Privacy notice

Who is responsible for your information

The SOP Hub is operated by THE SOP HUB LTD, registered in England and Wales with company number 17519712. Our registered office is Office 53C, Unimix House, Abbey Road, London, NW10 7TR, United Kingdom. You can contact us at hello@thesophub.com.

We are the data controller for account, website, billing and support information. A business customer normally controls the personal information it adds to its private workspace, and we process that information on its instructions to provide the service.

Information we collect

• Name, email address, login and account-security information.
• Business profile, team membership and support communications.
• SOPs, versions, approvals, assignments, checklist notes and evidence that you choose to add.
• Business Hub documents, uploaded files, spreadsheet content, file versions, sharing permissions and reminders; team messages and time records.
• Agreement records, including the document versions and time of your acceptance.
• Subscription, invoice and payment-status information. Stripe processes card details; we do not store full card numbers.
• Service activity and technical information needed to operate, secure and improve the platform.
• Marketing preferences and the date, wording and source of any email consent you give us.

Email updates and marketing

Account, security and billing messages are service communications needed to run your account. Marketing emails are separate and are sent only after you choose to subscribe and confirm your email. Every marketing message includes an unsubscribe link. We keep a minimal suppression record after you unsubscribe so that we can respect your choice.

If you have confirmed marketing consent and start but do not finish checkout, we may send one reminder. We do not email anonymous website visitors merely because they viewed a page.

Optional website analytics

With your consent, we use Google Analytics 4 on public website pages to understand visits and which websites refer visitors. Google receives technical information such as browser/device details, approximate location, a cookie identifier and the public page viewed. We do not install this tag inside private workspaces or account sign-in and signup pages, and do not send workspace records, names, email addresses or URL query strings. Google signals and advertising personalisation are disabled. With the same analytics consent, our server also reports a newly verified email signup and a completed free-trial checkout confirmed by Stripe when you return to Billing. These events use the existing analytics identifier and, where available, session identifier, not your name or email address. Only the plan name is included with the trial event; no payment details are sent. Events are deduplicated. Pending signup references stop being usable after 24 hours. During analytics processing, expired references are cleared and internal deduplication hashes older than 180 days are deleted. Use Cookie settings on a public page to withdraw consent at any time. See our cookie information for storage and expiry details. Google may process analytics data outside the UK; its applicable data-processing terms and international-transfer safeguards govern that processing.

Why we use it

We use information to create and secure accounts, provide private workspaces, generate and manage SOPs, deliver invitations and support, administer subscriptions, prevent abuse, meet legal and accounting duties, and improve the reliability of the service.

Depending on the activity, our lawful basis is performance of our contract, compliance with a legal obligation, our legitimate interests in operating and protecting the service, or consent where the law requires it.

Providers and international transfers

We use specialist providers including Supabase for authentication, Stripe for payments, OpenAI for AI-assisted drafting, Resend for transactional email, and hosting and infrastructure providers. They receive only the information needed to provide their service. Where information is transferred outside the UK, we use an appropriate legal safeguard required by UK data-protection law.

File malware scanning

We use attachmentAV (widdix GmbH, Germany) to scan new uploaded files through its EU synchronous API before storage. Files are processed on temporary encrypted storage, with immediate deletion after scanning according to the provider. It states that synchronous scan-result metadata is not stored. AWS EMEA provides its infrastructure. The provider says file hashes, not file contents, may be checked remotely with Sophos SXL; locations and safeguards for those checks remain under verification. Infected or inconclusive files are rejected; if the scanner is unavailable, the upload is not stored. Existing stored files are not automatically rescanned. See the file-scanning information for details and subprocessor arrangements. We do not claim that scanning guarantees a file is safe.

Retention and security

We keep information while an account is active and for as long as reasonably needed afterwards for account closure, disputes, security, backups, legal and accounting obligations. Retention varies by record type. Workspace permissions and technical controls restrict access, but no online service can guarantee absolute security. Please avoid adding unnecessary sensitive personal information to an SOP.

Your rights

Depending on the circumstances, you may ask us for access, correction, deletion, restriction, portability or to object to processing. You may also withdraw consent where we rely on it. Email hello@thesophub.com to make a request. You can complain to the UK Information Commissioner's Office if you are unhappy with our response.

Changes to this notice

We may update this notice as the service or the law changes. The effective date above shows when it was last updated.