Privacy Policy
Version 2026-11-04 · This policy explains what personal data 4colors collects, why, who we share it with, how long we keep it, and your rights. It covers our website, the Account page, the 4colors APIs (4colors Quantum Compiler, 4colors Optimizer for QUBO and 4colors Optimizer for Scheduling (early access)), the fourcolors client, and how we contact people. What happens to the models, circuits and results you send us is set out in our Terms of Service (section 8) and on How we handle your data (/data-handling). This policy is about personal data.
1. Who we are
4colors Ltd, trading as 4colors Research, is the controller of the personal data described here. Registered in England and Wales, company number 10139486. Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Contact for anything in this policy: support@4colors-research.com.
2. What we collect, and why
2.1 Visitors to our website
| What | Why | Legal basis |
|---|---|---|
| Pages viewed, browser, device and approximate location, through Google Analytics, only if you accept analytics in the cookie banner | To understand how the site is used and improve it | Consent |
| How you read our pages, through our own measurement script, only if you accept in the cookie banner: the page, the page you came from and any campaign tags in the link, which sections were on screen and for how long, scrolling, the size of the browser window, whether the page was in view or in focus, which links, downloads and buttons you clicked, and which form fields you used (never what you entered). When you typed, scrolled, moved the pointer or touched the screen is counted, never which key or where. Your network address cut short. The script stores a random visitor ID on your device (in local storage), so we recognize your browser across pages and visits. Kept for 24 months. | To understand which content is useful and improve the site | Consent |
| Your cookie choice, kept in your browser only | To remember your choice | Necessary for the site |
| Our web servers' standard logs of each request: your full network address, browser, the page or address requested and the time. Kept for up to 15 days, then deleted. | To keep the site and service secure, prevent abuse and fix problems | Legitimate interests |
If you accepted and then give us your email address, for example in a form or when you sign up, or open a personal link in an email from us, we link the visitor ID to you. If someone else then sends a form from the same browser, they get their own new visitor ID and their own record; nothing of theirs is linked to you, and visits from before that point stay with your record. Your visits, including those from before, then become part of our record of you, and we use them to understand what interests you and to make our messages to you more relevant. A copy of your data that you ask for (section 7) includes these visits. If you change your choice to Decline, the visitor ID is removed from your browser and measurement stops. To have visits already linked to you deleted, ask us (section 7).
2.2 People who use our forms (contact, early access, newsletter, trial, conference)
| What | Why | Legal basis |
|---|---|---|
| What you enter: name, email, company, role, country, interest, and your message or note where the form has one | To answer you and handle what you asked for | Legitimate interests (answering an enquiry you sent); consent for the newsletter |
| The form's name and version, and the wording of any consent you gave (kept as a fingerprint) | To show what you agreed to | Legitimate interests; legal obligation |
| Your network address cut short (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address). We never keep the full address from a form, apart from the web server logs in section 2.1. | To prevent spam and abuse | Legitimate interests |
If you sign up for our newsletter, we first email you a link to confirm your address. Until you confirm, we send you nothing else, and an unconfirmed sign-up is deleted after 30 days (if we also hold your details for another reason, for example a message you sent us or your account, we keep only those).
Contact and early-access messages are also delivered to our support mailbox.
2.3 People with a 4colors account
| What | Why | Legal basis |
|---|---|---|
| Email address, password (stored only as a one-way hash), your team and role, and your organization's name | To create and run your account | Contract |
| If you sign in with Google or GitHub: your account identifier there, your email address and whether it is verified. We don't keep your profile or contacts. | To sign you in | Contract |
| API keys (stored only as a one-way hash and a short prefix) and when each was last used | To authenticate API use and let you manage keys | Contract |
| The network address you signed up from (in full for 7 days, then cut short like the others) | To detect duplicate trials and abuse | Legitimate interests (preventing abuse of free trials) |
| Checks at sign-up: your email address normalized (for example without "+tags"), whether it is from a disposable-email service, and whether your email domain already has an active trial | To keep to one trial per person and organization (Terms section 5) | Legitimate interests |
| Records of what you accepted: which version of the Terms or which consent text, by whom, and when, with your network address cut short and your browser's user agent | To prove what was agreed | Legal obligation; legitimate interests |
| Activity records of each API request: time, endpoint, result, size and timing, the account and key, the client's user agent, and your network address cut short. Sign-in events, emails we send you, and changes to account, team, key, licence and billing records. Emails appear in these records only as a one-way hash and the domain; passwords, keys and content only as fingerprints. | Security, abuse prevention, billing questions and support | Legitimate interests |
| How you use your account: which account pages you open, when you look at plans and prices, start, leave or complete an upgrade or top-up, create an API key, run your first job, reach a plan limit, and follow links from your account to our docs. Recorded by our servers, with no extra tracking in your browser. | To understand how the service is used, improve it, and offer your team help or a plan that suits it | Legitimate interests |
| How much execution time your team's jobs use, including jobs that end without an answer. If use of unbilled jobs goes over our fair-use limit, the account is suspended automatically (new jobs refused) and team admins are emailed; you can ask for a person to review it at support@4colors-research.com | To apply fair use (Terms section 9) and prevent abuse of unbilled jobs | Legitimate interests; contract |
| The emails we send you about your account and billing | To keep a record of what we told you | Contract; legitimate interests |
2.4 Customers who pay
We use Stripe to take payments. Stripe collects your card details directly; we never see or store full card numbers. We keep your Stripe customer reference, the card's brand and last four digits (to show which card is saved), your plan, charges, receipts, refunds and the consents you gave for charges. For tax, we also keep your billing address and your VAT or tax number if you give one.
Legal basis: contract; legal obligation (accounting and tax records).
2.5 People who email us
If you email support or another 4colors address, we keep your email and our reply to handle your request.
Please don't send us models or results by email. If you do, they are handled as described in How we handle your data.
2.6 Business contacts and marketing
We may keep the business contact details of people at organizations we work with or meet, for example at events. We send marketing emails only where the law allows, and every email lets you unsubscribe. If you have an account, we may email you about 4colors products and plans; you can opt out on the Account page or from any of these emails. If you opt out or object, we also stop using your account activity to decide whether to contact you. If you unsubscribe, opt out or ask us to delete your data, we keep a one-way hash of your email address, and nothing else, so that we don't email you again. Links in our marketing emails are unique to each recipient, so we know who clicked which link and when. We use this to measure our emails and to stop emailing people who aren't interested.
Legal basis: legitimate interests (business-to-business marketing); consent where the law requires it.
3. Who we share it with
We don't sell personal data. We share it only with service providers who process it for us under contract:
| Provider | What for |
|---|---|
| Hosting providers, such as OVH | Hosting of our website and our platform servers |
| Stripe | Payments |
| Our accountant | Accounts and tax returns |
| Google (Google Workspace) | Email we send and receive |
| Google (Google Analytics) | Website analytics, only with your consent |
| Google and GitHub | Sign-in, only if you choose it |
Our servers, including those holding backup copies, are in the United Kingdom, the European Union and North America (the United States and Canada). We may add servers in any of these regions.
We may also disclose personal data where the law requires it, or to protect our rights, users or the service. This includes tax records we must give to HM Revenue & Customs or other tax authorities.
4. Transfers outside the UK
Some of our servers and providers are outside the UK: in the European Union and North America (see section 3). Where data goes outside the UK, we rely on UK adequacy regulations (which cover the European Union and Canada) or on safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
5. How long we keep it
| What | How long |
|---|---|
| Account data | While your account exists; deleted when you close it (email support) |
| Activity records | 365 days in our live records, then archived with no fixed end date. The archive holds emails only as hashes and network addresses only cut short. Backups include it. When an account is closed or its data deleted, these records are kept in this form, so they no longer show your email address. |
| Sign-up network address in full | 7 days, then cut short |
| Web server logs (full network address) | Up to 15 days, then deleted |
| Website measurements from our own script, with the visitor ID and any link to you (only if you accepted) | 24 months |
| How you use your account (pages, plans viewed, upgrades and top-ups started) | 12 months, then deleted |
| Records of what you accepted | 6 years after your account closes |
| Payment, invoice and refund records | 6 years after the end of the financial year they belong to (UK accounting law) |
| Emails we sent you about your account | 30 days |
| Form submissions and enquiries | 24 months after your last contact with us |
| Newsletter sign-ups you have not confirmed | 30 days, then deleted |
| Business contacts not active | Deleted after 12 months without contact |
| Hash of an email address that unsubscribed or asked for deletion | As long as we send marketing email, so that we don't email it again |
| Backups | Deleted data leaves our backups within 35 days |
6. Security
We protect personal data with access controls, encrypted connections and by storing passwords, API keys and tokens only as one-way hashes. Activity records hold emails only as hashes and network addresses cut short. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the ICO as the law requires.
7. Your rights
Under UK data protection law you can ask us for a copy of your personal data, and ask us to correct it, delete it, restrict or object to how we use it, or give it to you in a portable form. You can withdraw consent at any time, for example for analytics in the cookie banner or for marketing by unsubscribing; this doesn't affect use before you withdrew.
Email support@4colors-research.com. We reply within one month.
If you're not happy with how we handle your data, you can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113. We'd like the chance to help first.
8. Cookies and similar technology
- Cookie choice: your choice is kept in your browser (local storage). If you accept, our measurement script also records that you accepted, and when you change your choice.
- Google Analytics: loads only after you click Accept. You can change your choice at any time under Cookie settings at the bottom of every page.
- Our own measurement: loads only after you click Accept, together with Google Analytics, and stops when you change your choice. It keeps a random visitor ID in local storage until you change your choice (section 2.1).
- Account sign-in: the Account page uses what it needs to keep you signed in. These are strictly necessary.
What we store on your device. Apart from Google Analytics' cookies (_ga and _ga_BBC47519CW, kept up to 400 days), which it sets only after you accept and which are removed when you withdraw, our site sets no cookies. It keeps these items in your browser's local storage:
- 4c-consent, 4c-analytics-consent, 4c-consent-sent: your cookie choice and when it was recorded (always; needed to respect your choice).
- fc-currency: the currency you chose for prices (only if you choose one).
- fc-play-name, fc-play-music, fc-play-sound and fc-<game>-scores: the name you typed, your sound and music settings and your best scores in our games. They are set only when you play, whatever your cookie choice, because they do only what you asked for, and they never leave your device.
- 4c-vid: the random visitor ID (only if you accepted).
- 4c-vid-for: a short code made from the email address you last typed in one of our forms and this browser's visitor ID, so it means nothing on any other device. It is never sent to us. We use it to tell whether a different person is using the same browser, so their visits aren't mixed with yours (only if you accepted). Anyone using this browser could check whether an address they guess matches it.
The last two are removed when you change your choice to Decline or withdraw your consent, when your choice expires, or when your browser sends a Global Privacy Control signal; 4c-vid-for is also removed whenever a new visitor ID is made.
9. Children
Our services are for business, research and professional use. They are not for children, and we don't knowingly collect children's data.
10. Your content that contains personal data
Our services are built for optimization and compilation problems. Please don't send personal data in models, circuits or schedules unless we have agreed it in writing. Where we have agreed it, we process that data for you, on your instructions, under a data processing agreement.
11. Changes to this policy
Each version has a date at the top, and past versions stay available at /privacy?v=<version>. If a change matters to you, we'll tell account admins by email before it takes effect.
12. Contact
4colors Ltd, trading as 4colors Research. Registered in England and Wales, company number 10139486. Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Email: support@4colors-research.com
Questions about these documents? Contact us.