Privacy Policy

Last updated: 24 March 2026

This Privacy Policy explains how MR Analytics Hub ("we", "us", "our") collects, uses, stores, and protects your information when you use DashLabs at dashlabs.mranalyticshub.com and mranalyticshub.com.

MR Analytics Hub is operated by MR ANALYTICS HUB LIMITED. We are the data controller for your personal data.

We are committed to protecting your privacy and handling your data transparently and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information we collect

Account information: When you create an account, we collect your email address and password (stored in encrypted form). If you subscribe to a paid plan, payment information is collected and processed directly by Stripe — we do not store your credit card details.

Data you upload: You may upload CSV data files to generate dashboards. This data is stored on our infrastructure to provide the service. We process your uploaded data solely to generate dashboards, run AI analysis, and provide the features you request.

Usage data: We automatically collect information about how you use the service, including: pages visited, features used, dashboard creation activity, AI assistant queries (question text only, for service improvement), error logs, and session timestamps.

Technical data: We collect your IP address, browser type and version, device type, and operating system. This is used for security, analytics, and service improvement.

Cookies: We use essential cookies for authentication (session management and login state). We do not use advertising or third-party tracking cookies. The authentication cookie (mr_auth_token) is strictly necessary for the service to function and does not require consent.

2. Legal basis for processing

We process your data under the following legal bases (UK GDPR Article 6):

3. How we use your data

We use the information we collect to:

• Provide, maintain, and improve the DashLabs service.
• Process your uploaded data to generate dashboards and AI-powered insights.
• Process payments and manage your subscription.
• Send essential service communications (account verification, subscription changes, security alerts).
• Monitor usage to enforce subscription limits and prevent abuse.
• Diagnose technical issues and improve service reliability.

We do not use your data for advertising, profiling, or automated decision-making that produces legal effects.

4. AI processing

DashLabs uses third-party AI models (provided by Anthropic and OpenAI) to analyse your data and generate dashboards and insights. When you use the AI assistant or generate a dashboard:

• A summary of your data schema (column names and types) and sample data is sent to the AI provider to generate analysis.
• AI assistant queries include your question text and relevant data context.
• AI providers process this data under their own data processing agreements and do not retain your data for training purposes.
• We do not send your complete raw datasets to AI providers — only the minimum context needed for the specific request.

5. Data storage and security

Your data is stored on Google Cloud Platform (GCP) infrastructure in the europe-west2 (London, UK) region. We implement the following security measures:

• Encryption in transit using TLS 1.2+ for all connections.
• Encryption at rest for all stored data (Google-managed encryption keys).
• Authentication via JSON Web Tokens (JWT) with secure, HTTP-only cookies.
• Data isolation — each user's data is stored separately and access-controlled by user ID.
• Regular security reviews of our infrastructure and code.

While we take reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Data sharing

We do not sell, rent, or trade your personal data. We share data only with the following third parties, solely to provide the service:

Note: AI providers (Anthropic and OpenAI) are US-based. Data transfers to the US are covered by appropriate safeguards including Standard Contractual Clauses (SCCs) and the providers' data processing agreements. Only minimal data context is transmitted — not your complete datasets.

We may also disclose data if required by law, regulation, or legal process, or to protect the rights, safety, or property of MR Analytics Hub or others.

7. Data retention

• Active account: Your data is retained for as long as your account is active and your subscription is current.
• After cancellation: Dashboards are retained in read-only state for 30 days. After 30 days, data may be archived. After 90 days, data is permanently deleted.
• After trial expiry: Trial data is retained for 30 days, then permanently deleted.
• Account deletion: Upon request, we will delete all your personal data and uploaded files within 30 days. Some data may persist in encrypted backups for up to an additional 30 days.
• Usage and technical logs: Retained for up to 12 months for service improvement, then deleted.

8. Your rights (UK GDPR)

Under the UK GDPR, you have the following rights:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate personal data.
• Right to erasure — Request deletion of your personal data ("right to be forgotten").
• Right to restrict processing — Request that we limit how we use your data.
• Right to data portability — Receive your data in a structured, machine-readable format.
• Right to object — Object to processing based on legitimate interest.
• Right to withdraw consent — Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at support@mranalyticshub.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.

9. Children's privacy

DashLabs is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will take steps to delete it.

10. International data transfers

Your uploaded data is stored in the UK (Google Cloud europe-west2). However, limited data is transferred to the US for AI processing (see section 6). These transfers are protected by Standard Contractual Clauses and the data processing agreements of our AI providers. We only transfer the minimum data necessary for each AI request.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on our website at least 14 days before they take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact us

For privacy-related enquiries, data subject requests, or complaints:

• Email: support@mranalyticshub.com
• Website: mranalyticshub.com/contact-us

For complaints about data protection, you may also contact the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113