Privacy Policy
Product: totalia.ai Provided by: MLK Consulting Ltd, a company registered in England and Wales ICO Registration Reference: ZC206823 Data protection contact: privacy@email.totalia.ai, or in writing at MLK Consulting Ltd, 117 High Street, Chesham, HP5 1DE
Version 1.0 — effective 3 August 2026. We'll publish a new version here whenever this policy changes.
If you’re an employee of a company that uses totalia.ai, read this first
Your employer may use totalia.ai to analyse HR data — performance ratings, succession plans, organisational structure, and similar. We never see, store, or have access to any of that data about you. Not because we’ve promised not to look — because of how the product is built: when your employer’s totalia.ai user uploads a file, it’s read and analysed entirely inside their own web browser. The actual rows of data — including anything about you individually — are never sent to our servers at all. Only the shape of the file (column names, and a label describing what kind of data each column holds — “a rating,” “an organisational field,” and so on) is stored, so your employer’s saved work is there next time they log in.
This means we are not the right people to contact about your own HR data — we don’t have it. Your employer is the controller of that data and any request about it (access, correction, deletion) should go to them directly.
The rest of this policy is about the other kind of personal data we do handle: our direct relationship with the people who actually use totalia.ai (your employer’s own staff who hold a login) and with visitors to totalia.ai itself.
1. Who We Are
MLK Consulting Ltd is the data controller for the personal data described in this policy. We are registered with the UK Information Commissioner’s Office, reference ZC206823.
2. What Personal Data We Collect
If you hold a totalia.ai account (you’re an employee, admin, or authorised user at a customer organisation):
- Name and email address, provided when your organisation’s administrator invites you
- Your role/permission level within your organisation’s account
- Basic technical data generated by using the service — sign-in timestamps, IP address at time of request (processed transiently by our infrastructure providers, not stored by us as a distinct record)
What we do not collect, from anyone, ever: the underlying employee/HR data your organisation uploads to analyse. See the box above — this isn’t a policy promise, it’s an architectural fact about how the product works, described precisely in our Data Processing Agreement.
If you just visit totalia.ai (not yet a customer): we don’t run analytics or embed any forms on our marketing site, so we don’t collect any personal data about you from browsing it. If that changes, we’ll update this section.
3. How We Use It
- To create and administer your account, and let your organisation’s administrators manage who has access
- To authenticate you (including multi-factor authentication, where enabled)
- To send account-related emails — invitations, password resets — via our email sub-processor
- To maintain the security of the platform, including detecting and preventing misuse
- To communicate with you about the service (e.g. maintenance, material changes to this policy)
We do not use your account data for advertising, and we do not sell it to anyone.
4. Our Legal Basis for Processing
- Performance of a contract — administering your account and providing the service is necessary to deliver what your organisation has subscribed to.
- Legitimate interests — maintaining security, preventing fraud or misuse, and improving the service, balanced against your right to privacy.
- Legal obligation — where we’re required to retain or disclose information by law (e.g. tax and accounting records).
We do not rely on consent as a legal basis for the core service, since account data processing is necessary to provide it.
5. Who We Share It With
We share account data only with the sub-processors necessary to operate the platform:
| Sub-processor | Role | Location |
|---|---|---|
| Supabase | Database hosting, authentication | eu-west-1 (Ireland) |
| Cloudflare Pages | Application hosting | LHR (London, UK) |
| Resend | Transactional email | eu-west-1 (Ireland) |
We do not share account data with any other third party, and we do not sell it.
6. International Transfers
We don’t make any. Every sub-processor we use operates within the UK or the European Economic Area.
7. How Long We Keep It
While your account is active, we retain your account data for as long as your organisation’s administrator keeps you as a user.
When your account is removed — whether you leave your organisation, your administrator removes you, or your organisation’s subscription ends — access is removed immediately and your account data is deleted from our live systems within 72 hours.
We may retain minimal records beyond this — for example invoicing records, or records relevant to a security incident, fraud investigation, or dispute — for as long as required by law, even after the deletion described above.
8. Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Request erasure of your data
- Restrict or object to certain processing
- Data portability, where technically applicable
- Complain to the ICO if you believe we’ve mishandled your data — ico.org.uk
To exercise any of these rights, contact us at privacy@email.totalia.ai, or in writing at MLK Consulting Ltd, 117 High Street, Chesham, HP5 1DE.
9. Cookies and Local Storage
totalia.ai does not use tracking or advertising cookies. The application stores two small pieces of information in your browser’s local storage, neither of which is personal data: your light/dark theme preference, and a flag recording which version of our in-app changelog you’ve last seen. Neither is transmitted to us or to any third party.
10. Security
We maintain technical and organisational measures appropriate to the data we actually hold — access controls enforced at the database level, role-based permissions, and optional multi-factor authentication.
11. Children’s Data
totalia.ai is a business product intended for use by working adults at customer organisations. It is not directed at, and we do not knowingly collect data from, children.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via an in-app changelog entry, and by email as well where the change is significant enough to warrant direct notice.
13. Contact and Complaints
For any question about this policy or how we handle your data, contact us at privacy@email.totalia.ai, or in writing at MLK Consulting Ltd, 117 High Street, Chesham, HP5 1DE. If you’re unhappy with our response, you have the right to complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113.
Governing Law
This policy is governed by the laws of England and Wales.