Privacy Policy
Last updated: 16 June 2026
This Privacy Policy explains how PewPlan (“we”, “us”, “our”) collects, uses, shares and protects personal data when you use the PewPlan website and services (the “Service”). We comply with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
1. Who we are
PewPlan is the controller of personal data relating to your account and your use of the Service. If you have any questions about this policy or how we handle your data, contact us at support@pewplan.app.
Controller vs processor. When you or your Organisation add information about other people as part of your content (for example the names of service participants or a roster), your Organisation is the controller of that data and we act as a processor, handling it only to provide the Service on your instructions. You are responsible for having a lawful basis and giving any required privacy notices to those individuals.
2. Personal data we collect
| Category | Examples |
|---|---|
| Account data | Your name, email address and profile image, received from your sign-in provider (e.g. Google) when you authenticate. |
| Organisation & content data | Organisation name and settings, programmes you create, song titles and lyrics, roster names, logos and media files you upload. |
| Billing data | Your Plan, subscription status and customer/subscription identifiers. Card payments are handled by Stripe — we do not store full card numbers. |
| Usage & technical data | Sign-in events, “last seen” timestamps, audit logs of changes to programmes, and limited analytics on public share links (a one-way hashed visitor identifier and visit date used to count unique views). |
3. How and why we use your data
We use personal data for the following purposes, relying on the following lawful bases under the UK GDPR:
- To provide the Service — creating your account, hosting your programmes and content, and enabling sharing and collaboration. Lawful basis: performance of a contract.
- To process payments and manage subscriptions. Lawful basis: performance of a contract.
- To secure and maintain the Service — authentication, preventing abuse, keeping audit logs, and counting unique views via a hashed identifier. Lawful basis: our legitimate interests in operating a secure and reliable service.
- To communicate with you — responding to support requests and sending essential service notices. Lawful basis: performance of a contract and legitimate interests.
- To comply with legal obligations — such as accounting and tax record-keeping. Lawful basis: legal obligation.
4. Who we share data with
We do not sell your personal data. We share it only with the service providers (sub-processors) that help us run the Service, each bound to protect it:
| Provider | Purpose |
|---|---|
| Authentication / sign-in | |
| Neon | Database hosting (your account, organisation and content data) |
| Supabase | Storage of uploaded media and logos |
| Stripe | Payment processing and subscription billing |
| Vercel | Application hosting and delivery |
We may also disclose data where required by law, to enforce our Terms of Service, or to protect the rights, safety and security of PewPlan, our users or the public.
5. International transfers
Some of our providers may process data outside the UK. Where personal data is transferred outside the UK, we rely on appropriate safeguards — such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses — to ensure your data remains protected.
6. How long we keep data
We keep personal data only for as long as necessary for the purposes above. Account and content data is retained while your account is active. If you delete content or close your account, we will delete or anonymise the associated personal data within a reasonable period, except where we must retain certain records (for example billing records) to comply with legal obligations. Hashed share-link visitor data is short-lived and used only to deduplicate view counts.
7. Your rights
Under the UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased (the “right to be forgotten”);
- restrict or object to certain processing;
- data portability — receive your data in a structured, commonly used format; and
- withdraw consent at any time where we rely on consent.
To exercise any of these rights, contact support@pewplan.app. Where we process data on behalf of your Organisation, please direct your request to that Organisation, and we will assist them in responding. We will respond within the time limits set by law.
8. Cookies and similar technologies
We use only cookies and similar storage that are strictly necessary to operate the Service — for example to keep you signed in and to maintain your session. We do not use advertising or third-party tracking cookies.
9. Children
The Service is not directed at children, and you must be at least 16 to create an account. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
10. Security
We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and use of reputable infrastructure providers. No system is completely secure, but we work to protect your data and to notify you and the relevant authority of any personal data breach where required by law.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will update the “Last updated” date above and, for material changes, take reasonable steps to notify you.
12. Contact and complaints
For any privacy question or request, email support@pewplan.app.
If you are unhappy with how we have handled your personal data, you have the right to complain to the UK’s supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk. We’d appreciate the chance to address your concerns first.