How EQ-3 handles your data

Last updated: 28 July 2026.

EQ-3 is a trading name of Primordium Limited, a company registered in England and Wales (company number 17340607), registered office Bartle House, 9 Oxford Court, Manchester, M2 3WQ. We are the “data controller” for the information described here. You can reach us at office@primordium.co.uk. We are registered with the UK Information Commissioner’s Office (ICO).

The short version

We are built to take as little of your personal data as possible. Where we can avoid holding something about you, we do. Some things happen only on your own device and never reach us. We don’t sell your data, we don’t run ads, and we don’t build profiles about who you are.

What we collect, and why

An anonymous ID. When you use EQ-3, we give you an anonymous identifier so the service works across your visits. It isn’t your name, and on its own it doesn’t tell us who you are — and it changes regularly by design, so even this identifier never accumulates a long history.

Payment information (only if you buy something). When you buy a session or pack, payment is handled by our payment provider (Stripe). They process your card details securely — we don’t see or store your full card number. We keep a basic record that a purchase happened, so you can access what you bought and so we meet our tax and accounting duties.

Things you choose to tell us. If you contact us, or take part in something optional that asks for information, we hold what you provide, for as long as we need it to help you.

Basic technical information needed to deliver the service and keep it secure and working (for example, the type of device you’re using). We keep this minimal.

Voice, and things that stay on your device

Some features (for example, sessions that respond to your voice) work on your own device. Where that happens:

• Your voice sample is used on your device and is not sent to us and not stored — the moment the feature has what it needs, the sample is gone.
• Any personalised information built from your use lives on your device, under your control — not on our systems.

We designed it this way on purpose. The most personal things stay with you.

How our service learns

EQ-3 improves over time, but it is built to learn from patterns, not about individuals. To do that, we may record de-identified signals about how the service is used — for example, which session you chose, how long it ran, and whether you finished — tied only to an anonymous device identifier. We do not record the words you write or the sound of your voice: those stay on your device and are never sent to us (see “Voice, and things that stay on your device”). Any signals we keep are combined with others’ and stripped of identifying detail, so they become general insight — never a record of, or a profile about, any one person. And they don’t linger: within seven months, individual signal entries are folded into anonymous monthly counts and deleted (see “How long we keep things”).

What we don’t do

• We don’t sell your personal data to anyone.
• We don’t show ads or let advertisers target you.
• We don’t build profiles about your identity, and we don’t track your behaviour across the internet.

Who we share data with

We use a small number of trusted service providers to run EQ-3 — for example, our payment provider and our hosting provider. They only process data on our instructions and to provide their service to us. We don’t share your data with anyone else unless the law requires us to.

We aim to keep data within the UK or European Economic Area. Our systems are hosted on Supabase, with data stored in the United Kingdom (London region); payments are processed by Stripe. Where a provider processes data elsewhere, we ensure appropriate legal protections are in place.

How long we keep things

Deletion here isn’t a vague promise — these windows are written into our systems as fixed rules, and a job runs every night to apply them. The actual windows:

• Usage signals (the de-identified session signals above): kept as individual entries for no more than 7 months. We clear them by whole calendar months, so an entry lives six to seven months depending on when it arrived. After that they are folded into anonymous monthly counts — numbers with no identifier at all — and the individual entries are deleted.
• Day-to-day service counters (how many sessions ran, and similar): 90 days.
• Invitation codes: once a code has been used, it is deleted on the next nightly clear-out.
• Creator submissions that don’t go ahead: deleted in full after 90 days — the recording, our notes, and the record itself.
• If you’re a creator and you leave: your email address is deleted immediately and permanently — it’s the only email our systems hold, and it doesn’t survive your leaving.
• Purchase records: kept so you keep access to what you bought, and for as long as tax law requires (up to 6 years).
• Consent records: kept, because the law expects us to be able to show what was agreed and when.

Your rights

Under UK data protection law you have the right to ask us to: show you the personal data we hold about you; correct it if it’s wrong; delete it; or restrict how we use it, among others. Because we hold very little that identifies you, some of these may not apply — but where they do, we’ll honour them. To make a request, email office@primordium.co.uk.

You also have the right to complain to the ICO (ico.org.uk) if you’re unhappy with how we’ve handled your data — though we’d appreciate the chance to put things right first.

The lawful bases we rely on

We process your data on these bases: to perform our contract with you (delivering what you bought); our legitimate interests in running and improving a minimal, privacy-respecting service; your consent for anything genuinely optional (which you can withdraw); and legal obligation for things like tax records.

Changes

If we change this notice, we’ll update the date above and, for significant changes, let you know.

This notice is written to be read. If anything here is unclear, email us and we’ll explain it plainly.