Privacy Policy
Last updated: [date]
This Privacy Policy explains how [Your Company] Ltd (“Montage”, “we”, “us”, “our”) collects and uses your personal data when you use the Montage app and website at [your-domain] (together, the “Service”).
We are the data controller for the personal data described in this policy. If you have any questions or want to exercise your rights, contact us at [privacy@your-domain].
We take your privacy seriously and only collect the data we genuinely need to run the Service. We do not sell your data, and we do not use advertising, analytics or third-party tracking cookies.
1. The personal data we collect
We collect only what the Service needs to work:
When you create an account
- Your email address. We use a passwordless sign-in (“magic link”), so we do not store a password. Your email is how you sign in and how we contact you about your account.
When you use the app
- Your training progress. Which challenges and workouts you’ve started or completed, your streak, completion counts, XP/level and kit preferences — so your progress follows you across devices.
When you subscribe to Montage Pro
- Subscription and billing status. We store a customer reference and your subscription status (e.g. active or cancelled) so we know whether to unlock Pro. We never see or store your card details — all payments are handled directly by Stripe (see section 4).
If you join the personalised-plans waiting list
- Your email address, so we can let you know if and when that feature launches. This is optional and based on your consent, which you can withdraw at any time.
Automatically, for security
- Standard technical data our hosting providers process to keep the Service secure and running (e.g. IP address and request logs). We do not use this to build a profile of you.
We do not collect special-category data (such as health records). The pre-exercise safety questions shown when you first open the app are answered privately on your own device — your answers are not sent to us or stored by us.
2. How and why we use your data (lawful bases)
Under the UK GDPR we must have a lawful basis for using your data. Ours are:
| What we do | Why | Lawful basis |
|---|---|---|
| Create and run your account; save and sync your progress | To provide the Service you’ve asked for | Performance of a contract |
| Take payment and unlock Pro; keep transaction records | To provide the subscription and meet tax/accounting duties | Contract and legal obligation |
| Keep the Service secure and prevent abuse | To protect users and the Service | Legitimate interests |
| Send essential service messages (sign-in links, subscription changes) | To operate your account | Contract |
| Add you to the personalised-plans waiting list and email you about it | You asked to hear about it | Consent |
Where we rely on legitimate interests, we’ve balanced our interests against your rights and privacy. You can object at any time (see section 7).
3. Marketing
We only send you marketing (such as news about new features) if you’ve opted in. Every marketing email has an unsubscribe link, and you can opt out any time by emailing [privacy@your-domain]. Essential service messages — like your sign-in link or a failed-payment notice — are not marketing and will still be sent while you have an account.
4. Who we share your data with
We use a small number of carefully chosen service providers (“processors”) who process data on our behalf under contract and may only use it to provide their service to us.
- Supabase — hosts our database and manages sign-in (your email, progress and subscription status). Our production database is hosted in the UK/EU region.
- Stripe — processes all payments and manages subscriptions. You provide payment details directly to Stripe; we receive only a customer reference and your subscription status. Stripe is a certified PCI-DSS Level 1 provider. See stripe.com/privacy.
- [your email provider] — delivers our sign-in and account emails.
- Vercel — hosts and serves the app.
We may also disclose data if required by law, to establish, exercise or defend legal claims, or in connection with a sale or reorganisation of the business (in which case we’ll tell you). We do not sell your personal data or share it with advertisers.
5. International transfers
Our production database and email delivery are based in the UK/EU. Some providers (such as Stripe) may process data outside the UK. Where they do, we rely on appropriate safeguards recognised under UK data-protection law — such as the UK International Data Transfer Agreement or Addendum, or an adequacy decision — so your data keeps an equivalent level of protection.
6. How long we keep your data
- Account data (email, progress, subscription status): for as long as your account is active. If you delete your account we delete this data, except where we must keep some information to meet a legal duty.
- Transaction records: we and Stripe keep records of payments for as long as tax law requires (generally six years in the UK).
- Waiting-list email: until the feature launches or you ask us to remove you, whichever comes first.
- Security logs: kept only for a short period, then deleted.
7. Your rights
Under the UK GDPR you have the right to:
- Access the personal data we hold about you;
- Rectify data that’s inaccurate or incomplete;
- Erase your data (“right to be forgotten”);
- Restrict or object to how we use it;
- Portability — receive your data in a portable format;
- Withdraw consent at any time, where we rely on consent; and
- Complain to the Information Commissioner’s Office (ICO).
To exercise any of these, email [privacy@your-domain]. We’ll respond within one month. Using these rights is free and you don’t have to give a reason. You can also delete your account and its data yourself at any time from within the app.
If you’re unhappy with how we’ve handled your data you can complain to the ICO at ico.org.uk, by phone on 0303 123 1113, or in writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We’d appreciate the chance to put things right first, so please do contact us.
8. Cookies and local storage
Montage does not use advertising, analytics or third-party tracking cookies, so there’s no cookie-consent banner to click through. We only use storage that’s strictly necessary or that makes the app work:
| What | Purpose | Type |
|---|---|---|
| Sign-in token (Supabase) | Keeps you signed in securely | Strictly necessary |
| Payment/session (Stripe) | Processes payments and helps prevent fraud during checkout | Strictly necessary |
App state (montage_state_v2, in your browser) | Remembers your progress and preferences on this device, including when you’re not signed in | Functional |
Because these are strictly necessary or functional, UK law (PECR) doesn’t require your prior consent — but we’re telling you about them so you know exactly what’s stored. You can clear this storage any time in your browser settings, though doing so will sign you out and clear any guest progress on that device.
9. Children
Montage is not intended for children under 16, and we don’t knowingly collect data from anyone under 16. If you believe a child has given us their data, contact [privacy@your-domain] and we’ll delete it.
10. Changes to this policy
We may update this policy from time to time. If we make a significant change we’ll let you know (for example by email or an in-app notice) before it takes effect. The “last updated” date at the top always shows the current version.
11. Contact us
[Your Company] Ltd
Registered in England and Wales, company number [company number]
Registered office: [registered office address]
ICO registration: [ICO registration number]
Email: [privacy@your-domain]