Privacy Policy

Solitu is operated by Reaching Futurity Ltd (“we”, “us”, “our”), a company registered in England and Wales (company number 11805801). Our registered office is 1 Doolittle Yard, Froghall Road, Ampthill, Bedfordshire, MK45 2NW. We are registered with the UK Information Commissioner's Office as a data controller for personal data processed through this service.

Contact us about privacy matters at: privacy@reachingfuturity.com

We do not collect special-category personal data (health, biometric, political opinions, etc.) and do not knowingly process such data on your behalf. Do not enter special-category data into timesheet descriptions or feedback.

When you add clients, projects, or features to Solitu, or connect Gmail to receive filename suggestions, our records may include personal data about people who are not Solitu users — typically your business clients and their contacts. Under UK GDPR:

• You are the data controller for that information. You decide what to store, why, and for how long.
• Solitu (Reaching Futurity Ltd) acts as your processor for that subset of data. We only process it on your written instructions, namely the instructions implicit in how you use the service.
• You are responsible for having a lawful basis to share that data with us, and for telling your clients (in your own privacy notice) that you use Solitu to manage your work for them.

If one of your clients exercises a data-subject right against you (e.g. asks you to delete their data), you can resolve that through your normal Solitu deletion controls; contact us at privacy@reachingfuturity.com if you need our assistance.

We share data with the following processors, each bound by a Data Processing Agreement and selected for their security posture. Where processing occurs outside the UK/EEA, transfers are covered by Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA).

Integrations you enable yourself (Xero, Google Workspace) are not Solitu sub-processors. When you connect them, you are the controller for the data they hold and Solitu acts as a conduit. Their respective privacy policies apply.

We retain personal data for as long as your account is active and then according to the following schedule. The dates below are enforced by automated daily clean-up routines.

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you. Available self-serve via Settings → Export.
• Rectification — correct inaccurate data. Most fields are editable in Settings.
• Erasure — request deletion of your data (“right to be forgotten”). Available self-serve via Settings → Delete my account. All your data is deleted, including invoices you raised through Solitu.
  Tax records remain your responsibility. If you have used Solitu to invoice clients, HMRC requires you (as the trader) to keep your own financial records for at least 6 years. Export your data before deletion — Settings → Export gives you JSON and CSV copies you can store yourself.
• Restriction — ask us to limit how we use your data while a query is resolved.
• Portability — receive your data in a structured, machine-readable format. Available self-serve via Settings → Export (JSON and CSV formats).
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw analytics consent at any time via the cookie banner or Settings → Privacy. Withdrawal does not affect the lawfulness of prior processing.

To exercise any of these rights, use the self-serve options above or contact us at privacy@reachingfuturity.com. We will respond within one month of receipt and confirm what we have done.

We use strictly necessary cookies to operate the service (authentication session tokens), which do not require consent under the Privacy and Electronic Communications Regulations (PECR). We use analytics cookies (PostHog) only with your consent, requested via the cookie banner the first time you visit. See our Cookie Policy for full details and to change your preferences at any time.

We apply appropriate technical and organisational measures to protect your data:

• TLS 1.2+ for all data in transit between your browser and our servers.
• Application-level AES-256-GCM encryption of OAuth tokens at rest (over and above Supabase's storage-level encryption).
• Row-Level Security enforced at the database layer, isolating each organisation's data from every other.
• Per-IP and per-user rate limiting on API endpoints to deter abuse.
• Three-layer access control on administrative interfaces (host isolation + allow-list + database RLS).
• Automatic daily clean-up of expired soft-deleted records (see section 5).

No method of transmission over the internet is 100% secure; we cannot guarantee absolute security. We will notify you and the ICO of any personal-data breach likely to result in a risk to your rights, within 72 hours of becoming aware of it.

Solitu is a business tool intended for use by adults. We do not knowingly collect data from anyone under the age of 18.

We may update this policy from time to time. Material changes will be communicated by email or by a notice within the application at least 30 days before taking effect. Continued use after that date constitutes acceptance.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK supervisory authority. We would welcome the chance to address your concern first, so we encourage you to contact us before going to the ICO.

Information Commissioner's Office (ICO)
ico.org.uk · 0303 123 1113