What we collect
Name & email address - via Clerk (our authentication provider) - when you sign up or log in
Subsctiption / payment status - via Stripe (our payment provider) - when you subscribe to one of our paid plans
IP address - via Cloudflare (our hosting provider)
We do not collect payment card details ourselves — these are handled entirely by Stripe, and we never see or store your full card number.
We do not use any advertising, analytics, or marketing tracking cookies. The only cookies/tokens in use are the ones listed above, all of which are strictly necessary to run the service — this is why you won't see a cookie consent banner on this site: under UK/EU law, strictly necessary cookies don't require consent, only disclosure (which this policy provides).
Why we process this data
When signing up to use premium features we need your account and subscription data to actually provide the service you've signed up for.
We use IP addresses and session tokens for security, fraud prevention, and to keep the service reliable, in a way that doesn't override your own rights and interests.
Who else sees your data
We share personal data with the following third parties, solely to provide the service:
Clerk (authentication) — clerk.com
Stripe (payments) — stripe.com
Cloudflare (hosting, security, content delivery) — cloudflare.com
Each of these has their own privacy policy governing how they handle data on our behalf, and we have data processing agreements in place with all three.
International data transfers
Clerk, Stripe, and Cloudflare are US-based companies. Where personal data is transferred from the UK to the US, this is done under the UK Extension to the EU-U.S. Data Privacy Framework (DPF) — each of these providers is self-certified under the DPF and the UK Extension, meaning UK personal data can be transferred to them lawfully without additional safeguards. As a backstop, each provider's data processing agreement also incorporates the UK's Standard Contractual Clauses (International Data Transfer Addendum), which would apply automatically if DPF certification for that provider were ever withdrawn or invalidated.
How long we keep your data
We retain your account and subscription data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within [30 days], except where we're required to keep certain records for legal or accounting purposes (e.g. payment records, which Stripe retains per their own obligations).
Your rights
Under UK GDPR, you have the right to; access the personal data we hold about you, correct inaccurate data, delete your data ("right to be forgotten"), object to or restrict certain processing, data portability.
To exercise any of these rights, contact us at the below email address. We'll respond within one month.
You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we've mishandled your data.
Contact
Questions about this policy or your data: info@deltahex.uk