Privacy Policy

1. Who we are

Stag Vault is a trading name of Homeguard Developments Ltd, a company registered in England and Wales. Our registered office is 3rd Floor, 86–90 Paul Street, London, England, EC2A 4NE.

For privacy questions or to exercise your data rights, email hello@stagvault.co.uk. For company-level enquiries: info@homeguarddevelopments.co.uk.

2. What we collect

• Account data — name, email, hashed password, role, subscription tier. Used to authenticate and entitle you to features.
• Usage data — prompts you run, tracks completed, favourites, streaks. Used to deliver the product features you signed up for.
• Payment data — handled by Stripe. We store Stripe customer IDs and transaction IDs only; we never see or store your card details.
• Newsletter opt-ins — email + source (e.g. footer, exit-intent). Used only to send the Friday Drop newsletter.
• Anonymous analytics — page views, button clicks, performance metrics via PostHog. Only collected if you accept cookies.
• Server logs — IP address, browser, requested URL for ~30 days for security/abuse prevention.

3. Why we collect it (legal basis)

Under UK GDPR Article 6, we rely on:

• Contract (6(1)(b)) — to deliver the service you paid or signed up for.
• Legitimate interests (6(1)(f)) — minimal server logs and fraud prevention.
• Consent (6(1)(a)) — newsletter signups and non-essential analytics cookies.
• Legal obligation (6(1)(c)) — tax records (kept 7 years per HMRC).

4. Who we share with

• Stripe — payment processor (privacy.stripe.com).
• Resend — transactional & newsletter email delivery (resend.com/privacy).
• PostHog — anonymous product analytics (posthog.com/privacy), only with consent.
• OpenAI / Anthropic / Google AI — when you run a prompt the prompt text is sent to the AI provider to generate a response. No personal account data is sent.
• Hosting provider — Emergent (managed infrastructure for stagvault.co.uk).

We do not sell your personal data. Ever.

5. How long we keep it

• Account data — until you delete your account, then within 30 days.
• Payment records — 7 years (HMRC requirement).
• Server logs — 30 days.
• Newsletter opt-ins — until you unsubscribe.
• Analytics — anonymised after 12 months.

6. Your rights

Under UK GDPR you have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your data (right to erasure / be forgotten)
• Restrict or object to processing
• Data portability (export)
• Withdraw consent at any time

Email hello@stagvault.co.uk to exercise any of these. We respond within 30 days.

If you believe we've mishandled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or call 0303 123 1113.

7. Cookies

We use one essential cookie for authentication (a JWT in an HttpOnly cookie — required for login). With your consent we also load PostHog for anonymous product analytics. You can change your choice anytime by clearing site data in your browser.

8. International transfers

Some of our processors (Stripe, OpenAI, Anthropic, Google) are based outside the UK. We rely on UK GDPR-approved transfer mechanisms (Standard Contractual Clauses + adequacy decisions where they apply).

9. Changes to this policy

We'll update this page if anything material changes. The “last updated” date at the top will reflect the most recent revision.