Privacy Policy

This Privacy Policy explains how SepRoom Ltd (“SepRoom,” “we,” “us”) collects, uses, and protects information when you use the SepRoom web application and website (the “Service”). We are the data controller for the personal data described here, under UK data-protection law (UK GDPR) and, where it applies, the EU GDPR.

Information we collect

We collect only what the Service needs to work. It comes directly from you, from Google or Stripe when you use them, and automatically from your device (log data):

• Account information. Your email address. If you sign in with Google, we also receive your name and profile image from Google — never your Google password. If you sign in by email, we send a one-time sign-in link to your address; there are no passwords. You can set a display name in your account.
• Content you upload. The artwork files you import and the color separations, previews, and production files generated from them, together with project settings such as your ink sets and garment choices.
• Payment information. Payments are provided through Stripe Managed Payments; for eligible transactions Link acts as merchant of record and processes payment, billing, tax, fraud-prevention, dispute, and transaction-support information under its own privacy terms. We receive the limited account and transaction information required to provide your subscription — such as its status and the last four digits of your card; we never see or store full card numbers.
• Usage and technical data. Credit and storage usage for your account, and standard log data (IP address, browser and device type, timestamps).

Providing your email address and payment details is necessary to contract with us — without them we cannot provide an account or a subscription. You may choose not to upload artwork or set optional profile details, but we cannot perform separations without project content, and certain technical and security information is collected automatically when you use the Service.

How we use your information, and the lawful basis for each use

• Creating and maintaining your account (email, profile details) — performance of our contract with you.
• Storing and processing your projects (artwork, settings, outputs) — performance of our contract.
• Billing and account records (transaction and subscription records) — performance of our contract and compliance with legal obligations (tax and accounting rules).
• Service emails (sign-in links, billing notices, warnings before stored work is removed) — performance of our contract.
• Securing the Service and preventing abuse (IP addresses, logs, account events) — our legitimate interests: protecting SepRoom and its users, preventing misuse, diagnosing faults, and improving reliability.
• Support (your messages and relevant account or project data) — performance of our contract and our legitimate interests.

We do not sell your personal information, and we do not send marketing emails without your consent. You can withdraw that consent at any time using the unsubscribe link in the email or by contacting us. We do not use your uploaded artwork to train machine-learning models. We do not carry out automated decision-making that has legal or similarly significant effects on you.

How your information is shared

We share data with providers that help us operate SepRoom, including cloud hosting, processing, storage, database, email-delivery, and content-delivery providers. Where those providers act as our processors, they process data under our instructions and appropriate data-processing agreements. Stripe, Link, and Google may also act as independent controllers for parts of their services under their own privacy policies.

Primary artwork, project files, and separation processing are hosted in the European Union. Temporary cached copies of generated preview images may be served from content-delivery locations outside the EU to make the app fast; access to them is through signed, time-limited links. Some providers (such as our email and payment providers) may process limited data in the United States. Where personal data leaves the UK or EU, the safeguard used depends on the provider and transfer, and may include an applicable adequacy decision, the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, or the UK Addendum; details are available on request. We may also disclose information where required by law or to protect the rights and safety of our users and the Service.

Cookies

We use only strictly necessary cookies:

• Session (SepRoom) — keeps you signed in; valid for up to 30 days from sign-in.
• Security (hosting and content-delivery infrastructure) — abuse and fraud prevention.
• Payment (Stripe/Link, on their checkout and billing pages) — checkout and fraud prevention, per their policies.

We currently do not use advertising, analytics, or other non-essential cookies that require consent, so we do not display a cookie-consent banner.

Data retention

• Projects and artwork — kept while your account is active. Deleting a project removes it from active systems immediately. After a paid subscription ends, stored projects are kept for 60 days (14 days after an unconverted free trial) and then permanently deleted — we email you before that happens.
• Backups — deleted data may persist in encrypted backups for up to 35 days before expiring on schedule.
• Account profile data — kept while your account exists and normally deleted or anonymized within 30 days of account closure. We may retain limited account identifiers where necessary for billing and tax records, fraud prevention, legal claims, enforcing trial limits, or complying with law.
• Billing and tax records — kept for 6 years as required by UK tax law.
• Security and access logs — kept for up to 90 days.
• Support correspondence — kept for up to 2 years after the issue is resolved.

Your rights

Under the UK GDPR and, where applicable, the EU GDPR, you may have the right to access, correct, erase, or receive a copy of your personal data, restrict its processing, and object to certain processing. Some rights depend on the circumstances and the lawful basis we rely on. Depending on where you live and whether the relevant law applies to SepRoom, you may have additional privacy rights.

To exercise your rights, contact us at info@seproom.com. We may need to verify your identity before completing a request. We will not discriminate against you for exercising your rights.

Right to object

You may object at any time to processing based on our legitimate interests. Contact us at info@seproom.com and describe the processing you object to. This right is not absolute, and in some circumstances we may continue processing where we have compelling legitimate grounds.

Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully before consent was withdrawn.

You may complain to the UK Information Commissioner’s Office at ico.org.uk or by telephone on 0303 123 1113, or to your local supervisory authority.

Security

We use industry-standard measures to protect your data in transit and at rest. No system is perfectly secure, however, and we cannot guarantee absolute security.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a new effective date, and we will notify you directly of changes that materially affect how your data is handled.

Contact

Questions about this policy or your data can be sent to info@seproom.com. The data controller is SepRoom Ltd, registered in England and Wales (company number 17366776), with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.