squid Privacy Notice
What we hold about you as a user of squid, our client system.
Last updated: 20 September 2026
In short. squid is our client system. This notice covers what we hold about you as a person who signs in to it — your account, how you signed in, and which pages you looked at. It does not cover the data on your own website; that is covered by the data processing agreement between us and the company you work for.
1. Who is responsible
eplatforms ltd, company number 03954521, registered office 9 Donnington Park, 85 Birdham Road, Chichester, West Sussex, PO20 7AJ, United Kingdom.
For your squid account we are the controller: we decide what the account holds and why. This is different from our role for the data on your website, where we act as a processor on your company’s instructions. The two are separate, and this notice is only about the first.
Questions about this notice: privacy@eplatforms.com or +44 (0)303 666 5485.
2. What we hold
| What | Why |
|---|---|
| Your name, job title and work email address | To identify your account and address you properly. These come from the contact record your company gave us. |
| A password, stored only as a one-way hash | To let you sign in. We cannot read it, and we cannot tell you what it is. |
| Your two-step sign-in key | Required on every squid account. It is encrypted before it is stored. |
| Sign-in records: date, time, IP address, and failed attempts | To protect the account from someone else trying to get in, and to lock it briefly after repeated failures. |
| A record of which sections you open | So we can answer who looked at a company’s invoices and when, if that is ever asked. It records the section, not what you read. |
| Anything you type into the improvement panel | To act on the request and keep a record of what was asked for. |
We do not use any of this for marketing, we do not sell it, and we do not use it to train general-purpose AI models.
3. Why we are allowed to hold it
Our lawful basis is legitimate interests: running a secure account system for the companies we work for, and being able to show who did what in it. We have considered your interests as well as ours, and concluded that this is what someone would reasonably expect of a business system they have been given an account on.
You are not personally a party to the contract between us and your employer, so we do not rely on “performance of a contract” for your personal data.
4. Who else sees it
Nobody outside eplatforms, except the suppliers that run the systems it sits on: our hosting provider, our database provider and our email provider. They act on our instructions and may not use it for anything else. We do not share it with other clients, and one company’s account can never see another’s information.
Everything is stored in the United Kingdom.
5. How long we keep it
| What | Kept for |
|---|---|
| Your account, while it is in use | Until it is closed, or your company tells us you have left |
| Sign-in sessions | 12 hours, then discarded |
| Sign-in and page-view records | 12 months |
| Improvement requests | Kept with the rest of the account records for your company, as a record of what was asked for and agreed |
When an account is closed the sign-in details are deleted. The record that it existed, and the improvement requests raised through it, are kept as part of our records for your company.
6. Your rights
You can ask us for a copy of what we hold about you, to correct it if it is wrong, to delete it, or to object to us holding it. Because our basis is legitimate interests you have a particular right to object, and we will stop unless we can show a good reason not to.
Write to privacy@eplatforms.com. If you are not happy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk.
One thing worth saying plainly: asking us to delete your squid account does not delete anything on your company’s website. That is your company’s data, not yours, and only they can ask for it.
7. Cookies and measurement
squid sets two cookies, both strictly necessary, both listed in our cookie policy.
There is no Google Analytics in squid, and no tracking or advertising of any kind. That applies to the sign-in page, every page behind it, and this notice and the terms of use. We do keep our own record of which sections of squid you open, described in section 2 — that is ours, it stays with us, and it is not shared with Google or anyone else.
The public page describing squid at eplatforms.com/squid is part of our ordinary website and does use Google Analytics, with consent, like the rest of it. You will not have signed in at that point.