Legal
Privacy notice
What Murgese Ltd does with personal data collected through this website, and what you can ask us to do about it.
Last updated 4 October 2026. What changed: the short version now points to the Murgese Construction site app's own privacy notice, and section 3 now says what happens if you turn on the software's optional AI features with your own account.
The short version
This notice is about the website. It is not about the software. Murgese runs on your own machine and keeps your records there, so we do not hold the books you keep in it.
The Murgese Construction site app has its own privacy notice: murgese.co.uk/privacy/site-app.
To report a security weakness or a suspected breach, write to security@murgese.co.uk. Everything else in this notice is at privacy@murgese.co.uk.
1. Who is responsible
Murgese Ltd, company number 13464940, is the controller of the personal data described here. We are registered with the Information Commissioner's Office under registration ZC230438.
Write to privacy@murgese.co.uk about anything in this notice. That address is kept separate from support because these requests carry a statutory one-month deadline.
2. What we collect, and why
| What | When | Why we are allowed to |
|---|---|---|
| Your name, email, telephone, company or firm name, and what you wrote | When you send an enquiry, a partner application or a download request | Our legitimate interest in answering people who contact us, and taking steps at your request before entering into a contract |
| Your IP address, the time of the request, and what your browser says it is | Every time a form is submitted, and in the web server's logs | Our legitimate interest in keeping the site working and stopping abuse of the forms |
| The download link issued to you, when it was used, how many times, and the address it was used from | When we send you the software after a request | Our legitimate interest in knowing that a link we issued to one person is not being passed around, and in being able to withdraw one |
| If your firm joins the partner programme: the name, role and email address of the person who accepts the partner agreement, the date and time they accepted it, the IP address they accepted from, what their browser says it is, and a fingerprint of the exact documents they accepted | When somebody at your firm opens the agreement link we send and accepts or declines it | Performance of a contract, and our legal obligation to keep proper records of the contracts we enter into |
| If you apply for the pilot programme: your name, email address, firm or company, the kind of business you are, which product you want to test, roughly how many people you are, what you use now, how much time you can give it and what you wrote. While you take part, our notes of what you report and how the pilot is going | When you apply at /pilot, and during the pilot | Taking steps at your request before entering into a contract (the pilot licence), and our legitimate interest in running the pilot and improving the software from what testers tell us |
| A session cookie | When you use a form or sign in to the site's admin area | Strictly necessary for the site to work, so no consent is required |
We do not run advertising, we do not profile visitors, and we do not use analytics or tracking cookies on this site.
When you follow a link from one of our posts on X, the address carries the number of that post, and we count the visit against it. What is stored is a number per post per day. There is no cookie, and nothing about you or your device is recorded. If you then apply for the pilot, your application notes which post you came from.
3. What we do not collect
We do not receive your accounting records. The software stores them in a database on your own machine and runs its own local server process. Nothing is hosted by us, and a client's data does not leave your premises unless you export it, or turn on the software's optional AI features with your own account with an AI provider, in which case what is read or asked about goes to that provider under your own arrangement with it, and not to us.
Where a bank feed is used, it connects through an open banking provider under a separate arrangement. What that connection can reach today is described on the status page.
4. Who else sees it
Our website hosting provider processes data on our behalf in order to run this site. Our email provider does the same for messages sent to and from us. Where you buy a licence, payment is collected by GoCardless, who are the controller of the payment details you give them.
We post on X as @MurgeseUK. If you follow, reply to or message that account, X holds that under its own privacy policy, and what you do there is visible to X and, where public, to anyone. This website publishes our posts to X and reads back the public figures for our own posts, such as how many times each was seen. It does not collect anything about you from X.
The first drafts of our posts on X are written with the help of an AI service, Anthropic, from a description of our products. No personal data is sent to it: not enquiries, not applications, not anything about the people who visit this site.
We do not sell personal data and we do not pass it to anyone for their own marketing.
5. Where it is held
This website and its database are hosted in the United Kingdom. If that ever changes, or if a supplier processes data outside the UK, we will say so here and put appropriate safeguards in place.
6. Security, and how to tell us about a problem
Write to security@murgese.co.uk if you find a weakness in this website or in the software, or if you have any reason to think personal data has been exposed. Do not wait until you are certain. A suspicion reported early is worth more than a confirmed report a week later, and it is a separate address from support so that it is read as what it is.
Tell us what you found and how to see it for yourself. Please do not go further into anybody's data than you need to in order to show us the problem. We will acknowledge the report, tell you what we find and tell you when it is fixed.
What a breach here would be about. The data described in this notice is enquiries, download requests, partner applications, pilot applications and the records behind a licence. It is not the books. Murgese runs on your own machine and keeps your records there, so the ledgers, the clients and the figures a firm works on are not held by us and are not ours to lose.
What we will do. Where a breach of the data described here is likely to result in a risk to people's rights and freedoms, we report it to the Information Commissioner's Office within 72 hours of becoming aware of it. Where it is likely to result in a high risk to somebody, we tell them as well, without undue delay, in plain language, and we say what we know rather than waiting for the picture to be complete.
If it is your own installation. Where a firm's own copy of the software is compromised, that firm is the controller of the records in it and the duty to assess and report it is theirs, because we neither hold those records nor have any access to them. Tell us all the same at the address above if you think the cause is something in the software: we cannot see your installation, so the first we will know of a fault in it is somebody telling us.
The security page sets this out at greater length, with what is in place on the machine the software runs on and on this website.
7. How long we keep it
- Enquiries and download requests, and the record of a download link issued against one: up to two years from when we received them, then deleted.
- Partner applications that went no further: up to three years, because the commercial conversation is a longer one.
- Pilot applications, and our notes on the pilot, where the tester did not go on to become a customer: up to two years from when we received the application, then deleted. If you become a customer, they are kept with your customer record.
- A signed partner agreement, and the record of who accepted it and when: six years after the agreement comes to an end. That is a contract record, so it is kept whether or not anybody asks us to delete it.
- An agreement link that was declined, withdrawn or ran out unused: twelve months, then deleted.
- Web server logs: a short period set by our hosting provider.
- Anything that becomes part of a contract or a legal record: as long as the law requires.
- Encrypted backups of this website: every hour for two days, then one a day for thirty days, then deleted. This is the one place where something you have asked us to erase survives for a while, and it is why the figure is thirty days rather than longer.
We take an encrypted copy of this website every hour so that a mistake or a failure does not lose what people have sent us. When you ask us to delete your data we delete it from the live site straight away, and it then falls out of the backups as those copies age out, within thirty-one days at the outside. We do not go into old backups to remove single records, because opening and rewriting every copy would put your data through more hands rather than fewer.
8. Your rights
You can ask us for a copy of the personal data we hold about you, to correct it, to delete it, to restrict what we do with it, or to receive it in a portable form. You can object to processing we carry out on the basis of legitimate interests. Where we rely on consent, you can withdraw it at any time.
Send the request to privacy@murgese.co.uk. We will reply within one month. There is no charge for a reasonable request.
9. If you are unhappy
Tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113.
10. Changes
If we change this notice, the date at the top changes with it. Where the change is significant, we will say what changed.