Privacy Policy

Drentova Group Ltd is the controller of the personal data described in this policy. We are registered with the Information Commissioner’s Office under number PLACEHOLDER — ICO registration. Questions about this policy, or about how we handle personal data, go to [email protected].

Where you use one of our products as a customer of one of our customers — for example where an organisation uses our software to serve you — that organisation is the controller and we act as its processor. In that case, ask them first; we will help them respond.

We collect only what we need, and we collect it for the reasons below.

Information you give us

• Account details — your name, email address and, for paid plans, billing details. We need these to provide the service and to take payment.
• Correspondence — what you send us when you contact us, so we can respond and keep a record of the exchange.
• Content — whatever you put into the service. We process it to provide the service and for no other purpose.

Information we collect automatically

• Technical data — IP address, browser and device information, and request logs. We need these to operate the service, to keep it secure, and to diagnose faults.
• Usage data — which features are used and when. Where this is not necessary to run the service, we collect it only with your consent through analytics.

Information from others

• Payment status from our payment provider, so we know whether a subscription is active. We do not receive or store your full card details.

Under the UK GDPR we must have a lawful basis for each purpose. Ours are:

• Contract — to provide the service you have asked for, to manage your account and to take payment.
• Legitimate interests — to keep the service secure, to prevent abuse, to improve what we build, and to respond to enquiries. We have assessed in each case that this does not override your rights, and you may object at any time.
• Consent — for analytics and marketing cookies, and for marketing email. You may withdraw consent at any time, as easily as you gave it.
• Legal obligation — to keep accounting records and to respond to lawful requests.

We keep personal data only as long as we need it, and we delete or anonymise it after that.

• Account and content — for as long as your account is open, and for 30 days after you close it so an accidental closure can be undone.
• Correspondence — for two years from the last message, so we have context if you come back to us.
• Billing and accounting records — for six years, as UK tax law requires.
• Server and security logs — for 90 days.
• Cookie consent records — for as long as the consent cookie lasts, so we can show what you chose.

We do not sell personal data, and we do not share it for anyone else’s marketing. We use a small number of providers to run the service; each processes personal data only on our instructions, under written terms meeting Article 28 of the UK GDPR. They are listed in the subprocessor table below.

We may also disclose personal data where the law requires it, to establish or defend legal claims, or to a buyer if the business is sold — in which case we will tell you first.

We are based in the United Kingdom and process personal data here wherever we can. Some of the providers we rely on operate outside the UK.

Where personal data is transferred outside the UK, we rely on one of the safeguards permitted by Chapter V of the UK GDPR: UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. The safeguard applying to each provider is named in the subprocessor table, and we carry out a transfer risk assessment before relying on any of them.

You can ask us for a copy of the safeguards in place for a particular transfer by writing to [email protected].

We use a small number of cookies. Necessary ones are always on; analytics and marketing cookies are set only if you agree. Our Cookie Policy lists every one, and you can change your choice at any time using “Cookie preferences” in the footer of any page.

We do not make decisions producing legal or similarly significant effects about you by automated means alone. Where a product uses AI to assist a decision, our AI Policy explains what it does and how to ask for a person to review it.

Our services are not directed at children and we do not knowingly collect personal data from anyone under 13. If you believe a child has given us personal data, tell us at [email protected] and we will delete it.