Privacy Policy

Who we are and the controller

Simple Stack ("we", "us") operates Northwind Studio and is the controller of the personal data described here. For any privacy question, contact us at support@example.com.

What we collect

• Your email address and profile — to create your account, authenticate you, and send service messages.
• Account and security activity — sign-ins, feature use, and the IP address / browser sent with requests, used for delivery, security, and abuse prevention.
• Payment metadata — Stripe processes web payments; we receive amount, currency, status and processor IDs, never full card details.
• Support messages you send us.

Where information comes from

Most information comes directly from you and your use of the service. If you buy before creating an account, we receive your checkout email, payment status and transaction identifiers from Stripe so we can create or link your account and deliver the purchase.

Why we use it (lawful bases)

• Contract — account, purchase and content information used to provide your account and the service features you request.
• Legitimate interests — proportionate security logs, fraud and abuse prevention, support, service reliability and dispute handling.
• Legal obligation — transaction information needed for accounting, tax and lawful requests.
• Consent — optional analytics only; withdraw it at any time through Cookie settings.

Who we share data with

• our hosting provider — hosting the application, database and restricted backups.
• our email provider — sending sign-in, purchase and service emails.
• Stripe — web payment and fraud processing.

We share only what each provider needs for the stated purpose. Where information is transferred outside the UK, we rely on applicable UK adequacy regulations or approved contractual safeguards. Contact us for details of the safeguard relevant to your information.

Cookies and local storage

Essential cookies operate the account and security features. Analytics remains off unless you actively accept it, and Cookie settings lets you withdraw that choice.

• ss_cms_session — essential authentication, security and CSRF protection; up to 30 days.
• ss_remember — optional “remember me” sign-in; 30 days per rotating token, with an absolute chain limit configured by the operator.
• app_theme / app_accent — optional appearance choices; normally the browser session and no longer than one year.

Retention, deletion and backups

We keep account content while your account exists. Security, login and download logs are retained only while needed to protect accounts, provide support and establish or defend legal claims; the period depends on the risk and any live dispute. Account deletion removes your account and user-owned content from active systems and cannot be reversed through the service. Information may remain in access-restricted backups until normal backup rotation overwrites it and is used only for disaster recovery.

We remove direct account identifiers and retain only the minimised transaction information needed for tax, accounting and dispute handling, generally for up to six years. Payment-processor references may remain personal data and are retained only for those purposes; names, email addresses, addresses and raw processor payloads are removed from the retained application records.

Your rights and complaints

Under UK data-protection law you may request access, correction, erasure, restriction or portability. You may separately object to processing based on legitimate interests, and may withdraw consent without affecting earlier processing. Email support@example.com; we may need to verify your identity. You can also complain to the Information Commissioner's Office.

Automated decisions

We do not make decisions with legal or similarly significant effects about you solely by automated means.

Changes

We may update this policy; the "last updated" date above reflects the latest version.

This page is provided in good faith and is not legal advice.