01Who we are and what this covers
Data controller. We are the data controller for the personal information described in this policy. Our registered details are listed in clause 12.
This policy applies to our websites, mobile applications, and any other service that links to it. It does not apply to third-party services we link to — those publish their own privacy notices, which we recommend you read.
02Information we collect
We collect three categories of information:
- You give us — account details, profile, payment information, content you upload, and messages you send us.
- We collect automatically — device, browser, IP address, pages viewed, timestamps, approximate location, and identifiers stored on your device.
- We receive from third parties — sign-in providers where you choose to use them, payment processors, identity-verification partners where the law requires it, and publicly available sources.
We do not knowingly collect special categories of data such as health, religion, or political views. If you choose to share this kind of information in a free-text field, we treat it as restricted and use it only for the purpose you gave it to us for.
03How we use your information
We process your data only when we have a legal basis to do so. The main purposes are:
- To provide the service — running your account, delivering features, processing payments. Basis: contract.
- To keep your account secure — detecting fraud, preventing abuse, authenticating sign-ins. Basis: legitimate interest and legal obligation.
- To communicate with you — service announcements, security alerts, and replies to your messages. Basis: contract or legitimate interest.
- To improve the product — understanding which features get used, fixing defects, running controlled experiments. Basis: legitimate interest.
- To send marketing — only where you have opted in or the law permits it. You can unsubscribe at any time. Basis: consent.
- To meet legal duties — tax records, lawful requests, regulatory reporting. Basis: legal obligation.
04Cookies and similar technologies
We use cookies and similar storage for the following purposes. You can change your selection at any time from the cookie banner or from your browser settings.
- Strictly necessary
- Functional
- Analytics
- Advertising
Strictly necessary cookies are always on. Everything else stays off by default and is activated only after you opt in. We honour global Privacy Control (GPC) signals — if your browser sends one, we treat it as an opt-out for analytics and advertising.
05Sharing your information
We never sell personal data. We share it only with:
- Service providers — hosting, email delivery, customer support tooling, and analytics. Each one is bound by a data-processing agreement.
- Payment processors — to handle transactions; they receive only what they need to authorise a payment.
- Identity-verification partners — where anti-fraud or anti-money-laundering law requires it.
- Professional advisors — auditors and lawyers, under confidentiality.
- Authorities — when we receive a valid legal request, or to protect the safety of our users.
- A successor entity — in the event of a merger, acquisition, or sale of assets, with notice to you in advance.
06International data transfers
Some of our service providers sit outside the country where you live. When we move personal data across borders, we rely on:
- Adequacy decisions — where the destination has been recognised by the European Commission or the UK ICO as providing adequate protection.
- Standard Contractual Clauses — the EU/UK SCCs, supported by a transfer-impact assessment and extra technical measures where required.
- Your explicit consent — for occasional, clearly explained transfers that do not fall under the above.
You can request a copy of the safeguards that apply to your transfer by writing to dpo@example.com.
07How long we keep your data
We retain personal data only for as long as the purpose it was collected for requires, then we either delete it or anonymise it for statistics.
| Data category | Retention period |
|---|---|
| Account profile | While your account is active, plus 30 days after closure. |
| Billing and invoices | 7 years after the last transaction, to comply with tax law. |
| Support correspondence | 24 months after the case is closed. |
| Server access logs | 14 months, then aggregated and anonymised. |
| Marketing preferences | Until you unsubscribe, plus 12 months of suppression. |
| Analytics cookies | 13 months maximum, refreshed on each visit. |
08Your rights and choices
Depending on where you live, you hold some or all of the following rights. We extend them to every user, regardless of location.
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct anything that is wrong or incomplete.
- Erasure — ask us to delete your data, subject to legal retention rules.
- Restriction — pause processing while we look into a concern.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest, or to direct marketing.
- Automated decisions — request human review of any decision taken solely by automated means that affects you.
- Withdraw consent — at any time, without affecting processing that has already happened.
- Lodge a complaint — with your local data-protection authority.
We respond to verified requests within 30 calendar days. Use the form below or write to privacy@example.com.
09Data security
We protect personal data with industry-standard controls: encryption in transit (TLS 1.2+) and at rest, role-based access, audit logging, and regular third-party penetration testing. Access to production data is limited to staff with a documented need, behind hardware-backed multi-factor authentication.
If we become aware of a personal-data breach affecting your information, we will notify you and the relevant supervisory authority within the timeframes required by law.
10Children
Our services are not directed at children under 16, or such higher age as applies in your country. We do not knowingly collect personal data from children. If a parent or guardian believes a child has given us personal data, please write to privacy@example.com and we will delete it.
11Changes to this policy
We update this policy when our practices change. The effective date at the top of the page always reflects the current version. For material changes we notify active users by email or in-product banner at least 14 days before they take effect. Previous versions are archived and available on request.
12How to contact us
For any privacy question, request, or complaint, contact our team. We aim to answer every written enquiry within 30 calendar days.
Full contact details — including our Data Protection Officer, postal address, and EEA representative — are listed in the section below. You can also use the privacy request form for access, correction, or deletion requests.
