Data protection policy
Last updated: 2026
This is an internal governance document describing how CompareHQ, as an organisation, handles personal data. If you're looking for what data we collect from you and why, see our Privacy Policy instead.
Our approach
CompareHQ collects the minimum personal data needed to run the service: account details for buyers, providers, and staff, and enquiry details a buyer chooses to send to a provider. We don't collect data we don't have a genuine use for, and we don't sell or share personal data with third parties for their own marketing purposes.
Access controls
Personal data is stored in our database (Supabase) behind row-level security policies, meaning access is restricted at the database level, not just in the application. Buyers can only access their own account data. Providers can only access their own listing and the quote requests sent to them through their account. Direct enquiries are sent to a provider by email at the time they're submitted, there isn't currently a dashboard where a provider can browse past ones. Internal staff access to enquiry and account data is limited to named team members who need it to operate the platform, and is itself gated by a separate staff-membership check.
How long we keep data
We keep account and enquiry data for as long as it's needed to provide the service, an active account's data is retained while the account exists. If you ask us to delete your account or data, we'll do so other than where we're required to keep a record for legal or accounting reasons.
Sub-processors
We rely on a small number of specialist providers to run CompareHQ, rather than building our own infrastructure for things like hosting or email delivery. See our Data processing & sub-processors page for exactly who they are and what they handle.
If something goes wrong
If we become aware of a data breach affecting your personal data, we'll assess it, take steps to contain it, and notify affected individuals and, where required, the Information Commissioner's Office (ICO), in line with UK GDPR timeframes.
Contact us
Questions about this policy, or a data protection concern? Get in touch.