Privacy Notice

This notice explains how Reason Labs LTD, a company registered in England and Wales (ICO registration application no. C1963025), processes personal data when you use GLYPH (the "Service"). Reason Labs LTD is the data controller.

1. What we collect

• Account data: email address and authentication credentials (password hash or Google OAuth identifier) when you create an account.
• Subscription & credits data: plan, status, period, credit balance, and a customer ID issued by our payment provider. We do not see or store your card details.
• Technical data: basic request information (IP address, user agent) required to deliver the Service and prevent abuse.
• Content you process: webcam, image, video, or audio you supply is processed locally in your browser by default. Where server processing is needed, it is transient and not retained.

We do not use your personal data for advertising, profiling, or any purpose other than operating your account and delivering the Service. We never sell your data.

2. Why we use it (legal bases)

• Contract performance: creating your account, providing the Service, managing your subscription and credit balance.
• Legal obligation: tax records, responding to lawful requests.
• Legitimate interests: security, fraud prevention, and basic operational logging.
• Consent: any non-essential cookies (see Cookie Notice).

3. Who we share it with

We do not share or sell your personal data. We use a small number of processors to run the Service:

• Supabase — managed authentication and database hosting.
• Google — only if you choose "Continue with Google" for sign-in.
• Paddle.com Market Limited — our Merchant of Record for payments, subscription management, tax compliance, invoicing, and refunds. Paddle collects and processes payment information directly under Paddle's Privacy Policy.
• Cloudflare — application hosting and edge delivery.

We may disclose data where required by law, to enforce our Terms, or to protect rights, property, or safety.

4. International transfers

Some of our processors are located outside the UK/EEA. Where data is transferred internationally we rely on adequacy decisions, Standard Contractual Clauses, or the UK International Data Transfer Addendum as appropriate.

5. Retention

Account data is kept while your account is active. When you delete your account, your authentication record, subscription record, and credit balance are deleted within 30 days, except where we are required to retain transaction records for tax or legal purposes (typically 6 years for UK invoicing).

6. Your rights (UK GDPR)

You have the right to:

• access the personal data we hold about you;
• request rectification or erasure;
• restrict or object to processing;
• data portability;
• withdraw consent where processing is based on consent;
• complain to the UK Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email kcrozier.creative@gmail.com. We respond within one month.

7. Security

We apply appropriate technical and organisational measures including encryption in transit, encrypted password storage, role-scoped database access (row-level security), and least-privilege service credentials.

8. Children

The Service is not directed at children under 13 (or 16 in the UK/EEA). Do not create an account if you are under that age.

9. Changes

We will update this notice as the Service evolves. Material changes will be notified by email or in-app notice.

10. Contact

Reason Labs LTD — kcrozier.creative@gmail.com. Registered address available on request.