Privacy Policy

This policy explains what personal data we collect when you buy or use Poetato tools, why we collect it, who we share it with, and the rights you have. We handle your data in line with the UK GDPR and the Data Protection Act 2018.

1.Who we are (data controller)

The data controller is Poetato.

For any privacy question or to exercise your rights, contact us at [email protected] or on Discord.

2.What we collect and why

We do not knowingly collect data from anyone under 16.

3.Legal bases

We rely on:

• Performance of a contract- to deliver your key, run and enforce your licence, and provide support.
• Legitimate interests- to prevent fraud, abuse, and licence- sharing, and to keep our service secure. We balance this against your rights, and only use the minimum data needed (for example, hashing device identifiers).

Where we ever rely on consent (for example, optional marketing email), you can withdraw it at any time.

4.Who we share data with

We do not sell your data. We share the minimum necessary with a small number of trusted service providers (processors / sub-processors) who help us run the service:

• Square- payment processing.
• Google Firebase- backend, authentication, and hosting.
• Cloudflare- website and software-update hosting and security.
• Resend- sending your key and receipt emails.

Each processes data on our instructions. Some may process data outside the UK; where they do, appropriate safeguards (such as UK-approved transfer mechanisms) apply.

5.How long we keep it

We keep data only as long as we reasonably need it:

• Licence and account data (email, key, status)- for as long as your licence is valid, and for a reasonable period afterwards to handle support and disputes.
• Order / receipt records- kept as long as we are required to for tax and accounting purposes (generally up to 6 years).
• Security data (IP addresses, hashed device identifiers)- kept for a short period sufficient for fraud prevention, then deleted or further anonymised.

6.Your rights

Under the UK GDPR you have the right to:

• Access a copy of your personal data;
• Rectify data that is wrong or incomplete;
• Erase your data ("right to be forgotten"), where applicable;
• Restrict how we use your data;
• Object to processing based on legitimate interests;
• Portability- receive your data in a portable format.

To exercise any of these, email [email protected] or message us on Discord. We will respond within the time the law allows (normally one month).

7.Marketing

We do not send marketing email without your consent. If you ever opt in, you can unsubscribe at any time and we will stop.

8.Complaints

We would like the chance to resolve any concern first, so please contact us. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

9.Changes to this policy

We may update this policy from time to time. The "last updated" date at the top shows when it last changed.