Last updated: 5th August 2026
Registered name: Stitchwork Labs Ltd
Stitchwork Labs Ltd is the controller of the personal information we use for our own purposes. When we process research data you upload on your behalf, we normally act as a processor instead.
This notice explains what personal information we collect and use, why we use it, who we share it with, how long we keep it, and your rights under data protection law.
- Contact details
- What information we collect, use and why
- Lawful bases and data protection rights
- Where we get personal information from
- How long we keep information
- Who we share information with
- Sharing information outside the UK
- How to complain
Contact details
Email: hello@stitchwork.ing
What information we collect, use and why
We may collect and use the following types of personal information:
- Contact information, such as your name and email address
- Account information, such as registration details, account settings and security information
- Subscription and transaction information, such as your subscription, purchase and payment history
- Usage information, such as IP addresses and information about how you use our website and app
- Communication records, such as emails, support requests and records of meetings
- Marketing information, such as your communication preferences and records of consent
We use this information to:
- Provide the Stitchwork service, using contact, account, subscription, usage and communication information
- Understand and improve our website and service, using usage information
- Manage user accounts, using contact, account, subscription and marketing information
- Send service updates and marketing, using contact, marketing, subscription and usage information
- Comply with legal requirements, using contact, transaction and other information where required by law
- Deal with enquiries, complaints or claims, using contact, account, subscription, transaction and communication information
Where we need personal information to create or manage your account or provide the Stitchwork service, you need to provide that information for us to provide the service to you.
Research data you upload
You may upload research material to Stitchwork that contains personal information about research participants or other people. For this information, you normally decide why and how it is processed, and Stitchwork processes it on your instructions.
We process this information to provide the Stitchwork service. Our handling of research data you upload is governed by our terms with you.
Lawful bases and data protection rights
The lawful bases below apply where Stitchwork acts as the controller of your personal information.
Under UK data protection law, we need a lawful basis for using this information. The lawful bases we rely on depend on why we are using it.
Our lawful bases
- Providing the Stitchwork service: Contract, where we need your information to provide the service you have signed up for. We also rely on legitimate interests to operate, maintain and improve Stitchwork, understand how the service is used, and keep it reliable and secure.
- Understanding and improving our website and service: Legitimate interests, to understand how our website and service are used, improve them, and monitor their performance and reliability.
- Managing user accounts: Contract, where the processing is necessary to manage your account and provide the service. We also rely on legitimate interests to keep accounts secure, prevent misuse, maintain accurate records and support users.
- Service updates and marketing: Contract where communications are necessary to provide the service. We use consent for optional marketing where required. We may also rely on legitimate interests, where permitted by law, to send relevant service updates, understand engagement with our communications, and manage communication preferences and opt-outs.
- Complying with legal requirements: Legal obligation, where we need to use personal information to comply with the law.
- Dealing with enquiries, complaints or claims: Contract where this relates to providing the service, legal obligation where we are required to act by law, and legitimate interests in responding to enquiries, resolving complaints, keeping appropriate records, and establishing, exercising or defending legal claims.
Where we rely on legitimate interests, we only use personal information where we consider the processing necessary and have balanced our interests against your rights and interests.
Your data protection rights
Depending on the circumstances and the lawful basis we rely on, you may have the right to:
- Access the personal information we hold about you
- Correct information that is inaccurate or incomplete
- Ask us to delete your personal information
- Ask us to restrict how we use your personal information
- Object to certain uses of your personal information
- Ask us to transfer information you have provided to us or another organisation
- Withdraw your consent at any time where we rely on consent
You can object to the use of your personal information for direct marketing at any time.
These rights are not always absolute and may depend on the circumstances. You can find more information about your data protection rights on the website of the Information Commissioner’s Office (ICO), the UK’s data protection regulator.
To exercise any of these rights, contact us using the details above. We will respond without undue delay and normally within one month.
Where we get personal information from
We may get personal information:
- Directly from you, for example when you create an account, contact us, join our mailing list or use Stitchwork
- From publicly available sources, such as company websites or professional profiles
- From suppliers and service providers that help us operate Stitchwork and communicate with users
How long we keep information
We keep personal information only for as long as we need it for the purposes described in this notice.
Our standard retention periods are:
- Account and subscription information: while your account is active and for up to 90 days after it is closed, unless we need to keep particular records for longer for legal, accounting or dispute purposes.
- Website, app usage and security information: for up to 12 months.
- Enquiries, support requests and other correspondence: for up to 2 years after our last interaction with you.
- Complaints, disputes and legal claims: for up to 6 years after the matter is closed, or longer where legal proceedings require it.
- Marketing information: until you unsubscribe, withdraw your consent or we no longer need the information for that purpose. We may keep a minimal record of an opt-out for as long as necessary to make sure we respect it.
- Financial and accounting records: normally for 6 years from the end of the financial year they relate to.
At the end of the relevant retention period, we delete or anonymise personal information unless we have a legal or other valid reason to keep it for longer.
Research data you upload is retained in accordance with your instructions and our terms with you.
Who we share information with
We use service providers to help us operate and provide Stitchwork. These may include providers of:
- Cloud hosting, storage and infrastructure
- AI services used to provide Stitchwork
- Email and customer communications
- Website and product analytics
- Security and technical services
Where a service provider processes research data you upload on our behalf, it acts as a subprocessor.
We may also share personal information with:
- Professional advisers, such as accountants or legal advisers
- Regulatory authorities
- Other organisations where we are legally required to do so
We only share personal information where necessary to provide Stitchwork or for the other purposes described in this notice.
Sharing information outside the UK
Some of the service providers we use may process personal information outside the UK, including in the European Economic Area (EEA) and the United States.
Research data you upload is stored on hosting infrastructure in the EU. AI processing of that data takes place within the EU.
When personal information is transferred outside the UK, we make sure that the transfer is permitted under UK data protection law. Depending on the destination and provider, this may include:
- UK adequacy regulations, where the destination has been recognised as providing an adequate level of protection
- The UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses
- Another transfer mechanism permitted under UK data protection law
Some of our service providers may use subprocessors in other countries. Where these transfers are subject to UK data protection law, appropriate safeguards must be in place.
You can contact us using the details above if you would like more information about the safeguards used for a particular transfer.
How to complain
If you have concerns about how we use your personal information, please contact us at hello@stitchwork.ing. We will investigate your complaint and respond in accordance with our obligations under data protection law.
You can also complain to the ICO if you are unhappy with how we have handled your personal information or your complaint.
You can find information about making a complaint on the ICO website.