Privacy policy

Last updated 09-Nov-2026

Who we are

InDate is run by MHUSolutions Ltd (“we”, “us”), a company registered in England and Wales, company number [COMPANY NUMBER], registered office [REGISTERED OFFICE ADDRESS]. For anything about privacy or your data, email hello@mhusolutions.com.

Two kinds of data

Your account. When a business signs up, we are the controller of the account details: the names, email addresses and passwords of the people who log in, the company name, and billing records.

Your team’s records. The details a business adds about its workers – names, job titles, departments, mobile numbers, email addresses, card and certificate details, expiry dates, photos and documents – belong to that business. The business is the controller of that data and we process it only on its behalf and on its instructions, under our data processing terms. If you are a worker and want to see, correct or remove your details, please contact your employer first; we will help them respond.

What we collect and why

• Account and login details, to give you access and keep your account secure. Lawful basis: performing our contract with your business.
• Billing details, to take subscription payments. Card details go straight to Stripe; we never see or store your card number. Lawful basis: contract, and legal obligations for tax records.
• Team records, to track expiry dates, send reminders, produce site packs and the training matrix. Lawful basis: processed for your business under our data processing terms.
• Who changed what (an audit log of changes, with the login and time), to keep records accurate and secure. Lawful basis: legitimate interests.
• Service emails, such as login links, reminders, weekly summaries and notices about your account. We do not send marketing emails without asking first.

Who helps us run InDate

We use these suppliers, each bound by data protection terms and given only what it needs:

• Supabase: database, logins and file storage, hosted in the EU (Frankfurt, Germany).
• Stripe: subscription payments.
• Resend: sending emails, from the EU (Ireland).
• Cloudflare: hosting the website and forwarding our email.
• Google Fonts: the typefaces on our pages, which means your browser contacts Google’s servers.
• Meta (WhatsApp): only if your business uses automatic WhatsApp reminders on the Business plan.

Some suppliers may process data outside the UK. Where they do, they rely on UK adequacy regulations or the UK International Data Transfer Addendum to protect it.

How long we keep it

• Account and team records: while your subscription is open. If you close your account, we delete your company’s data within 30 days.
• People archived after a move to a smaller plan: deleted 90 days after archiving unless restored.
• Billing records: 6 years, as UK tax law requires.
• Backups: overwritten within 30 days.

You can export your data or delete it at any time from inside InDate.

Cookies and storage

We only store what’s needed to keep you logged in. We don’t use advertising or tracking cookies.

Keeping data safe

Data is encrypted in transit and at rest. Each company’s data is kept separate, and logins only see what their role allows. Photos and documents are private and shown through links that expire after an hour.

Your rights

You have the right to access, correct, delete or move your personal data, and to object to or restrict how we use it. Email hello@mhusolutions.com and we’ll respond within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If we change this policy in a way that matters, we’ll tell account owners by email before it takes effect.