Privacy Notice

Part A — Your account data (we are the controller)

When you create an account we hold your email address, your display name if you give one, your plan and subscription status, the terms version you accepted, your marketing preference, and operational logs such as sign-in times and request counts used for rate limiting.

Lawful basis

• Contract — running your account and delivering the console.
• Legitimate interests — security, abuse prevention, rate limiting, service improvement.
• Consent — marketing email only, withdrawable at any time from your account page.
• Legal obligation — retaining payment and tax records.

Retention

Account data is kept while your account exists and deleted when you delete it, except payment and tax records which are kept for six years as required by UK law.

Processors we use

Cloud hosting and database, our payment provider, and transactional email. Card details are handled entirely by the payment provider; we never receive them.

Your rights

Access, rectification, erasure, restriction, portability and objection, plus the right to complain to the Information Commissioner's Office. Most of these are self-service on the account page; for the rest, contact us and we will respond within one month.

Part B — Physical-security telemetry (your organisation is the controller)

Badge swipes, door and camera references, site identifiers and the identities linked to them are not our data. Your organisation decides why they are collected and for how long; we process them on your instructions as a processor. This is a different lawful basis, a different retention clock and a different legal document — it belongs in a data processing agreement with a processor annex, not in this consumer notice.

Summary of how we handle it in the meantime:

• We act only on documented instructions from the customer-controller.
• Identities are stored as pseudonymous references by default. Real names, badge IDs, door and camera refs are revealed only to accounts holding the investigator or administrator role, never through a paid plan.
• Every identity reveal is written to an access audit log with the actor, time and reason.
• Telemetry is redacted automatically after 90 days unless the controller has configured otherwise; the event survives, the person does not.
• On termination we delete or return the telemetry at the controller's choice.

If you are an individual whose badge data reaches this service, your rights sit with your employer or site operator as controller. Ask them; we will support their response.