How [COMPANY NAME] collects, uses and protects your personal data, how long we keep it, cookies, and your rights under UK GDPR.
Privacy Policy - [COMPANY NAME] Version: 1.0 Effective Date: 25 February 2026 1. Introduction [COMPANY NAME] (“we”, “us”, “our”), registered in Scotland (Company No. [COMPANY NUMBER]), is the data controller for the personal data processed through the Elyo Studio platform (“Service”). Our registered office is at [REGISTERED ADDRESS]. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. 2. Data We Collect We collect the following categories of personal data: 2.1 Account Information - Full name - Email address - Password (stored as a secure hash — we cannot read your password) - Phone number, country, and business name (optional) 2.2 Technical Data - IP address at signup and login - Browser user agent string - Login timestamps and frequency - Last activity timestamps 2.3 Billing Data - Subscription plan and billing cycle - Stripe customer ID (payment details are held by Stripe, not by us) - Invoice history 2.4 Content Data - Images, videos, and other files you upload - Catalog metadata (names, descriptions, settings) - Usage statistics (storage, views, bandwidth) 2.5 Consent Records - Date and time you accepted the Terms of Service - Date and time you accepted this Privacy Policy - Version numbers of accepted documents 3. Legal Basis for Processing We process your data under the following lawful bases: - Contract: Processing necessary to provide the Service you have subscribed to (Article 6(1)(b) UK GDPR) - Consent: Where you have given explicit consent, such as accepting this Privacy Policy (Article 6(1)(a)) - Legitimate Interest: For security monitoring, fraud prevention, and service improvement (Article 6(1)(f)) - Legal Obligation: For tax records, regulatory compliance, and responding to lawful requests (Article 6(1)(c)) 4. How We Use Your Data - To create and manage your account - To provide, maintain, and improve the Service - To process payments and manage subscriptions - To send important service notifications (account verification, password resets, billing alerts) - To monitor for abuse, fraud, and security threats - To comply with legal obligations - To provide customer support 5. Data Sharing We share personal data only with the following categories of recipients: - Stripe: Payment processing (Stripe acts as an independent controller for payment data) - Cloudflare: CDN and security services (data processing agreement in place) - DigitalOcean: Database hosting (data processing agreement in place) - Render: Application hosting (data processing agreement in place) - Brevo (Sendinblue): Transactional email delivery We do not sell your personal data to third parties. We do not use your data for advertising purposes. 6. International Transfers Some of our service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or adequacy decisions, as required by UK GDPR. 7. Data Retention - Active accounts: Data is retained for the duration of your account - Deleted accounts: Personal data is permanently removed upon account deletion, subject to our lifecycle process (grace period, archive period, then permanent deletion) - Billing records: Retained for 7 years as required by UK tax law - Admin activity logs: Retained for 2 years for security and audit purposes 8. Your Rights Under UK GDPR You have the following rights regarding your personal data: - Right of Access: Request a copy of the personal data we hold about you - Right to Rectification: Request correction of inaccurate data - Right to Erasure: Request deletion of your data (“right to be forgotten”) - Right to Restrict Processing: Request that we limit how we use your data - Right to Data Portability: Request your data in a structured, machine-readable format - Right to Object: Object to processing based on legitimate interest - Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time To exercise any of these rights, contact us at support@elyostudio.com. We will respond within 30 days as required by UK GDPR. 9. Data Security We implement appropriate technical and organisational measures to protect your data, including: - Encryption in transit (TLS/HTTPS) - Passwords stored using bcrypt hashing - Access controls and role-based permissions - Regular security monitoring and audit logging - Secure cloud infrastructure with reputable providers 10. Cookies The Service uses essential cookies and local storage for authentication (session tokens). We do not use tracking cookies, advertising cookies, or third-party analytics cookies. No cookie consent banner is required as we only use strictly necessary cookies. 11. Children's Privacy The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly. 12. Changes to This Policy We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The version number and effective date at the top of this page will be updated accordingly. 13. Complaints If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow Cheshire, SK9 5AF https://ico.org.uk 14. Contact For any questions or requests regarding this Privacy Policy or your personal data, contact us at: support@elyostudio.com [COMPANY NAME] DunEden Business Centre 8 Harrison Road, Dundee DD2 3SN, United Kingdom Company No. [COMPANY NUMBER]