Obligary Privacy Policy

For the purposes of this policy, "Obligary", "we", "us" and "our" means Web Wonderland Ltd, a company registered in England and Wales under company number 13647284, with its registered office at 20 St. Johns Avenue, Chelmsford, England, CM2 0UB.

You can contact us about this policy or your personal data by emailing hello@obligary.co.uk.

Obligary provides a software-as-a-service platform that helps organisations manage compliance calendars, evidence, documents, ISO management-system records, reminders, tasks, approvals and related reporting.

Obligary is available through our website and, where installed, through the Obligary mobile app. The mobile app is a companion app for authenticated users to view assigned work, capture or upload evidence, receive notifications and work with selected cached workspace information when a connection is temporarily unavailable.

When we process personal data for our own business purposes, such as account administration, billing, support, sales and website operation, we act as a controller.

When our customers upload, store or manage personal data within their own Obligary workspace, we normally act as a processor on behalf of that customer. In that situation, the customer decides what personal data is uploaded, why it is used, how long it is kept and who can access it.

Account and user data

This may include:

• name
• business email address
• organisation name
• job title or role
• account login details managed through our authentication provider
• workspace membership and permissions
• usage and access records
• communication preferences

Customer workspace data

Customers may upload or create information inside Obligary, including:

• compliance tasks
• evidence files
• photos, screenshots, document scans and uploaded files used as evidence
• controlled documents
• policies and procedures
• audit records
• ISO management-system registers
• training records
• supplier records
• access review records
• health and safety records
• environmental records
• notes, comments and approvals
• evidence requests sent to internal users or external recipients

This data may include personal data depending on what the customer chooses to upload or enter.

Company lookup data

Where a user searches for or selects a UK company record, Obligary may process the search term, company number and public Companies House information used to populate workspace fields such as company name, company number, incorporation date, registered office, accounts dates and confirmation statement dates.

Billing data

Payments and subscriptions are processed through Stripe. We may receive limited billing information such as:

• customer name
• billing email
• billing address
• subscription plan
• payment status
• invoice and transaction references

We do not store full payment card details on our systems.

Support and communication data

If you contact us, we may process:

• your name
• email address
• organisation
• message content
• support queries
• attachments you provide
• records of our response

Demo and meeting-request data

If you request a product demo or portfolio review, we may process:

• your name and work email address
• organisation name and optional role
• the UK-time meeting slot you request
• the optional information you provide about what you would like to discuss
• notification-delivery status and records of our response
• where analytics consent has been given, approved first-touch and last-touch campaign source information

A meeting request is used to arrange the requested conversation and is not treated as consent to receive unrelated marketing.

Website and technical data

When you use our website or platform, we may collect technical information such as:

• IP address
• browser and device information
• pages visited
• timestamps
• log data
• cookie preferences
• security and diagnostic information
• where you consent to analytics, session and interaction events, approximate location and Google Analytics browser identifiers
• where you consent, approved campaign parameters, landing path and referring domain used for first-touch and last-touch attribution

With your consent, Obligary uses Google Analytics 4 to understand website visits and product interactions and may retain first-touch and last-touch campaign or referral information. We configure analytics without Google advertising signals or personalisation and do not intentionally send names, email addresses, workspace names, uploaded evidence or other direct identifiers. Query strings are excluded from analytics paths. We do not use advertising cookies, remarketing tools or session-recording tools.

Mobile app, device and notification data

When you use the Obligary mobile app, we may process:

• your Obligary account and workspace membership details
• task, evidence and notification information retrieved from your workspace
• files, photos and document scans that you choose to upload as evidence
• camera or file-picker access only when you choose to capture, scan or upload evidence
• Expo push notification tokens, device platform, device name, app version and related notification delivery metadata
• notification interactions, such as whether an in-app or push notification has been opened
• selected workspace data stored locally on your device to support offline viewing and queued uploads or task updates
• technical information needed to keep the app secure and reliable, such as IP address, API logs, error information and security events

The mobile app does not use advertising SDKs or collect advertising identifiers for behavioural advertising.

We use personal data to:

• provide and operate the Obligary platform
• create and manage user accounts
• authenticate users
• manage organisations, workspaces and permissions
• store evidence, documents and compliance records
• send transactional emails, reminders and notifications
• send mobile push notifications for task reminders, evidence-related alerts and service messages where enabled
• support mobile evidence capture, document scanning, file uploads, offline cache and queued sync
• process subscriptions and billing
• provide customer support
• store, arrange and respond to requested product demonstrations and portfolio reviews
• analyse consented website and product usage and improve the platform
• monitor security, performance and reliability
• prevent fraud, abuse or unauthorised access
• comply with legal, accounting and regulatory obligations
• send product updates or marketing communications where permitted

Depending on the circumstances, we rely on one or more of the following lawful bases:

• Contract: where processing is necessary to provide the platform or manage your subscription.
• Legitimate interests: where we process data to operate, secure, improve and promote our business in a way that does not override individual rights.
• Legal obligation: where we need to keep records or comply with applicable law.
• Consent: where we ask for consent, such as for certain cookies or optional marketing communications.

Where we process customer workspace data as a processor, we process it on the customer's documented instructions.

Customers are responsible for deciding what personal data they upload into Obligary and for ensuring they have a lawful basis to do so.

Customers should avoid uploading unnecessary sensitive personal data unless it is required for their compliance, evidence or management-system purposes.

Where customer workspace data includes personal data relating to employees, suppliers, clients or other individuals, the customer is responsible for providing appropriate privacy information to those individuals.

This responsibility also applies to photos, scans, documents and other evidence captured through the mobile app.

We use trusted service providers to operate Obligary. These may include providers of:

• hosting and application infrastructure
• database hosting
• authentication
• cloud storage
• email delivery
• payment processing
• diagnostics and operational logging
• consent-based website and product analytics
• customer support tools
• professional advisers

Our current core providers include Vercel, Neon, Clerk, Resend, Cloudflare, Stripe, Amazon S3 or S3-compatible storage providers, Expo, Apple Push Notification service, Google Firebase Cloud Messaging and, where analytics consent is given, Google Analytics 4. We also use the public Companies House API to support company lookup and workspace setup.

For mobile app functionality, Expo, Apple Push Notification service and Google Firebase Cloud Messaging help us issue and deliver push notifications. Clerk supports authentication, including email/password, Google sign-in and Sign in with Apple where enabled.

We may also share personal data where required by law, to protect our rights, to investigate misuse of the platform, or in connection with a business sale, merger or restructuring.

You can read the current provider list on the subprocessors page.

For Google Play disclosure purposes, the Obligary mobile app may collect and transmit the following categories of user data when needed to provide the service:

• Personal information: name, email address and workspace role.
• User identifiers: Obligary and authentication-provider account identifiers.
• Files, photos and documents: evidence files, document scans, screenshots or photos that users choose to upload.
• App activity: task updates, evidence uploads, notification opens, workspace actions and audit records.
• Device or other identifiers: push notification tokens, device platform, app version and related delivery identifiers.
• Diagnostics and security data: logs and technical data used to monitor reliability, prevent abuse and investigate errors.

We use this data for app functionality, account management, security, compliance recordkeeping, customer support, service communications and platform improvement. We do not use mobile app data for third-party advertising.

User data transmitted between the mobile app and Obligary is sent over encrypted connections. You can initiate account deletion directly from the mobile app under Profile, or request deletion of your account or personal data using the account and data deletion page. If the request relates to a customer workspace, we may need to coordinate with the relevant customer because they may be the controller of that workspace data.

You can disable push notifications through your device settings. Disabling push notifications does not remove in-app alerts, account records or workspace records that are needed to provide the service.

Some of our service providers may process personal data outside the United Kingdom or the European Economic Area.

Where required, we use appropriate safeguards, such as adequacy regulations, approved contractual terms, the UK International Data Transfer Agreement, the UK Addendum to EU standard contractual clauses, or equivalent protections.

We keep personal data only for as long as needed for the purposes described in this policy.

Typical retention periods are:

• account data: for the life of the account and a reasonable period afterwards
• billing records: for the period required for tax and accounting purposes
• support records: for as long as needed to handle the request and maintain service records
• marketing data: until you unsubscribe or object
• platform logs: for a limited period needed for security, diagnostics and audit purposes
• Google Analytics data: according to the retention settings applied to our GA4 property; analytics browser cookies may remain for up to two years unless consent is withdrawn or they are deleted sooner
• browser attribution cookie: up to 90 days; when attribution is linked to a workspace it is retained with that workspace for aggregate conversion reporting and deleted with it
• demo and meeting requests: up to 12 months, unless they need to be retained for an active customer relationship or legal requirement
• mobile push tokens: while the device remains registered, unless disabled, replaced, deleted or no longer valid
• customer workspace data: for the duration of the customer subscription, unless deleted earlier by the customer or retained under agreed backup, legal or contractual requirements

Customers can request deletion or export of workspace data in accordance with their subscription terms.

The mobile app may store selected workspace data locally on the device for offline use. Signing out is intended to clear local app cache where technically possible. Users can also clear app data through their device settings.

We use technical and organisational measures designed to protect personal data, including access controls, authentication, role-based permissions, secure hosting, encrypted connections, restricted file access, audit logging, operational logging and security monitoring.

In the mobile app, authentication tokens are stored using secure mobile storage where available, and evidence uploads are linked to authenticated workspace permissions. Push notification tokens are used to deliver service notifications and are disabled when we learn that a device token is no longer valid.

No online service can be guaranteed to be completely secure. Customers are responsible for managing user access, passwords, permissions and the content they upload to the platform.

Depending on your circumstances, you may have rights to:

• access your personal data
• correct inaccurate personal data
• request deletion of personal data
• restrict how personal data is used
• object to certain processing
• request portability of your personal data
• withdraw consent where processing is based on consent
• complain to a data protection regulator

To exercise your rights, contact us at hello@obligary.co.uk. You can also use the account and data deletion page.

If your request relates to personal data held inside a customer workspace, we may need to refer your request to the relevant customer, because they may be the controller of that data.

We may send product updates, onboarding information and marketing communications to business contacts where permitted.

You can opt out of marketing emails at any time by using the unsubscribe link or contacting us. We may still send essential service messages, such as account, billing, security, task reminder, evidence reminder, compliance reminder or platform service notifications.

Mobile push notifications are used for service-related alerts, not third-party advertising. You can disable push notifications in your device settings.

We use essential cookies and similar technologies on our website and platform. Google Analytics is optional and is only enabled after you give analytics consent. You can change your choice at any time through the Cookie preferences control in the site footer or on the Cookie Policy page. For more information, please read our Cookie Policy.

We may update this Privacy Policy from time to time. The latest version will be published on our website with the updated date.

Material changes may also be notified by email or in-app notice where appropriate.

If you have questions about this Privacy Policy or how we use personal data, contact:

Web Wonderland Ltd trading as Obligary
20 St. Johns Avenue
Chelmsford
England
CM2 0UB

Email: hello@obligary.co.uk