Privacy Policy

Who We Are

SPEQ ("SPEQ", "we", "us") operates the GxP resource hub at speqgx.com. For the personal data described here, SPEQ is the data controller. SPEQ is operated from the United States and serves practitioners worldwide. You can reach us about any privacy matter at isaiah@speqgx.com.

The Data We Collect

We collect only the data needed to run the resource hub and the services you ask for. We do not collect special-category (sensitive) personal data, and we do not process payment or card details.

• —Newsletter & briefing sign-up — your email address, first name (optional), and the page you subscribed from.
• —Framework overview download — your name, work email, and organization, recorded when you request the PDF.
• —Maturity assessment — the answers you select and the resulting scores. The Quick Scan needs no account; emailing your results adds your name, email, and organization.
• —Account & sign-in — if you create an account, your email (magic-link) or the basic profile (email, name) returned by Google Sign-In if you use it. Signed-in features such as saved items are stored against your account only.
• —Usage data — aggregate, privacy-preserving analytics about which pages and features are used, to improve the hub (see "Cookies & Analytics").

We do not buy personal data about you, and we do not build advertising profiles.

How & Why We Use It (Legal Bases)

Under the GDPR and UK GDPR we rely on a specific legal basis for each use:

• —To deliver what you request — the framework PDF, your assessment results, account features. Basis: performance of a contract / steps taken at your request.
• —To send the Weekly GxP Briefing and any alert streams you opt into. Basis: your consent, withdrawable at any time via the unsubscribe link in every email or on your profile.
• —To understand aggregate usage and improve the hub. Basis: your consent for analytics cookies (see below); privacy-preserving, cookieless measurement runs on our legitimate interest in a reliable service.
• —To follow up with relevant GxP resources after you download the framework or request results, and to secure the platform and prevent abuse. Basis: our legitimate interests, balanced against your rights.
• —To meet legal obligations where they apply. Basis: legal obligation.

We never sell your personal data, and we do not use it for automated decisions that produce legal or similarly significant effects.

Service Providers We Share Data With

We share personal data only with the vetted providers ("processors") that run the platform on our behalf, under contracts that require them to protect it and use it only for our instructions:

• —Supabase — database and authentication (hosted on Amazon Web Services). Stores subscriber, lead, assessment, and account records.
• —Resend — delivery of transactional emails (e.g. your assessment results) and the Weekly GxP Briefing, including managing subscriber/unsubscribe status.
• —Vercel — website hosting and content delivery, plus Vercel Analytics and Speed Insights, which measure performance and traffic in aggregate without cookies and without identifying you.
• —Google — Google Analytics for aggregate usage statistics, loaded only after you accept analytics cookies; and Google Sign-In, used only if you choose to sign in with Google.
• —Microsoft — Microsoft Clarity (product analytics: aggregate usage, heatmaps, and session replay of on-page interactions), loaded only after you accept analytics cookies; Microsoft processes this data under the Microsoft Privacy Statement.

We may also disclose data if required by law, to protect our rights, or in connection with a business transfer — in which case this policy continues to govern your data.

International Data Transfers

SPEQ is operated from the United States, and our providers may process data in the US and other countries. Where personal data is transferred out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and our providers’ certifications under the EU–US Data Privacy Framework where applicable. You can contact us for more detail on the safeguards that apply to a specific transfer.

How Long We Keep Data

We keep personal data only as long as it serves the purpose it was collected for:

• —Newsletter and alert subscriptions — until you unsubscribe, after which we remove or suppress your address so you are not contacted again.
• —Download and results leads — for a limited follow-up period, then reviewed and deleted or anonymised when no longer needed.
• —Assessment responses — retained to provide and improve the assessment; you may ask us to delete yours.
• —Account data — for as long as your account is active, and deleted on request.

Cookies & Analytics

We use strictly necessary cookies to operate the site (sign-in and session management); these are always active and are not used for tracking. With your consent, we also use two analytics tools to understand how the hub is used so we can improve it: Google Analytics (aggregate, anonymised usage statistics) and Microsoft Clarity (which captures aggregate usage, heatmaps, and session replay of on-page interactions using first- and third-party cookies and similar technologies, to show how visitors navigate our pages). Neither loads until you choose "Accept" in the cookie banner: Google Analytics runs under Google Consent Mode with all analytics and advertising storage denied by default, and the Microsoft Clarity tag is not injected at all until you opt in. You can grant or withdraw this consent at any time via "Cookie preferences" in the site footer. Vercel Analytics and Speed Insights measure traffic and performance in aggregate without cookies. We use no third-party advertising cookies and do not sell or share data for cross-context behavioural advertising. For how Microsoft collects and uses data gathered through Clarity, see the Microsoft Privacy Statement at https://www.microsoft.com/privacy/privacystatement.

Your Rights

Depending on where you live, you have some or all of the following rights over your personal data. To exercise any of them, email isaiah@speqgx.com — we will respond within the time required by applicable law and will not discriminate against you for asking.

• —Access — get a copy of the personal data we hold about you.
• —Rectification — correct data that is inaccurate or incomplete.
• —Erasure — ask us to delete your data ("right to be forgotten").
• —Restriction & objection — limit or object to certain processing, including our legitimate-interests uses.
• —Portability — receive your data in a portable, machine-readable format.
• —Withdraw consent — unsubscribe from emails via any footer link, or withdraw analytics consent via "Cookie preferences", at any time and without affecting prior processing.

EU/EEA users may lodge a complaint with their local data protection authority; UK users with the Information Commissioner’s Office (ICO). California residents have the rights to know, delete, and correct their personal information and to opt out of its sale or sharing — we do not sell or share personal information, and honour Global Privacy Control signals for the limited analytics choice above.

Data Security

All connections are encrypted in transit via TLS, and data is encrypted at rest by our infrastructure providers. Per-user records are isolated with database row-level security, access is limited on a least-privilege basis, and we do not store card details. No system is perfectly secure, but we work to protect your data and to notify you and the relevant authorities of any breach as required by law.

Children's Privacy

SPEQ is a professional resource for GxP practitioners and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

Changes to This Policy

We may update this policy as our services or the law evolve. When we do, we revise the "last updated" date above, and for material changes we notify registered users by email. Continued use of SPEQ after an update means you accept the revised policy.

Contact

For any privacy request or question, email isaiah@speqgx.com. SPEQ is the controller of the data described here and is operated from the United States.