Privacy policy

This notice explains how personal data is processed when you use Wordround. It is provided under Article 13 of the UK GDPR.

Controller

Skyhill Group Limited, a company registered in England and Wales, is the controller of the personal data described in this notice, except where it says otherwise. Contact: roman@skyhill.io.

What is processed, why, and on what basis

• Account data — your email address, and any name and picture your sign-in provider supplies. Processed to create and operate your account. Basis: performance of our contract with you.
• Content you create — your page and the records you keep. Processed to provide the service. Basis: performance of our contract with you.
• Usage and event data — views of your public page, including a one-way hash derived from the visitor’s IP address and user agent, and actions taken in the product. Processed to operate the service, produce the statistics it shows you, secure it against abuse, and improve it. Basis: our legitimate interests in running, securing and developing the service.
• Technical and diagnostic data — error reports and logs, which may include your account identifier and the page you were on. Basis: our legitimate interests in keeping the service working and secure.

Providing account data is a requirement of using the service; without it an account cannot be created.

Data about other people

The records you keep about your contacts are personal data for which you are the controller. You decide what to record, you are responsible for having a lawful basis to record it, and you answer any request a contact makes about it. We process that data as your processor, on your instructions, in order to provide the service.

Public pages

A published page and everything selected for display on it — which may include a phone number, email address, LinkedIn profile, website and location — is public and accessible to anyone with the address. You choose what is displayed, one item at a time, and you are responsible for that choice.

Cookies

We set cookies that are strictly necessary to provide the service you have requested: one that keeps you signed in, and a short-lived one that preserves an action you began before signing in. Strictly necessary cookies do not require consent. We do not set advertising or cross-site tracking cookies.

Recipients

Personal data is shared with the service providers we use to operate Wordround, each acting as our processor: Supabase (database, authentication, file storage), Vercel (hosting), Sentry (error reporting), PostHog (product analytics), Inngest (scheduled processing), and Google (only where you choose to sign in with it). It may also be disclosed where required by law, and to a purchaser or successor in the event of a sale or reorganisation of the business.

International transfers

Some processors operate outside the UK. Where personal data is transferred outside the UK, it is done under the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or another transfer mechanism permitted by law.

Retention

Personal data is retained for as long as your account exists and afterwards for as long as is necessary for the purposes described in this notice, to comply with legal obligations, or to establish, exercise or defend legal claims. Raw event data is retained for a shorter period than the aggregated statistics derived from it. Deleting your account removes your account data, your content and your records from the live service; copies may persist in backups until those backups expire in the ordinary course.

Your rights

Subject to the conditions and exemptions in the UK GDPR, you have the right to request access to your personal data, its rectification or erasure, restriction of processing, and portability, and to object to processing carried out on the basis of legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting processing carried out before withdrawal. Requests may be made to roman@skyhill.io.

You have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk.

Automated decision-making

There is no automated decision-making producing legal or similarly significant effects, and no profiling of that kind.

Children

The service is intended for business use by adults. It is not directed at children, and accounts may not be created by anyone under 18.

Changes

This notice may be updated. The current version is the one published at this address, and the date above shows when it last changed.

Data protection enquiries: roman@skyhill.io.