Privacy Policy

1. Introduction and Data Controller

This Privacy Policy explains how Recons Ltd (“Recons Ltd”, “we”, “us”, or “our”), a company incorporated in England and Wales under company number 14359202, with its registered office at Office 9, Dalton House, 60 Windsor Avenue, London SW19 2RR, United Kingdom, collects, uses, shares, and protects your personal data when you use the Mycorr service (“Service”) or visit our website, mycorr.app.

Recons Ltd is the data controller for the personal data we collect directly from you in connection with your use of the Service or our website. Where you store personal data of third parties in the Service, you are the data controller for that data and Recons Ltd acts as a data processor on your behalf (see Section 13).

This policy applies to all users of the Service and visitors to our website worldwide. We comply with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the California Consumer Privacy Act (CCPA) as applicable.

2. Information We Collect

We collect the following categories of personal data:

(a) Account Information: your name, email address and profile photo. If you sign in with Google, we receive your name, email address and Google profile photo from your Google account. If you register with an email address and password, we store the password only as a salted one-way hash, never in readable form. You may also upload a profile photo of your own.
(b) User-Generated Content: database schemas, table data, model configurations, and any other data you upload, create, or store through the Service. This content is controlled by you and may contain personal data of third parties.
(c) Usage Data: session metadata, including when multiplayer collaboration sessions start and end. This data is used solely for system monitoring and service improvement.
(d) Technical Data: IP address, browser type and version, device information, and operating system. This data is collected automatically by our web servers.
(e) Cookie Data: session authentication cookies necessary for the operation of the Service, and analytics cookies set on our website with your consent (see Section 10).
(f) Website Analytics Data: on our marketing website (mycorr.app), and only with your consent, we collect usage analytics through Google Analytics 4: the pages you visit, actions you take on the site (such as clicking a sign-up link or submitting the contact form), the campaign tags in the link that brought you (UTM parameters), approximate geographic location at country or city level, browser and device type, and a pseudonymous random identifier that distinguishes one visitor from another. This data does not include your Content, is not linked to your name or email address, and is not used to identify you personally.
(g) Communications: when you write to us through the contact form on our website or the support form in the Service, the name and email address you give us (or, for the support form, your account email address), the subject you choose, and your message.
(h) Billing Information, for organizations on a paid plan: the organization’s billing email address and name, which member pays, the plan, the number of seats, the subscription’s status and billing dates, and the identifiers Paddle gives the customer, subscription and payments. Paddle’s payment notifications also tell us the card brand, the last four digits and expiry date of the card, and the cardholder’s name. We never receive or store full card numbers or security codes: card details are entered directly into Paddle’s secure payment form. Your billing address, company name and VAT or tax number are held by Paddle; we show and edit them through Paddle and keep only Paddle’s reference to them. If you add invoice recipients, we pass their email addresses to Paddle, which sends them copies of your invoices.

3. How We Collect Information

We collect personal data in the following ways:

Directly from you: when you register or sign in, create content, or contact us through our website or the Service.
Automatically: through cookies, server logs, and session monitoring when you use the Service, and through Google Analytics 4 when you visit our website and have accepted analytics cookies.
From third parties: your name, email address and profile photo from Google when you sign in with Google.
From Paddle: the status of your subscription and payments, and the card details listed in Section 2(h), when you buy or change a paid plan.

4. Legal Basis for Processing

Under the UK GDPR and EU GDPR, we process your personal data on the following legal bases:

(a) Performance of a Contract (Article 6(1)(b)): processing necessary to provide you with the Service, including account creation, authentication, data storage, collaboration features, and paid plans (checkout, seats, invoices, renewals and cancellation).
(b) Legitimate Interests (Article 6(1)(f)): processing necessary for our legitimate interests, including service security, system monitoring, performance optimisation, service improvement, and keeping a record of billing actions (who changed a plan, its seats or its billing details) so that organizations can review changes and we can resolve disputes. Our legitimate interests do not override your fundamental rights and freedoms.
(c) Consent (Article 6(1)(a)): where you have given specific consent for certain processing activities, such as analytics cookies on our website or optional communications. You may withdraw consent at any time, including through the “Cookie settings” link in the footer of our website.
(d) Legal Obligation (Article 6(1)(c)): processing necessary to comply with applicable laws, regulations, or legal processes.

5. How We Use Your Information

We use your personal data for the following purposes:

To provide, operate, and maintain the Service.
To authenticate your identity and manage your account.
To enable real-time collaboration features, including multiplayer sessions.
To monitor and improve the performance, security, and reliability of the Service.
To collect website usage analytics (with your consent) to understand how our marketing site is used and to improve it.
To communicate with you about your account, including service updates and security notices.
To respond to your requests and provide customer support.
To sell and manage paid plans: to set up subscriptions, show invoices, apply seat changes and cancellations, and tell an organization’s owners about failed payments.
To comply with applicable laws and legal obligations.
To enforce our Terms of Service and protect our rights.

We do not use your personal data for automated decision-making or profiling. We do not use your Content to train machine learning models.

We do not sell your personal data. We do not share your personal data with third parties for their own marketing purposes.

We share personal data with the following categories of service providers (subprocessors) who assist us in operating the Service:

(a) Google Cloud Platform (Google LLC): cloud infrastructure hosting, authentication (OAuth), Google Sheets integration, and cloud storage. Data is hosted in Google Cloud Frankfurt (europe-west3), European Union.
(b) Postmark (ActiveCampaign LLC): transactional email delivery for service-related communications, and delivery of the messages you send through our contact and support forms to our support inbox.
(c) Google Analytics (Google LLC): usage analytics for our website (mycorr.app), collected only with your consent. Google acts as our processor under its data processing terms. See Section 7 for how transfers to the United States are safeguarded.
(d) Discord (Discord Inc.): internal notifications to our team when you send us a message through the contact form on our website or the support form in the Service. Each notification contains the details listed in Section 2(g). See Section 7 for how transfers to the United States are safeguarded.
(e) Infrastructure providers: database and caching services operated on our cloud infrastructure.

All subprocessors are bound by data processing agreements and are required to protect your personal data in accordance with applicable data protection laws.

Payments for paid plans are handled by Paddle.com Market Limited (“Paddle”), our reseller and the merchant of record for all purchases. When you buy a paid plan you buy it from Paddle, and Paddle processes your payment and billing details as an independent data controller under its own privacy notice (https://www.paddle.com/legal/privacy). We share with Paddle the organization’s billing email address, its name, and our own identifiers for the organization and your account, so that Paddle can invoice you and we can link your purchase to the right organization. When you edit billing details or invoice recipients in the Service, we send them to Paddle.

We may also disclose your personal data if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

7. International Data Transfers

Your personal data is hosted on Google Cloud Platform in Frankfurt, Germany (europe-west3), within the European Union.

If you access the Service from outside the European Union or United Kingdom, your data will be transmitted to and stored on servers in the EU. The UK has an adequacy decision with the European Union, permitting data transfers between the UK and EU without additional safeguards.

For transfers to jurisdictions outside the EU/UK that do not have an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission or the UK Information Commissioner’s Office.

Website analytics data collected through Google Analytics 4 is processed by Google LLC in the United States, and the support notifications described in Section 6 are processed by Discord Inc. in the United States. For those transfers we rely on each company’s certification under the EU-U.S. Data Privacy Framework and the UK Extension to that framework, which have been recognised as providing adequate protection for personal data transferred from the EU and from the UK respectively.

Paddle may process your billing information outside the UK and EU; its privacy notice describes where and under which safeguards.

8. Data Retention

We retain your personal data as follows:

(a) Account data (name, email): retained for as long as your account is active. Upon account deletion, your account data is deleted within 30 days.
(b) User-generated content (schemas, table data): retained for as long as your account is active. When you delete your account, deletion takes effect after a 48-hour grace period during which you may cancel; your content is then queued for destruction and permanently deleted within 30 days of your request.
(b1) Organization content: when an organization is deleted, its content enters a 30-day grace period during which any owner or administrator of that organization may cancel the deletion; the content is then permanently deleted within 30 days of the grace period ending. During the grace period, members retain access and may export their work using the built-in export features.
(c) Session metadata: retained for 7 days for system monitoring purposes, then automatically deleted.
(d) Server logs (including IP addresses): retained for 30 days for security and debugging purposes, then automatically deleted.
(e) Backup data: retained for up to 30 days after the original data is deleted, then purged.
(f) Website analytics data (Google Analytics 4): event-level data associated with a user identifier is retained by Google for 14 months, after which it is deleted or aggregated. The analytics cookies themselves expire 2 years after your last visit (see Section 10).
(g) Billing records (the plan, seats, subscription status and dates, Paddle’s identifiers, the billing email address and which member pays): retained for as long as the organization exists, and afterwards for up to six years where needed for accounting, tax and dispute purposes. Paddle keeps its own invoice and payment records under its own retention policy.
(h) Payment notifications from Paddle, including the card details in Section 2(h): deleted 90 days after we process them.
(i) The record of billing actions, including the previous and new billing email address when it changes: retained for as long as the organization exists, and afterwards for up to six years so that disputes about who changed what can be resolved.

We may retain certain data for longer periods where required by applicable law or to resolve disputes.

9. Your Rights

Depending on your location, you have the following rights regarding your personal data:

Right of Access: you may request a copy of the personal data we hold about you.
Right to Rectification: you may request that we correct inaccurate or incomplete personal data.
Right to Erasure: you may request that we delete your personal data, subject to certain exceptions.
Right to Restriction: you may request that we restrict the processing of your personal data in certain circumstances.
Right to Data Portability: you may request a copy of your personal data in a structured, commonly used, machine-readable format.
Right to Object: you may object to our processing of your personal data based on legitimate interests.
Right to Withdraw Consent: where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
Right to Lodge a Complaint: you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk, or with your local EU supervisory authority.

California Residents (CCPA)

Right to Know: you may request information about the categories and specific pieces of personal data we have collected about you.
Right to Delete: you may request that we delete the personal data we have collected from you, subject to certain exceptions.
Right to Opt-Out: we do not sell your personal data. If this changes, we will provide a clear opt-out mechanism.
Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights.

Exercising Your Rights

To exercise any of these rights, please contact us at support@mycorr.app. We will respond to your request within 30 days (UK/EU GDPR) or 45 days (CCPA). We may request verification of your identity before processing your request.

You may also export your data directly from the Service using the built-in export features.

10. Cookies and Analytics

Essential Cookies

We use essential cookies necessary for the operation of the Service (space.mycorr.app):

Session Cookie: an authentication cookie that identifies your logged-in session. This cookie is set when you sign in and expires when your session ends or after 7 days of inactivity.

Because essential cookies are strictly necessary, no consent is required for them under UK or EU law. We do not use advertising cookies, remarketing, or any other third-party tracking technologies on the Service.

Our marketing website (mycorr.app) uses Google Analytics 4 to understand how the site is used. Analytics cookies are set only after you accept them in the banner shown when you first arrive. No analytics cookie is set before you make a choice, and if you decline, Google Analytics never loads and nothing is set.

Once you accept, the following cookies are set on mycorr.app:

_ga: distinguishes one visitor from another. Expires 2 years after your last visit.
_ga_84L0CXJQGE: maintains your session state for our Google Analytics property. Expires 2 years after your last visit.

The data collected is described in Section 2(f): the pages you visit, actions you take on the site, the campaign tags in the link that brought you, approximate geographic location, browser and device type, and a pseudonymous random identifier.

Legal basis: your consent, under Article 6(1)(a) of the UK GDPR and the EU GDPR, and the requirement for consent to non-essential storage under the UK Privacy and Electronic Communications Regulations and the EU ePrivacy Directive.

You may change your choice at any time using the “Cookie settings” link in the footer of mycorr.app, which reopens the banner. Declining there stops any further collection and deletes the analytics cookies already in your browser. Withdrawing consent does not affect data collected before you withdrew it.

Google Analytics is provided by Google LLC acting as our processor (see Section 6). Transfers to the United States are safeguarded as described in Section 7. Analytics data is retained for 14 months (see Section 8).

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

Encryption of data in transit using TLS/HTTPS.
Encryption of data at rest.
Fine-grained access controls using role-based authorisation.
Regular security reviews and monitoring.
Access to personal data limited to authorised personnel on a need-to-know basis.
Secure authentication: sign-in with Google, or with an email address and a password that we store only as a salted one-way hash, never in readable form.

While we take reasonable measures to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

12. Children’s Privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete such data promptly. If you believe we have collected data from a child under 16, please contact us at support@mycorr.app.

13. Data Processing Terms

This section sets out the terms under which Recons Ltd processes personal data on your behalf when you act as a data controller by storing personal data of third parties in the Service.

(a) Roles: when you store personal data of third parties in the Service, you are the data controller and Recons Ltd is the data processor. You determine the purposes and means of processing; we process such data only on your documented instructions.
(b) Scope of Processing: we process your third-party data solely to provide, maintain, and secure the Service. We do not access, use, or disclose such data for any other purpose unless required by applicable law.
(c) Security Measures: we implement appropriate technical and organisational measures as described in Section 11 to protect all data processed through the Service.
(d) Sub-Processing: we engage the subprocessors listed in Section 6 to assist in providing the Service. We will notify you of any changes to our subprocessors by updating Section 6 of this Privacy Policy. You may object to a new subprocessor by ceasing to use the Service.
(e) Breach Notification: in the event of a personal data breach affecting data we process on your behalf, we will notify you without undue delay, and in any event within 72 hours of becoming aware of the breach, providing the nature of the breach, the categories of data affected, and the measures taken to address it.
(f) Audit Rights: upon reasonable written request and subject to appropriate confidentiality obligations, we will make available to you information necessary to demonstrate our compliance with these data processing terms.
(g) Data Return and Deletion: upon termination of your account, you may export your data using the built-in export features of the Service. Following your request for account deletion, we will delete all data processed on your behalf in accordance with the retention periods set out in Section 8.
(h) Data Protection Impact Assessments: upon reasonable request, we will provide you with information necessary to carry out a data protection impact assessment.

14. Your Obligations When Storing Third-Party Data

If you use the Service to store, process, or manage personal data of third parties (for example, customer records, employee data, or contact information), you acknowledge and agree that:

You are the data controller for such data and bear full responsibility for compliance with all applicable data protection laws.
You must have a lawful basis for collecting and processing such data.
You must inform the relevant data subjects about the processing of their data, including the fact that their data is stored using the Service.
You must respond to and fulfil any data subject requests (access, deletion, rectification, etc.) relating to such data.
You must not store special category data (racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, etc.) or criminal offence data in the Service unless you have ensured compliance with the additional requirements of applicable data protection law.
Recons Ltd acts as a data processor only and accepts no responsibility or liability for your compliance with data protection laws regarding third-party data you store in the Service.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the version number and effective date at the top of this policy and notify you through the Service. Material changes will require you to review and re-accept the updated policy before continuing to use the Service.

We encourage you to review this Privacy Policy periodically.

16. Contact

If you have any questions about this Privacy Policy or our data practices, or if you wish to exercise any of your data protection rights, please contact us at:

Recons Ltd, Office 9, Dalton House, 60 Windsor Avenue, London SW19 2RR, United Kingdom

Company number 14359202

support@mycorr.app

For data protection matters, you may also contact the UK Information Commissioner’s Office (ICO) at ico.org.uk.