Privacy Notice

Wyvern Studio Ltd ("we", "us", or "our") operates Huddle ("Huddle" or the "Service"), a private workplace social network. This Privacy Notice explains how we collect, use, disclose, and safeguard your personal data when you use Huddle. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data We Collect

1.1 Information you provide

• Account data: your name, email address, and password (stored as a one-way hash).
• Profile data: job title, bio, pronouns, location, start date, and profile photo that you choose to provide.
• Workspace data: your organisation name and any content you post, including posts, comments, reactions, poll votes, debate votes, mood check-ins, shoutouts, event RSVPs, and messages.
• Billing data: payment method and transaction details processed by our payment provider (Stripe). We do not store full card numbers on our servers.

1.2 Information collected automatically

• Usage data: device type, browser type, IP address, access times, and feature usage patterns.
• Cookies and similar technologies: used to maintain your session and remember preferences. See Section 8 below.

2. How We Use Your Data

We process your personal data for the following purposes:

• Service provision: to create and manage your account, display content within your workspace, and deliver the features of Huddle.
• Communication: to send you notifications, administrative messages, and support responses.
• Billing: to process subscription payments, manage trials, and maintain billing records.
• Improvement: to analyse usage trends, diagnose technical issues, and develop new features.
• Security and legal compliance: to detect, prevent, and address fraud, abuse, and legal obligations.

3. Legal Basis for Processing

Under the UK GDPR, we rely on the following legal bases:

• Contract (Article 6(1)(b)): processing necessary to provide Huddle under our Terms of Use.
• Consent (Article 6(1)(a)): for optional features such as push notifications and analytics, which you can withdraw at any time.
• Legal obligation (Article 6(1)(c)): to comply with legal requirements such as tax record-keeping.
• Legitimate interests (Article 6(1)(f)): to ensure platform security, prevent abuse, and improve the Service.

4. Data Sharing

We do not sell your personal data. We share data only with:

• Service providers: Stripe (payment processing), and cloud infrastructure providers, under written agreements requiring them to protect your data.
• Your workspace: content you post is visible to other members of your workspace, as that is the core function of Huddle.
• Legal authorities: where required by law, court order, or to protect our rights and the safety of others.
• Business transfers: in the event of a merger, acquisition, or asset sale, data may be transferred subject to confidentiality protections.

5. Data Retention

We retain your personal data for as long as your account is active. After account closure or workspace deletion, we retain data for a limited period to comply with legal obligations, resolve disputes, and enforce agreements, after which it is permanently deleted or anonymised.

6. Your Rights

Under the UK GDPR, you have the following rights:

• Access: request a copy of your personal data.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your data, subject to legal exceptions.
• Restriction: request that we limit processing of your data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests or direct marketing.
• Withdrawal of consent: withdraw consent at any time where processing is based on consent.

To exercise these rights, contact us at privacy@huddle.app. You may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls, and regular security reviews. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

8. Cookies

Huddle uses essential cookies to maintain your authenticated session and remember your preferences. We do not use cookies for third-party advertising. You can control cookies through your browser settings, but disabling them may affect functionality.

9. International Data Transfers

Your data may be processed in countries outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent legal protections.

10. Children's Privacy

Huddle is intended for workplace use and is not directed at individuals under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, please contact us and we will delete it.

11. Changes to This Notice

We may update this Privacy Notice from time to time. We will notify you of material changes by posting the updated notice within Huddle or by email. The "Last updated" date above reflects the most recent revision.

12. Contact Us

If you have questions about this Privacy Notice or your data, please contact:

Wyvern Studio Ltd
Email: privacy@huddle.app