Privacy policy
Last updated: [date to add]
This policy explains what personal data Dekko holds about you, why, who helps us run it and what you can ask us to do. We have tried to write it in plain English.
Who is responsible for your data
Operator name is the data controller. That means we decide how and why your personal data is used, and we are responsible for looking after it.
- Controller
- Operator name
- Postal address
- Operator address
- hello@dekko.cards
- ICO registration number
- [ICO registration number to add]
What we store
We keep only what we need to run your account.
- Your account. Your email address, and a name if you give us one. We need it to sign you in and to write to you about your account.
- Your sign-in sessions. A record for each device you are signed in on: when you signed in, when it was last used and rough device details such as the browser and IP address. It lets you see your sessions and end any of them.
- Your sign-in links. When you ask for a sign-in link we keep a one-way hash of it until it expires, which is a few minutes, or until you use it.
- Your subscription. Polar is the merchant of record. It sells the subscription to you, takes your payment and handles VAT, and it holds your payment and billing details. We keep a reference to your Polar customer and subscription, which plan you are on, its status and when the current period ends.
- Your messages. If you email us, we keep the conversation so we can help you.
- Technical logs. Our hosting keeps short-lived logs of requests, such as the page asked for and the IP address, to keep the service running and secure.
What we do not store
Some things never reach our servers, or are kept in a form that cannot be misused.
- Card or bank details. Polar takes payment, so your card number never touches our systems.
- Sign-in links in plain text. We keep only a hash of each link, so a copy of our database cannot be used to sign in as you.
- Advertising trackers. We use none, and we do not sell your data or share it for advertising.
- Analytics cookies. If we count visits, we use a cookieless counter that does not follow you around the web or build a profile of you.
Why we use your data
UK data protection law says we need a lawful basis, a reason it allows, for each way we use your data. These are ours.
| What we do | Data | Lawful basis |
|---|---|---|
| Run your account and sign you in | Email, sessions | Contract: you asked us to provide the service. |
| Take payment and keep billing records | Subscription reference, plan, status | Contract, and legal obligation for tax records. |
| Keep the service secure and stop abuse | IP address, technical logs | Legitimate interests: keeping the service safe for everyone. |
| Reply when you write to us | Email, your message | Legitimate interests: answering the people who ask for help. |
Who helps us run it
We use these companies to run the service. Each handles personal data on our behalf, under terms that only let it use the data for us.
| Company | What they do | Data | Where |
|---|---|---|---|
| Cloudflare | Hosts the app and this site, stores the database and delivers pages. | Everything you give the app, and technical request details such as your IP address. | As stated by Cloudflare |
| Cloudflare Email Service | Sends sign-in links and account emails. | Your email address and the text of the message. | As stated by Cloudflare |
| Polar | Takes payment and issues receipts as the merchant of record. | Your name, email, billing details and payment details, held by Polar. | As stated by Polar |
If we add or change a company on this list, we will update this page and the date at the top.
How long we keep it
- Account data: until you close your account, then we delete it.
- Payment and tax records: as long as the law requires, usually up to six years in the UK.
- Sign-in links expire within minutes. Sessions end when they expire or when you end them.
- Our payment processor keeps its own customer record (your email and name) after you close your account, under its own policy. Ask us and we will ask it to erase the record.
- Deleted data can sit in backups for a short while before it is overwritten.
Your rights
You can ask us to:
- show you the data we hold about you
- correct anything that is wrong
- delete your data
- limit how we use it
- give you a copy you can take elsewhere
- stop using it where we rely on legitimate interests
Email hello@dekko.cards. We aim to reply within one month. If we cannot help, we will say why.
If you are unhappy with how we handled it, you can complain to the ICO. Complain to the ICO.
Cookies
We set one cookie, from our own site, that keeps you signed in. The service cannot work without it, so we do not ask for consent. We do not use advertising or tracking cookies.
Sending data abroad
Some of the companies above process data outside the UK. Where they do, they rely on a safeguard UK law accepts, such as the UK's adequacy regulations, the International Data Transfer Agreement or the UK Addendum.
[Check each company's own terms and say which safeguard applies to it.]
Changes to this policy
If we change this policy in a way that matters, we will tell you by email or in the app before it takes effect. The date at the top shows the latest version.
Contact
Questions? Email hello@dekko.cards and a person will reply. hello@dekko.cards