Ida Solutions & Partners Ltd, a company registered in England and Wales, is the controller of the personal data described below.
Contact: data@runida.com — for any question about this notice, or to exercise a right
under it.
We have not appointed a statutory Data Protection Officer. On the current analysis one is not required (Art. 37: we are not a public authority, and our core activities are not large-scale systematic monitoring or large-scale special-category processing).
It is NOT the notice for a business's own clients, suppliers or contacts. See §9.
| What | Why | Lawful basis |
|---|---|---|
| Account data — name, work email, profile picture, the org you belong to, your role | To create your account, authenticate you, and apply the right permissions | Contract (Art. 6(1)(b)) |
| Authentication data — sign-in events, session tokens | To keep the account secure | Legitimate interests (security) |
| Billing data — org, plan, usage volumes, spend | To invoice, and to keep the accounting records the law requires | Contract; legal obligation (Art. 6(1)(c)) |
| Support correspondence | To answer you | Contract; legitimate interests |
| Security and audit logs — who approved what, and when; the IP address and browser of whoever accepts our Terms | To keep the Service secure, and to evidence what the Service did on whose authority | Legitimate interests (security, accountability) |
| Product usage — which features you open and use and which fail for you, tied to your account and org, with an identifier stored on your device | To see what works, what breaks and what nobody uses | Consent: you are asked when you accept our Terms or join a company, and can change your answer in Your account. Nothing is measured or stored on your device until you agree |
| Service activity — the days you are active and how long Ida takes to answer | To run and size the Service | Legitimate interests (running the Service) |
| Error reports — the technical detail of a fault and the account it happened to | To find and fix faults | Legitimate interests (keeping the Service working) |
| Notification devices — a token for each phone or browser you turn notifications on for | To deliver the notifications you asked for | Contract |
| Website analytics | To understand how the site is used | Consent |
| Waitlist sign-up — name, work email, company, website, team size, how you use AI today, your browser | To decide who to invite next and to contact you about joining | Steps at your request before a contract; legitimate interests |
| Marketing to prospects | To tell you about the Service | Consent, or legitimate interests (B2B) |
| Onboarding questions — the address you'll sign in with, where your email lives, the tools you use, the first job you want Ida on, and your booking | To prepare your onboarding call, which you asked for | Steps at your request before a contract (Art. 6(1)(b)) |
What is NOT in this table is the mail, documents and business records a company connects to Ida. That is the company's data, they are its controller, and it is governed by the DPA. Keeping the two apart is not presentational: we classify every table in our database by which of the two applies, and the classification is enforced in our build. We do this because the ICO's position is that a party unable to distinguish in its systems what it processes as controller from what it processes as processor is likely to be treated as a joint controller of all of it.
When a business connects a mailbox, Ida builds an index of message headers — who, to whom, subject, date. We do not keep message bodies. When a task genuinely needs one, Ida reads it live from the mailbox, uses it, and keeps only the headers and a reference to read it again. What Ida writes about a message, such as a reply, a note or a to-do, is kept, and it may quote the message. A reply Ida drafts keeps the message it answers until someone sends or declines the reply.
Disconnecting a mailbox deletes the index and the access tokens. When a person disconnects their own mailbox, they are asked whether the Service should also delete what it derived from their mail — the memories, contacts and to-dos it recorded. If they choose to, those are deleted too; if not, they remain as the business's own records. A shared company mailbox is disconnected by an admin, and what was derived from it remains as the business's records. Attachments filed into a room, by a person or by Ida, meetings prepared from the calendar and the record of what was sent remain either way. The same choice is offered when a connected system such as Xero is removed.
What the Service holds of your correspondence is the envelopes, not the letters.
Stored in the EU. Some of it is processed in the US.
Your data is stored in the EU. Our servers and our database are EU-resident.
But AI processing happens in the United States. When the Service needs to read or write something intelligently, that content goes to our AI providers: OpenAI, Anthropic and TypeSafe, and Google for images. All four are US-based. A few of our other suppliers are in the US too: email delivery, phone notifications, web search and our team's alerts. The Sub-processors page names each one and where it is. Our AI providers may keep what they are sent for a limited time to check for abuse, and then delete it.
Those transfers are covered by the Standard Contractual Clauses as amended by the UK Addendum — the safeguard UK law provides for exactly this, approved by the Information Commissioner, governed by English law with the ICO as the supervisory authority. We keep a Transfer Risk Assessment for them.
Our suppliers ("sub-processors"), each under a contract that binds them to the same protections. The current list is published at Sub-processors and we give 30 days' notice, by email and on that page, before adding or replacing one.
Two suppliers handle only data about our own prospects and visitors, so they are not on that page: Google Analytics measures our website if you allow it, and Calendly takes the booking if you arrange an onboarding call. Both are in the US.
We also disclose personal data where the law requires it, or to establish or defend legal claims.
| What | How long |
|---|---|
| Account data | While you belong to a company. Your sign-in account is deleted once you belong to none |
| Your org's data | When you ask us to delete your company, it closes for 30 days: nothing runs, its connections are disconnected, and your admins can download an export or keep the company. Then it is erased, unless you told us in writing to erase it at once |
| Onboarding questions | Until you create your company, when they become part of it and are cleared from here; otherwise 90 days after you last answered |
| Waitlist sign-up | 12 months after you sign up, or after we invite you; 30 days after you create or join a company; sooner if you ask. If you asked for a code and never finished signing up, your email address is kept for 30 days |
| Product usage | Until you withdraw consent; deleted with your account |
| Accounting records | 6 years from the end of the relevant financial year (Finance Act 1998 Sch. 18 para 21), longer if HMRC opens an enquiry — the period runs to the latest of the anniversary, the enquiry's completion, or the closure of the enquiry window |
| Access and approval records | Kept while we may need to evidence what the Service did on whose authority, then deleted. You can object (§8) — this retention rests on our legitimate interests, not on a legal duty, so an objection releases it |
| Your company's acceptance of our Terms | While your company's contract with us continues, then deleted with the company. We keep it to establish or defend legal claims |
| Backups | See below |
Two things worth saying out loud, because most notices imply the opposite:
What survives an erasure survives per RECORD, not per customer. An invoice we are obliged to keep is not a licence to keep your correspondence. When your organisation is erased and we keep an accounting record, we strip the identifying parts of it — the invoice keeps the org, the money and the period; it does not keep which of your staff did what.
Backups. When we delete your data, it goes from our live systems immediately, and the error reports our suppliers hold expire within 30 days. Your data may persist in encrypted backups until they expire on our rotation schedule — a maximum of 7 days. During that window the data is held beyond use: we do not access it, we do not use it to inform any decision about anyone, and it is deleted on schedule.
We tell you this because the ICO expects us to be absolutely clear about what happens to your data in backups when you ask for erasure — and because "deleted immediately" would be a simpler sentence and a false one.
You can ask us to: give you a copy of your data (access); correct it; delete it (erasure); restrict or object to how we use it; or give you a portable copy. Where we rely on consent, you can withdraw it at any time.
Some of these have limits:
Email data@runida.com. We respond within one month. If we need to verify who you are
or ask what you mean, the clock pauses while we wait (UK GDPR Art. 12A, in force 5 February
2026). If it is genuinely complex we may extend by two further months, and we will tell you
why within the first month.
You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). You do not have to raise it with us first.
We hold information about you, and the business — not us — is the controller of it.
You are likely to be the largest group of people this system touches, and the least likely to have heard of us.
If a business uses Ida, our Service may hold your name, your email address, the subject lines and dates of correspondence between you and them, and things their staff have recorded about your working relationship. We hold it on their instructions and we do not use it for our own purposes.
Your rights are exercised against the business, because they decide what is held and why. Contact them. If you contact us instead, we will not act on the request ourselves — we will tell them promptly and help them respond, which is what a processor is required to do and what any other answer would misrepresent.
If you do not know which business holds your data, write to data@runida.com and we will do
what we can to point you the right way.
We will post changes here, and tell you about anything significant by email rather than waiting for you to notice.
Last updated: 8 October 2026