Privacy Policy

What we collect

• Account details: your email address and sign-in method (email/password or Google).
• Profile information you choose to add, such as name, username, skills, interests and location.
• What you contribute: problems, solutions, comments, team messages, tasks, files, test results and impact reports.
• Messages you send through the contact form.
• Preferences such as theme and appearance settings, stored in your browser and, when signed in, your account.
• Direct messages, message requests, blocks and abuse reports; account activity, credit balances and subscription identifiers.
• Technical information needed for security and troubleshooting, such as IP addresses, browser/device information and error logs. Contact-form abuse prevention stores a hashed sender identifier.

How it is used

• To run the platform: review submissions, match people to problems, coordinate teams and record verified outcomes.
• Text from problems and solutions may be processed by an AI service to produce research summaries for reviewers. AI never makes official decisions.
• To send in-app notifications about work you are involved in.

We do not sell your information and we do not show advertising.

Who can see what

• Public: verified problems, verified solution and impact records, organisation pages marked public, and profile fields you make public.
• Private: drafts and submissions under review, team chats, files and evidence, invitations, notifications and account settings — visible only to you, your team where relevant, and ProblemBank reviewers.
• These limits are enforced by the platform's database permissions, not just hidden in the interface.

Legal bases for processing

• Contract performance: account and profile details, contributions, team work, messages and billing identifiers are processed to provide the service you request.
• Legitimate interests: security information, abuse reports and support messages help protect users, prevent fraud, troubleshoot and respond to inquiries. We balance these interests against your rights.
• Consent: where required, optional processing or disclosures rely on your consent, which you may withdraw without affecting earlier lawful processing.
• Legal obligations: records needed to meet applicable legal, accounting or regulatory duties.

Service providers and payments

We share data needed for the service with hosting, authentication, storage, AI and support providers, including Lovable Cloud and its infrastructure providers. AI providers receive the information necessary for the requested research or assistance; AI never makes official decisions.

Paddle is our reseller and Merchant of Record, not merely a payment processor. We share necessary account and order identifiers with Paddle for product sales, subscription management, payments, tax compliance and invoicing. Paddle handles checkout information under its own Privacy Notice.

We may share relevant information with professional legal or accounting advisers, or authorities where legally required. We do not sell personal information.

Retention

Account and profile information is kept for the duration of your account. You can request account deletion in Settings. Contributions and shared team history may remain where needed to preserve collaborative records, subject to applicable deletion rights.

Support messages are retained while an inquiry remains open and for as long as follow-up or dispute handling reasonably requires. Security, moderation and audit records are kept while needed to investigate abuse and protect the service. Billing records are retained for the period required by applicable tax and accounting law. We delete or anonymise personal data when these purposes no longer require it; backup copies may remain until their normal replacement cycle.

Security and international processing

We use appropriate technical and organisational measures, including encrypted HTTPS connections, authenticated access, database-level access controls and restricted staff access. Private files use controlled access. No internet service can guarantee absolute security; direct messages are not end-to-end encrypted.

Our providers may process data outside your country, including outside the UK or EEA. Where applicable law requires safeguards for international transfers, we rely on applicable adequacy decisions or contractual safeguards such as Standard Contractual Clauses.

Cookies and browser storage

Essential storage supports sign-in, security and interface preferences, including theme and sidebar settings. We do not currently use advertising or marketing cookies in the application. Paddle may use its own cookies during checkout, as described in its notice. You can clear or block cookies and browser storage in your browser settings, but sign-in and saved preferences may stop working. We will seek consent for non-essential analytics or marketing cookies where required before introducing them.

Your choices

• Edit your profile and visibility settings at any time in Settings.
• Delete your account from Settings. Shared team history may be retained without your personal details.
• Ask a privacy question through the contact form.

Depending on applicable law, you may request access, correction, erasure, restriction, portability, or object to processing, and withdraw consent. UK/EEA users also have the right to complain to their data protection supervisory authority. We respond to applicable GDPR requests within one month, subject to lawful extensions with notice. Use the contact form; we may need to verify your identity.

Changes

If this policy changes, we will update this page and the date above.