Privacy Notice

• Contact form details — name, email, and your message. Used to reply to you. Legal basis: our legitimate interest in responding to enquiries.
• Account details — email address and sign-in identifier (including via Google sign-in). Used to create your account and show your plan. Legal basis: performance of our contract with you.
• Subscription records — your email, plan, status, renewal date, and the customer and subscription identifiers we receive from Paddle. Used to provide and support your plan and to send service emails. Legal basis: contract, and legal obligation for records.
• Support messages — what you send us about your site. Used to help you. Legal basis: contract and legitimate interests.
• Technical and security data — IP address, device and browser information, and error or request logs generated when you use the site. Used to keep the service secure and working. Legal basis: legitimate interest in security and reliability.

We don't sell personal data, and we don't send marketing email unless you ask us to.

• Paddle — our merchant of record. Paddle handles the sale, payments, subscription management, tax compliance, invoicing, and refunds, and acts as controller for the payment data it collects directly from you.
• Service providers — hosting, database and authentication infrastructure, and transactional email delivery, acting as our processors under contract.
• Professional advisers — legal and accounting, where needed.
• Authorities — where we're required to disclose by law.

Contact enquiries: up to 24 months. Account and subscription records: for the life of your account and then up to 7 years where tax and accounting rules require it. Technical logs: typically 90 days. After that, data is deleted or anonymised.

Our providers may process data in the United States and other countries. Where data moves out of the UK or EEA, transfers rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

Depending on where you live, you can ask for a copy of your data, correct it, delete it, restrict or object to processing, receive it in a portable form, or withdraw consent where we rely on it. Email us and we'll respond within one month. If you're in the UK or EEA you also have the right to complain to your data protection supervisory authority.

We use appropriate technical and organisational measures — encryption in transit, access controls, row-level database permissions, and least-privilege credentials — to protect personal data. No system is perfectly secure, but we treat this seriously and patch quickly.

We use essential cookies and local storage only: keeping you signed in, remembering your light or dark theme, and supporting secure checkout. We don't run advertising or cross-site tracking cookies. You can clear or block cookies in your browser, though sign-in won't work without the essential ones.

If this notice changes materially, we'll update the date at the top and, where appropriate, tell you by email.