Privacy notice
This notice covers portal.fractionalteams.com only, the client report portal. For the main website and Fractional Teams’ services generally, see fractionalteams.com.
Who is responsible
The data controller is Next Generation ICT Ltd, trading as Fractional Teams, 86-90 Paul Street, London EC2A 4NE, United Kingdom. Data protection contact: dpo@fractionalteams.com.
What we process, and why
| Data | Why | Basis |
|---|---|---|
| Your name, work email address, password (stored only as a salted hash), and optional two-factor secret (stored encrypted) and backup codes (hashed) | To give you a login and keep your account secure | Contract with your organisation; legitimate interest in security |
| Session cookie (signed, HTTP-only) and CSRF token | To keep you signed in and protect forms; strictly necessary, no consent banner needed | Legitimate interest |
| API keys you create (stored only as a hash, with a short prefix and last-used time) | To authenticate your software and let you see which keys are in use | Contract |
| Report content and lead data supplied by or gathered for your organisation, including the names, LinkedIn profiles and message summaries of people your organisation has contacted through its outreach campaigns | To deliver the audit and outreach reporting your organisation has engaged us for | Contract with your organisation (your organisation is the controller of its outreach data; we process it on its instructions) |
| Lead-status changes (who marked which lead, when) | Audit trail shown to your organisation’s users and to the Fractional Teams team, who are notified of each change | Contract |
| Chat messages you send from a report, and the resulting transcript | To answer your question; the team reads chats in its internal Slack workspace, an unanswered chat is emailed to the support inbox and continued by email, and the transcript stays in the portal so you can reopen it | Contract |
| Server and error logs (IP address, requested path, time) and in-memory rate-limit counters | Security monitoring, rate limiting and fault finding | Legitimate interest |
| Analytics on the public pages only (the landing, about, contact, pricing and privacy pages, the sign-in and forgot-password pages, the demo and the documentation) and only for visitors who are not signed in, if enabled: Google Analytics 4 with IP anonymisation and advertising signals off, and Ahrefs Web Analytics | To see how the public pages are used. Never on signed-in pages, reports, or pages carrying a one-time link | Legitimate interest |
Emails we send
Account emails only: invitations, password resets, two-factor changes, “a new report is ready”, and chat transcripts or missed-reply notices. Lead-status changes you make are notified to the Fractional Teams team, not emailed to you. No marketing email is sent from the portal.
Who else sees it
- The other users on your organisation’s account, and the Fractional Teams team, who can view your organisation’s reports, users and lead statuses.
- Processors we use to run the service. Each processes data on our instructions under a contract; those outside the UK are listed with their location in our data processing agreement.
- Vultr hosts the server in London and holds an off-site copy of the database in Amsterdam. That copy is encrypted before it leaves the server and only we hold the key.
- SMTP2GO sends the account emails above, from its EU sending region.
- Slack carries the Fractional Teams side of the in-report chat and the team’s notifications of lead-status changes.
- Google Workspace holds our email correspondence with your organisation and the working files behind each monthly report, in Google Drive.
- Anthropic provides the AI model that helps draft the narrative of monthly reports from your organisation’s figures and outreach records. Each request carries one client’s data only. Anthropic keeps that data for 30 days for safety monitoring and does not use it to train its models.
- Google Analytics 4 and Ahrefs Web Analytics, on the public pages only, as described above.
- Better Stack monitors uptime. It receives availability signals only, never personal data.
- Nobody else. Data is never sold, and one client’s data is never visible to another client.
How long we keep it
- Account data: for the life of your organisation’s engagement, then deleted on request or within 12 months of the engagement ending.
- Reports and lead history: kept as your organisation’s record while it is a client; deleted with the account.
- Chat transcripts: kept in the portal (so a conversation can be reopened) and with the support email thread; deleted with the account.
- Server logs: rolling, typically under 90 days. Database backups: rolling, deleted on the same cycle.
- Data sent to Anthropic for report drafting: deleted by Anthropic after 30 days.
- Demo workspace data: fictional, reset nightly.
Your rights
You can ask for access to, correction of, or deletion of your personal data, object to processing based on legitimate interest, and ask for a copy in a portable format. Email dpo@fractionalteams.com; we answer within one month. If you are unhappy with our response you can complain to the UK Information Commissioner’s Office (ico.org.uk). If your organisation is the controller of the data in question (for example outreach lead data), we will pass your request to them.
Security
All traffic is encrypted in transit. Passwords are hashed, two-factor secrets are encrypted at rest, API keys are stored hashed and shown once. Access to a client’s data is scoped per user and enforced on every request, on the web, the API and the MCP server alike. The service is reviewed for security before each significant change.
Changes
This notice was last updated on 2026-10-15. Material changes are announced to signed-in users.