What we collect, why we collect it, how long we keep it, and the rights you have over it. Written to be read, not to be skipped.
Account data — name, email address, company, billing address and phone number. Needed to open an account, raise invoices and reach you about your services.
Payment data — handled entirely by Stripe. Card numbers never reach our servers; we store only the card brand, the last four digits and the expiry date so you can recognise a saved card.
Technical data — IP addresses in server and application logs, and the IP recorded against staff actions in our audit trail.
Support data — the content of tickets and any files attached to them.
To perform the contract (delivering and billing your services), to comply with legal obligations (tax and accounting records, abuse handling), and for our legitimate interest in keeping the platform secure and preventing fraud.
We do not sell personal data, and we do not use it for advertising.
Stripe for payment processing, our datacenter partners where a physical intervention is required, and law enforcement where we are legally compelled. That is the complete list.
Invoices and their supporting records: 7 years, as required by tax law. Support tickets: 3 years after closure. Server and application logs: 90 days. Account data: until you close the account, then 30 days.
Under the GDPR and comparable laws you may request access to your data, correction, erasure, restriction of processing, portability, and you may object to processing based on legitimate interest.
Write to [email protected]. We answer within 30 days. You may also complain to your national data protection authority.
For anything you store on a server you rent from us, you are the controller and we are the processor. We do not access it except where you ask us to as part of a support request, or where we are legally compelled.
The marketing site sets no tracking cookies. The client area sets one essential cookie to keep you signed in. There is no third-party analytics or advertising script on this site.
Passwords are hashed with bcrypt. The client area is served over TLS only, supports two-factor authentication, and every staff action against a customer account is written to an audit log.