Draft template. Replace everything in [square brackets] and have it checked before launch. This is a starting point, not legal advice.
Last updated: [date]
Smidge is run by [Your company name], [registered address], company number [number]. We are the data controller for your information. Contact: [email address].
Smidge is for people aged 18 and over. We don't knowingly collect information from anyone under 18. If you think someone under 18 has signed up, email us and we'll delete their account.
To run your account and save your learning (contract), to keep Smidge secure and limit misuse (legitimate interests), and to process check-in feelings only with your explicit consent, which you can withdraw at any time.
When you ask Smidge to write a lesson, deeper dive, reflection or weekly summary, the relevant text (for example your topic, your answers or your week's notes) is sent to our AI provider, Anthropic, to generate the response. It is not used to identify you or sold to anyone.
Our service providers: Supabase (sign-in and database), Cloudflare (hosting) and Anthropic (AI writing). Some may process data outside the UK under appropriate safeguards. We never sell your data.
Your notes, highlights, check-ins and progress are private to you. Lessons you create are added to the shared library that other members can read.
For as long as your account is open. Ask us to delete your account and we'll erase your data within [30] days.
You can ask to see, correct, export or delete your data, or object to how we use it, by emailing [email]. You can also complain to the Information Commissioner's Office (ico.org.uk).