Privacy policy

This policy covers studios.daccaa.com: this website, and the feedback our apps send to it. Each app has its own privacy policy covering what happens on your device; where one exists it is linked from that app's page.

Who we are

This site is operated by DACCAA Ltd, a company registered in England and Wales (company number 14639674), at 11 Othello Close, Stafford, ST17 9ZN, England. For data protection purposes DACCAA Ltd is the controller. Email [email protected] with anything to do with this policy.

What we collect

Reading the site asks nothing of you. We only hold something about you if you send us a message, send feedback from an app, or choose to sign in. We also count two things that carry nothing about you at all, and like any web server ours keeps short-lived access logs.

When you send us a message

The contact form asks for your name, email address, what the message is about, which app it concerns and the message itself. We store all of it so we can reply and keep the conversation in one place, along with our replies. We also store your browser's user agent string and a hash of your IP address, never the address itself, to spot abuse of the form. The hash is made with a secret key held only on our server, so it cannot be turned back into an IP address.

We email you an acknowledgement and each reply we write. Those emails come from an address nobody reads, so they contain a link to the conversation on this site instead, where you can read and answer it. That link works for 120 days after our last message and only opens that one conversation. If you open it after it has expired, we email a new link to the address the conversation was sent from; we never send it anywhere else.

When you sign in

Signing in is never needed to get help. If you choose to, you sign in with Gate.haus, DACCAA's own sign-in system, which all our products use. It is run by us, so nothing about your account passes to anyone else. It tells this site your name, email address, username, profile picture and Gate.haus account number, and gives us a token to check you are still signed in. We keep those in your session while you are signed in, and store your account number against your messages so you can see them together at /account. When you sign in, messages you sent earlier from the same email address are joined to your account too. A sign-in lasts at most 30 days.

When you send feedback from inside an app

If you use the feedback option inside one of our apps, the message comes to the same place. Alongside what you wrote, the app sends its version and build number, your device model, your iOS version and your locale, so that a bug report arrives with the detail needed to reproduce it. You can include your email address if you want a reply. If you are signed in to Gate.haus in the app, the message is joined to your account. With neither, the feedback is anonymous to us.

When you rate a guide

Each guide asks whether it was helpful. A yes or no is stored with the guide it was about and the time, and nothing else: it is not linked to your name, your IP address, your session or an account. If you say no and tell us what was missing, that note reaches us the same way as a message from the contact form, with your email address if you chose to give one, and is kept the same way.

When a search of the guides finds nothing

If a search of the guides finds nothing, we keep the words that were searched for and a count, so we know which guide to write next. We do not keep who searched, their IP address or anything that could identify them. To stop one visitor inflating that count, a keyed hash of the IP address is held separately for at most a day, and then deleted.

Server logs

Our web server records each request it answers: the IP address, the time, the page asked for and the browser's user agent. We use these only to keep the site running and secure, and they are deleted after 7 days.

Cookies and other third parties

We set one cookie, studios_session. It keeps our forms secure against forgery and, if you sign in, keeps you signed in. It is strictly necessary, holds no tracking information, and is deleted when you close your browser. We do not use any other cookies or browser storage.

Two things on the site involve another company, and only when you use them:

• Bot protection. The contact form, and the box for telling us what a guide was missing, use Cloudflare Turnstile to check you are a person. It only loads on those forms.
• Videos. Where a guide includes a video, the preview image is served by this site, so nothing is requested from YouTube or our video host until you press play. Then the player loads from them: for YouTube, from youtube-nocookie.com, its privacy-enhanced mode, under YouTube's own privacy policy.

What we do not do

• We do not run analytics on this site. There is no Google Analytics, no Meta pixel and no advertising tag.
• We do not sell, rent or share your details with anyone for marketing.
• We do not add you to a mailing list because you contacted us.
• We do not pass anything you send us to an AI service, or use it to train one.

Who processes it for us

The site, its database and its backups run on a server we rent from Hetzner in Falkenstein, Germany. Traffic passes through Cloudflare, which also provides the bot protection described above and stores the images on the site. Cloudflare's network is global, so a request may be handled at a data centre outside the UK. Email is sent with Amazon Web Services (SES) from its London region. Each of these processes data on our instructions only.

We use an AI service, reached through Cloudflare, to help us draft our own guides and app pages and to describe images we upload. It is given our own writing and our own images, never anything you send us.

How long we keep it

Messages are kept for three years from the last activity on the conversation, so that we can pick up a thread if you come back to us. Anonymous in-app feedback, with no email address and no account, is kept for two years. Both are deleted automatically when that time is up.

Rate-limiting records, including the keyed hashes of IP addresses they hold, are deleted within a day. Server logs are deleted after 7 days. Guide ratings and searched-for words identify nobody, so we keep them for as long as they help us improve the guides.

The site and its database are backed up each night, and each backup is kept for 30 days. Something deleted from the site is therefore gone from the backups within 30 days too.

Your rights

Under UK GDPR you can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, or object to us holding it. Email [email protected] and we will deal with it within a month. You can sign out at any time, and ask us to unlink your messages from your Gate.haus account. If you are not happy with how we handle any of this you can complain to the Information Commissioner's Office at ico.org.uk.

Our lawful basis

When you contact us, or send feedback from an app, we process it on the basis of legitimate interests: you asked us something, and replying to you is the obvious interest on both sides. When you sign in, we use what Gate.haus gives us to provide the account you asked for. Keeping hashed IP addresses, server logs and bot protection to stop abuse of the site is also a legitimate interest. The session cookie is strictly necessary, so it does not need your consent.

Changes

If this policy changes in a way that matters, the date at the top changes with it. We do not quietly rewrite history.