures (TLS in transit, encryption at rest, principle-of-least-privilege access controls). No internet service is 100% secure; we'll notify affected users without undue delay if we ever experience a breach affecting personal data.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated by email to active subscribers.

11. Contact

Questions about this policy or how we handle your data? Email hello@ratecalc.io.