Legal

Privacy Policy

Effective 10 September 2026

This policy explains how AI Deflag collects and uses personal information when you use the website, create an account, process media, or subscribe. For privacy questions or requests, contact admin@kcdsconnect.uk.

Information we collect

• Account information: your email address, a salted password hash, account status, and essential session information. We do not store your plain-text password.
• Subscription information: Stripe customer and subscription identifiers, subscription status, payment event identifiers, and the email used at checkout. Stripe processes your payment-card details; AI Deflag does not store them.
• Media and job information: files you upload, metadata and analysis settings you request, temporary output files, derived detection reports, job status, processing duration, processing route, error status, and secure download information.
• Usage and technical information: quota records and normal server logs, which may include an IP address, an IP-derived country code supplied by our trusted delivery provider, browser information, timestamps, and requested URLs. We use the country code to enforce geographic availability. For an anonymous daily allowance, the app uses a keyed hash derived from the IP address rather than storing that address in the quota record.

Why we use it

We use this information to provide and secure the service, authenticate users, process and return media, enforce usage allowances, administer subscriptions, prevent abuse, diagnose faults, and meet legal obligations. Our lawful bases are performance of our contract with you, our legitimate interests in operating a reliable and secure service, and compliance with legal obligations where applicable.

Cookies

AI Deflag uses an essential, signed, HTTP-only session cookie to keep you signed in. It is required for account access and is not used for advertising. The app does not include advertising or analytics cookies.

Sharing and service providers

We share information only where needed to operate the service: with Stripe for checkout, payment, and subscription administration; with our hosting and infrastructure providers for storage and delivery; with professional advisers where necessary; or with authorities when the law requires it. Those providers process information under their own terms and privacy obligations.

International processing

Some service providers may process information outside the United Kingdom. Where this occurs, the provider's applicable transfer safeguards and contractual protections are used.

How long we keep information

• Uploaded and generated media is temporary and is automatically removed after the server's configured job-retention period. The current standard deployment uses approximately three hours.
• A metadata-only job history containing account or anonymous-session category, original filename, file sizes, selected processing operations and outcomes, status, timing, media type, processor route, and bounded error text is retained for approximately 30 days for service administration. It does not retain the media file.
• Download links expire after the configured download period, normally 15 minutes.
• Daily allowance records are kept only as needed to enforce the allowance, and old daily records are removed automatically.
• Account and subscription records are kept while needed to provide the account and for reasonable security, dispute, accounting, and legal periods afterward.
• Server logs are retained according to the hosting provider's operational and security schedule.

Security

We use measures including salted password hashing, signed sessions, isolated account jobs, expiring downloads, restricted file handling, and verified Stripe webhook signatures. No internet service can guarantee absolute security.

Your rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict, object to, or receive a portable copy of your personal information. Contact us to exercise a right. You may also complain to the UK Information Commissioner's Office at ico.org.uk.

Changes to this policy

We may update this policy when the service, providers, or legal requirements change. The effective date above identifies the current version.