UniDoodle is operated by [PLACEHOLDER — legal entity name], registered in [PLACEHOLDER — country of incorporation] under company number [PLACEHOLDER]. Registered office: [PLACEHOLDER — address].

Data protection contact: privacy@unidoodle.com.

• Account details (name, email, role, country, and — for organisations — school name and job title).
• Learning data (questions attempted, answers submitted, images or sketches uploaded, progress and feedback).
• Billing metadata processed by Stripe (we do not store card numbers).
• Basic technical logs (IP, browser, referrer) used to keep the service reliable and secure.

• To provide the service you signed up for and improve feedback quality.
• To manage subscriptions, trials and referral credits.
• To communicate essential service messages (verification, receipts, changes).
• To detect abuse and keep student data safe.

We rely on: contract (to deliver the service you asked for), legitimate interests (product improvement, security, fraud prevention), consent (optional analytics cookies) and legal obligation (tax and accounting records).

UniDoodle is designed for learners aged 12+. Where students under the age of digital consent in their jurisdiction use the service through a school or organisation, we rely on that organisation to obtain the necessary parental consent. [PLACEHOLDER — final age gating and consent model].

We share data only with vetted subprocessors that help us run the service: hosting and database (Lovable Cloud / Supabase), email delivery (Resend), payments (Stripe), and AI model providers used for feedback. A current subprocessor list is available on request from privacy@unidoodle.com.

Account data is retained for the life of your account and [PLACEHOLDER — retention window, e.g. 12 months] after deletion for legal and dispute-resolution purposes. Billing records are retained for the period required by tax law.

You may request access, correction, deletion, portability, or objection to processing. Contact privacy@unidoodle.com. You also have the right to lodge a complaint with your local supervisory authority (e.g. the Irish DPC or UK ICO).

Some subprocessors are based outside the UK/EEA. Where required we rely on Standard Contractual Clauses. [PLACEHOLDER — confirm transfer mechanisms per subprocessor].

We'll update this policy when the service or the law changes. Material changes will be notified by email or in-app before they take effect.