Privacy Policy

1. Who we are

St8dio ("we", "us", "our") is an all-in-one business operations platform operated by a sole trader registered in the European Union. We are the data controller responsible for your personal data when you use St8dio.

If you have any questions about this Privacy Policy or how we handle your data, please contact us at the details provided in Section 9 below.

2. What data we collect

We collect and process the following categories of data:

• Account data: Your name, email address, and password (stored securely and hashed) when you create a St8dio account.
• Business data you enter: Information you input into the platform, such as contacts, invoices, expenses, employee records, and inventory. You are responsible for ensuring you have the right to enter personal data about others (e.g. employees or contacts) into the platform.
• Usage data: Information about how you use St8dio, including IP address, browser type, device information, and interaction logs. This helps us maintain security, troubleshoot issues, and improve the service.
• Payment data: When you subscribe to a paid plan, payment is processed by our payment provider (Stripe). We do not store full card details — these are handled entirely by the provider.
• Communication data: Records of correspondence if you contact us for support or enquiries.

3. Legal bases for processing

We process your personal data under the following legal bases in accordance with the GDPR:

• Performance of a contract: Processing your account data and business data to provide the St8dio service you signed up for.
• Legitimate interests: Using usage data to improve the platform, ensure security, prevent fraud, and communicate important service updates. These interests are balanced against your rights and are never used in a way that overrides your privacy.
• Consent: Where you opt in to receive marketing communications or certain non-essential cookies. You can withdraw consent at any time.
• Legal obligation: Retaining certain records (e.g. billing and tax-related data) to comply with applicable laws.

4. How we use your data

We use your personal data to:

• Provide, maintain, and improve the St8dio platform.
• Process subscription payments and manage your account.
• Provide customer support and respond to your enquiries.
• Monitor and ensure the security and integrity of the platform.
• Comply with legal obligations.
• Send you service notifications and, where you have consented, marketing communications.

5. Data sharing

We do not sell your personal data. We share data only in the following circumstances:

• Service providers: We use trusted third-party providers to operate the platform (e.g. cloud hosting, payment processing, email delivery). These providers act as processors on our behalf and are bound by appropriate data protection agreements.
• Legal requirements: Where required by law, court order, or to protect our rights and the safety of others.

6. International transfers

Some of our service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to protect your data to EEA standards.

7. Data retention

We retain your personal data for as long as your account is active. After account closure, we retain data for the period necessary to comply with legal obligations (e.g. tax record retention), resolve disputes, and enforce our agreements. After that, data is deleted or anonymised.

8. Your rights under GDPR

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (subject to legal retention obligations).
• Restriction: Request that we limit processing of your data in certain circumstances.
• Portability: Receive your personal data in a structured, machine-readable format and transmit it to another provider.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, please contact us using the details in Section 9. You also have the right to lodge a complaint with your local data protection authority.

9. Contacting us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us through our contact page or by writing to the address associated with your St8dio account. We will respond to your request within the timeframe required by applicable law (usually within one month).

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting the updated policy on this page and updating the "last updated" date. We encourage you to review this page periodically.