Privacy notice

Who this notice covers

HQ is business software for scheduling work, managing customers, preparing quotes and invoices, and recording payments already received. David Cale, trading as HQ operates the service as a sole trader. Contact us using the details above.

We decide how to use account, enquiry, subscription and support information to operate HQ. For the customer and staff records a business puts into HQ, that business normally decides the purpose and lawful basis; we process those records to provide its service. If your details appear in another business’s job or invoice, contact that business first. We will assist it where required.

Information used by HQ

Depending on the features in use, this includes account names and contact details; sign-in and permission records; business and staff details; customer names, addresses and contact details; appointments, work notes and uploaded documents; quotes, invoices and payment records; support messages; and technical information needed to operate and protect the service.

Information comes from you, your authorised colleagues, the business using HQ, and services you choose to connect. A connected accounting provider may supply company details, customers, sales items and tax codes. HQ receives authorisation tokens so it can perform the accounting actions you request. It does not ask for your accounting-provider password or the password used to sign in to a connected Google mailbox.

Why we use it

• Providing the service and answering enquiries: to fulfil our contract or take requested steps before a contract. This includes account administration and support.
• Operating a business account securely: our legitimate interests in preventing misuse, controlling access and resolving technical problems. We consider the effect on individuals when relying on this basis.
• Records required by law: to meet applicable legal obligations.
• Optional uses requiring consent: only on the basis explained when consent is requested. You can withdraw that consent without changing the lawfulness of earlier use.

Account information is needed to provide and secure the service. If you do not provide required details, we may be unable to create or support your account. Connecting accounting software is optional.

Connected services and AI

You choose whether to connect an accounting or email service. HQ sends or reads the information needed for the selected action. Transferring an invoice and asking a provider to email it are separate choices. The provider’s own terms and privacy notice also apply to its account and service. You can disconnect HQ and revoke its access in the provider’s settings.

Optional support-reply drafting can use OpenAI to propose a response from the relevant support conversation and approved help material. A person reviews the proposed reply. The accounting integration itself uses ordinary server-side API code; it does not send QuickBooks records to an AI model or use those records to train a model.

Route suggestions support scheduling decisions. They do not make legal or similarly significant decisions about people automatically.

Connecting Gmail

Connecting a Google mailbox is optional. An authorised company administrator selects the mailbox and completes Google’s sign-in and permission screens. Google handles the account password; HQ does not request or store it. Connecting email does not change your HQ sign-in.

The send-only connection receives your verified Google email address and account identifier to identify the correct company mailbox, together with access and renewal tokens. It requests permission to send email on your behalf. It does not request permission to read your inbox.

When you send a business email, HQ passes its recipient details, message and selected attachments to Google for delivery. This covers messages you send manually and messages sent under automation rules enabled by your business. HQ keeps the connection details and delivery identifiers/status needed to operate the connection, alongside your business’s own email records. Saved connection tokens are encrypted and supported connection files may be included in encrypted recovery copies.

Information received through Google APIs is used to provide and secure the connected email feature. It is not sold, used for advertising or used to train AI models. The send-only feature does not retrieve Gmail message bodies for AI drafting. HQ’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

People providing support may access Google API information only with your specific permission for the relevant support purpose, or where necessary for security, fraud prevention or a legal obligation as permitted by that policy. Necessary processing by hosting and recovery providers remains limited to operating and protecting this feature.

You can disconnect the mailbox in HQ. This removes its active saved connection token and disables sending and synchronisation for that connection. You can separately revoke HQ’s permission in your Google Account. Disconnecting does not erase existing business records or immediately rewrite recovery copies; these follow the business’s instructions, legal duties and applicable backup cycle. Contact hello@yournewhq.co.uk for a connection or deletion request.

This information website

These information pages provide product details, a link to the existing HQ sign-in and an email contact. They do not accept account applications, files, payments or connected-mailbox permissions. If you email us, we use your message and contact details to answer your enquiry and keep relevant correspondence in our Zoho mailbox.

This information website is hosted by Cloudflare Pages. It processes ordinary request and security information such as IP addresses and requested pages to deliver and protect the site. These pages do not enable advertising or audience-analytics cookies, embed third-party media or set tutorial/demo tracking cookies. The hosting provider may use essential security measures.

Who receives information

Information is available to the authorised users of the relevant business and to people providing necessary support. Service providers may process information for hosting and backups, business email, support, mapping and routing, and subscriptions where enabled. Current examples include Render for application hosting, Backblaze B2 for encrypted recovery storage, Zoho Mail for HQ’s contact mailbox, Geoapify for routing, and OpenAI when optional support drafting is enabled. Connected accounting services, Google and Microsoft 365 receive information when their relevant features are used. Cloudflare Pages delivers this information website.

We do not sell your personal information. We may disclose necessary information when legally required or to deal with a genuine security incident or legal claim. Ask us for details of the providers used for your account.

Where information is processed

Application hosting, recovery storage, support and connected services may involve processing outside the United Kingdom, depending on the provider and account configuration. A Cloudflare-hosted information site uses its international delivery network. Contact us for the locations and transfer arrangements relevant to your account.

When UK data-protection rules require safeguards for a transfer, the applicable adequacy arrangements or approved contractual safeguards must be in place. Contact us for the transfer arrangements relevant to your account and how to obtain a copy of applicable safeguards.

Keeping and deleting information

We keep account and support information for as long as it is needed to provide the service, resolve relevant issues, protect the service or meet legal obligations. The criteria include whether the account is active, whether a support matter or dispute remains open, and whether a legal record-keeping duty applies.

Customer business records are retained for the business’s use and handled on its instructions. At the end of the service, the business can request return or deletion, subject to legal duties. Backup copies are restricted to recovery and removed through the applicable backup cycle. Contact us to agree an export or deletion request and to confirm the relevant retention arrangements.

Security and browser storage

HQ uses HTTPS for its hosted service, role-based access, hashed sign-in tokens and encrypted saved accounting and connected-mailbox tokens. Access depends on your account role and the permissions granted by your business. Please protect your sign-in details and tell us if you suspect misuse.

Necessary cookies support sign-in and short-lived authorisation returns. Browser storage may remember appearance, training preferences and offline data where that feature is used. These legal pages do not set analytics or advertising cookies.

Your choices and rights

Depending on the processing and applicable law, you may request access, correction, deletion, restriction or a portable copy of your information. Where we use legitimate interests, you have a right to object. Contact hello@yournewhq.co.uk; we may need to verify your identity. If a business controls the records, we will help it respond rather than disclose that business’s records to an unauthorised person.

You can complain to us and to the UK Information Commissioner at ico.org.uk/make-a-complaint. We will publish material updates to this notice and make the current version available with the service.