Privacy Policy — SimpleSockets

1. Who We Are

SimpleSockets is a trading name of Drewdan Limited (company number 16948593), registered at 13 Tudor Crescent, Casnewydd, NP10 9BS, United Kingdom. Drewdan Limited is the data controller for personal data collected through this Service.

2. Data We Collect

We collect and process the following categories of personal data:

Account data: name, email address, and password (stored as a one-way hash)
Billing data: payment method details (processed and stored by Stripe; we do not store card numbers), billing address, and invoice history
Usage data: connection logs, message counts, channel names, and API usage metrics
Technical data: IP addresses, browser type, device information, and access timestamps collected via server logs
Communications: any correspondence you send us via email or support channels

3. How We Use Your Data

We use your personal data to:

Provide and maintain the Service
Process payments and manage your subscription
Send transactional communications (account confirmations, invoices, usage alerts)
Send optional usage summary emails (which you can disable in account settings)
Monitor and enforce our Acceptable Use Policy
Comply with legal and regulatory obligations
Investigate and resolve disputes or security incidents

4. Legal Basis for Processing

We process your personal data under the following legal bases:

Contract performance: processing necessary to provide the Service you have signed up for
Legitimate interests: fraud prevention, security monitoring, and service improvement
Legal obligation: compliance with applicable laws and regulations
Consent: where you have explicitly opted in (e.g., marketing communications)

5. Data Sharing

We do not sell your personal data. We may share it with trusted third-party service providers who assist in operating the Service, including:

Stripe — payment processing
Cloud infrastructure providers — hosting and data storage
Email service providers — transactional email delivery

All third-party processors are bound by data processing agreements and are required to protect your data in accordance with applicable law. We may also disclose data where required by law or to protect the rights and safety of our users.

6. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. Upon account closure, we will delete or anonymise your personal data within 90 days, except where we are required to retain it longer for legal, regulatory, or audit purposes.

Connection and usage logs are retained for a rolling 90-day period.

7. International Transfers

Your data may be processed outside the United Kingdom or European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK Information Commissioner's Office (ICO).

8. Your Rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

Access the personal data we hold about you
Rectify inaccurate or incomplete data
Erasure of your data ("right to be forgotten")
Restrict or object to processing
Data portability
Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you are unhappy with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

9. Cookies

We use cookies and similar technologies to operate the Service. See our Cookie Policy for full details.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include encrypted data transmission (TLS), hashed password storage, and access controls.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Service. We encourage you to review this page periodically.