Skip to main content
DRAFT — pending legal reviewThis text has not yet been approved and is not in force.

Privacy Policy

Last updated: [date]

This policy explains what personal data Hydrometric collects, why, who we share it with, how long we keep it, and the rights you have. It covers the Hydrometric website at hydrometric.io, the Hydrometric application, and the Hydrometric API and MCP interfaces.

Who we are

Hydrometric is operated by Aegaea Ltd, a company registered in England and Wales under company number [company number], whose registered office is at [registered office]. Aegaea Ltd is the controller of the personal data described in this policy. Our ICO registration number is [ICO registration number].

You can contact us about anything in this policy at community@hydrometric.io.

The data we collect

Your account

  • Email address. You sign in with your email and a one-time code; there is no password. We store your email in a normalised form (lower case, with any "+tag" part removed) so that one mailbox maps to one account.
  • Sign-in records. When you request a sign-in code we store a one-way hash of the code, when it was created and used, and the IP address and browser user agent that requested it. Failed code attempts are recorded with the email and IP address so we can limit repeated guessing.
  • Account dates. When your account was created, when your email was verified and when you last signed in.
  • Profile (optional). Your display name, job title, qualifications and organisation, if you add them in your account. These appear on reports and are copied into any sign-off you make (see "Sign-offs" below).
  • Waitlist details. If you join the waitlist we store your name, email and (optionally) your organisation.

Your choices

  • Marketing emails. Whether you agreed to receive product updates and commercial emails, and when.
  • Data sharing. Whether you opted in to sharing anonymised method choices, and when (see "Anonymised assessment metadata" below).

Your work

  • Projects, analyses and their results, catchment descriptors and any overrides you make, locations and catchment boundaries you select or edit, and files you upload (for example FEH XML or CD3 descriptor files).
  • Reports and report settings, including report branding such as logos, colours, client name, project reference and cover notes.
  • Comments, reviews, review assignments and sign-offs on analyses.
  • Teams and project sharing: the email addresses of people you invite, and who invited whom.
  • Your personally supplied NRFA Peak Flow Dataset ZIP, its filename, size, version, checksum and upload date, and your confirmation that you obtained your own licensed copy. This file is private to your account, is not shared with your team or included in community learning, and does not change the reference dataset used for calculations.

Billing

  • Your plan, subscription status, renewal date, the number of free assessments used, and Method Space credits and purchases.
  • Stripe customer and subscription identifiers. Card and payment details are collected and held by Stripe; we never see or store your full card number.

Usage and security records

  • Assessment usage. Each assessment you run is recorded with your email, the type of assessment, the station or project it relates to, whether it counted against your allowance, and the time. We use this to enforce plan limits and bill correctly.
  • API and MCP requests. Requests made with an API key are logged with the account email, the first characters of the key, the IP address, user agent, result and timing.
  • Administrator audit log. When one of our administrators accesses or changes account data, the action is logged.
  • Rate limiting. We use your IP address to limit the rate of sign-in and API requests.

Bug reports

If you use the in-app "report a bug" button, we collect what you type, the severity you choose, the address of the page you were on, the element you clicked and where, your screen size, your browser user agent, and the most recent error messages from your browser console. Screenshots are switched off. The report is filed as an issue in our private GitHub repository and a copy is kept in our database.

The Hydrometric Assistant

Where the Hydrometric Assistant is enabled for your account, we store your conversations with it (your messages and its replies), the analysis context it reads to answer you, and how many tokens each conversation used. The assistant is powered by Anthropic's Claude models, so your messages and that analysis context are sent to Anthropic to generate replies.

Anonymised assessment metadata (opt-in only)

If you opt in to data sharing on your account and tick the box on an individual assessment, then when that assessment is signed off we record a coarse summary of it: catchment descriptors as bands rather than values, the number of donors and whether QMED was donor-adjusted, the chosen distribution, where the adopted estimate sits within the range of methods, how far it moved from the recommendation, the class of reviewing organisation, the regulatory outcome, and a 10 km grid square. It never includes the site, station, client, your name or email, or your notes unless you separately choose to share a redacted note. The record is stored against the analysis so that it can be deleted with it; only the coarse summary is ever shown to other users, in aggregate.

Site performance

We use Vercel Speed Insights to measure how quickly pages load. It records page performance metrics, the page route, and general device and browser information. It does not use cookies and we do not use it to identify you.

How and why we use your data

  • To provide the service (performance of our contract with you): creating and securing your account, running and saving your analyses, producing reports, sharing work with the colleagues you choose, billing and enforcing plan limits, and answering your support requests.
  • To keep the service secure and working (our legitimate interests): rate limiting, preventing abuse of the free allowance, investigating bugs, audit logging of administrator access, and measuring site performance.
  • To send marketing emails (your consent): only if you ticked the marketing box. You can withdraw at any time by emailing us.
  • To build shared evidence on method choices (your consent): only for assessments you have explicitly opted in, as described above.
  • To meet legal obligations: keeping billing and tax records, and responding to lawful requests.

We do not sell your personal data. [Confirm: we do not use your analyses or uploaded files to train AI models.]

Who we share data with

We use the following service providers (processors), who act on our instructions:

  • Vercel Inc. hosts the website and application. Our application servers run in Vercel's London region; Vercel's global network may handle requests in other locations.
  • Neon Inc. hosts our PostgreSQL database in the AWS London region (eu-west-2).
  • Stripe processes subscription and Method Space payments.
  • Resend sends sign-in codes and other account emails.
  • GitHub Inc. hosts the private repository where bug reports are filed.
  • Anthropic PBC provides the AI model behind the Hydrometric Assistant, where it is enabled.
  • Amazon Web Services hosts our terrain and rainfall data files and the map tile service your browser loads terrain overlays from. It also stores your privately uploaded NRFA database archive in the London region (eu-west-2).
  • Railway hosts our spatial service for catchment delineation and point hydrology, which receives the map locations you select.
  • [marketing contact platform, if MARKETING_LEAD_WEBHOOK_URL is configured in production], which receives your email, marketing choice and verification date when you sign in.

Some features also connect you to independent third parties who receive your IP address, or the text you search for, as part of normal web traffic:

  • Map tiles. When you view a map, your browser loads basemap tiles directly from OpenStreetMap and Esri, and flood-map overlays from the Environment Agency.
  • Place search. When you search for a place or postcode, our server sends your search text to postcodes.io or OpenStreetMap Nominatim.
  • Google Drive export. If you choose to export a report to Google Docs, you connect your Google account and we store an encrypted token so we can create the document in your Drive.

We may also disclose personal data if required by law, to protect our rights, or as part of a sale or reorganisation of our business.

International transfers

Our database is in London. Some of our providers are based in, or access data from, the United States and other countries outside the UK. Where personal data is transferred outside the UK we rely on [transfer mechanism: UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), the ICO International Data Transfer Agreement, or the ICO Addendum to the EU Standard Contractual Clauses, as applicable to each provider].

How long we keep your data

  • Your account, profile and work are kept for as long as your account is open. If you ask us to delete your account we erase it as described under "Your rights".
  • NRFA database uploads are kept while they are your current account copy. Replaced, failed and expired uploads, and files belonging to an erased account, are queued for deletion after temporary upload permissions expire. Failed deletions remain queued for retry.
  • Sign-in code records expire after 15 minutes and are deleted automatically after 30 days, typically within a day of that period ending.
  • Assessment usage records are deleted automatically after 180 days, typically within a day of that period ending.
  • Administrator audit log entries are deleted automatically after 365 days, typically within a day of that period ending.
  • API request logs are kept for [retention period].
  • Bug reports are kept for [retention period].
  • Assistant conversations are kept for [retention period].
  • Waitlist and marketing records are kept until you ask us to remove them or [retention period].
  • Billing records are kept for [retention period required for tax and accounting purposes].
  • Signed-off analyses are kept after an account is erased (see below).
  • Database backups are overwritten after [backup retention period].

Sign-offs

A sign-off is a tamper-evident record that a named person approved an analysis. Because signed analyses may be relied on by regulators and clients, we keep signed analyses and their sign-off records even after the signer's account is erased. On erasure we replace the signer's email address with a random pseudonym, but the organisation and the details frozen into the signed record at the time of signing (which may include your name and qualifications) are retained. [Reviewer to confirm the lawful basis and retention period for retained sign-offs.]

Your rights

Under UK data protection law you have the right to:

  • ask for a copy of your personal data;
  • ask us to correct inaccurate data;
  • ask us to delete your data;
  • ask us to restrict or stop using your data, or object to how we use it;
  • ask for the data you gave us in a portable format;
  • withdraw your consent at any time, where we rely on consent.

To exercise any of these rights, email community@hydrometric.io from the address on your account. We will respond within one month. You can change your data-sharing choice yourself at any time on your account page.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.

Cookies

We use one essential cookie to keep you signed in, and store a few interface preferences in your browser. See our Cookie Notice.

Children

Hydrometric is a professional tool and is not intended for anyone under 18.

Changes to this policy

We will post any changes on this page and update the date above. If a change materially affects how we use your data, we will tell you by email.