Privacy Policy

1. Who we are

Retempla is operated by [COMPANY NAME], [REGISTERED ADDRESS] ("we", "us"). For your account and usage data we are the controller under UK GDPR. For the content of the documents you upload we act as a processor on your behalf: your documents are yours, and we process them only on your instructions — that is, to perform the conversions you request.

2. What we process

• Account data — your email address. That is the only personal detail an account requires (sign-in is passwordless).
• Your documents — the templates and documents you upload, and the converted files, reports and workbooks produced from them.
• Operational records — an append-only audit log of account activity (sign-in requests, sign-ins, uploads, conversions, downloads, deletions) including timestamps and IP addresses, kept for security and accountability.
• Error reports — technical error details sent to our monitoring service, configured to exclude request bodies, cookies and personal data.

We do not sell your data, and we do not use the contents of your documents for anything other than the conversion you asked for. Your documents are never used to train AI models.

3. Lawful bases (UK GDPR)

• Performance of a contract — providing the service: processing your documents, sending sign-in links and service emails such as job-completion notifications.
• Legitimate interests — keeping the service secure: rate limiting, audit logging, error monitoring and abuse prevention.
• Consent — where we ask for it explicitly; you can withdraw it at any time.

4. Subprocessors

We use a small number of service providers to run Retempla. Each one sees only what its role requires:

We will update this list before adding or replacing a subprocessor that handles your data.

5. Retention

• Documents and converted results — deleted automatically after at most 30 days; every deletion is logged. You can delete files sooner at any time.
• Account data — kept until you delete your account, which removes your files and data immediately.
• Audit and security records — retained for as long as needed for security and legal accountability.

6. International transfers

Some subprocessors may process data outside the UK. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. [FOR LEGAL REVIEW: confirm the transfer mechanism for each subprocessor and the hosting region.]

7. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to processing based on legitimate interests. To exercise any of these, email [CONTACT EMAIL]. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

8. Security

How we protect your documents and account — including encryption, access controls, file isolation and automatic deletion — is described in detail on our security page.

9. Cookies

We set one essential cookie (docubrand_session) to keep you signed in. We use no analytics or tracking cookies, so there is no cookie banner to click.

10. Changes and contact

If we make material changes to this policy we will notify account holders by email. Questions and requests: [COMPANY NAME], [REGISTERED ADDRESS] — [CONTACT EMAIL].