Privacy Policy

For the personal data of account holders (referred to as the "User" or "Coach"), the data controller is DevCode Ltd.

Entity: DevCode Ltd · Company no: 14284192 · Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom · Email: info@devcodeltd.co.uk

When a Coach collects data from visitors through their public page (e.g. via a contact form or booking), the Coach is the data controller for that visitor data and we act only as a processor on the Coach's behalf. See section 8 for this distinction.

To provide the service, we process the following categories of data:

• Account data: email address, display name, optional bio and profile image, account status and last login time. Your password is managed by our authentication provider (Google Firebase Authentication); we do not store your password.
• Subscription and payment data: your plan tier (Free/Pro/Business), subscription status and period dates, and the customer/subscription identifiers created by our payment provider, Stripe. We never see or store your card number; payment details are handled directly by Stripe.
• Content you publish: page title, bio, links, uploaded media (avatar/images), social handles and business details. This content is public to the extent you publish it.
• Visitor contact (lead) data: the name, email, phone and/or address a visitor enters into a contact or subscription form on a Coach's page. This data is stored only with the visitor's explicit consent (opt-in checkbox).
• Booking data: when a visitor books an appointment, their name, email, optional phone and note, and the appointment date/time.
• Analytics and technical data: page-view and click events, a non-identifying first-party visitor id (lh_vid), a salted hash of your IP address (raw IP is never stored), device type, operating system, browser, approximate country/city, and referrer and UTM parameters.

We process your data only for specific purposes and on a valid legal basis:

• To provide the service, manage your account and let you sign in — legal basis: performance of a contract.
• To charge and invoice subscription fees — legal basis: performance of a contract and legal obligation.
• To send transactional emails (password reset, booking confirmation/reminder, team invitation) — legal basis: performance of a contract and legitimate interests.
• To produce aggregated/anonymised analytics to improve, secure and prevent abuse of the service — legal basis: legitimate interests.
• To process visitor contact and booking forms — legal basis: the visitor's explicit consent (the Coach is the controller for such data).
• To comply with legal obligations and protect our rights — legal basis: legal obligation and legitimate interests.

We use a small number of cookies that are strictly necessary to run the service and remember your preferences. We do not use advertising or third-party tracking cookies.

To deliver the service we work with the trusted third-party providers below. Each accesses only the data needed to provide the service and is bound by contractual confidentiality obligations.

Our application database and uploaded files are hosted within the European Union (Germany). However, some of our service providers may be located outside the UK/EU.

When you use the AI Page Builder, the business details you enter (name, sector, phone, address, website) are transferred to DeepSeek (based in China) for content generation and to Perplexity (based in the US) for web search. This feature is optional; the transfer does not happen unless you use it.

Where relevant, transfers outside the UK/EU are protected by appropriate safeguards such as standard contractual clauses (SCC / UK IDTA). Please note that transfers to countries without an adequacy decision, such as China, may carry additional risk; consider this before entering sensitive business information into the AI Page Builder.

• Account and profile data: kept for as long as your account is active. When you delete your account, your account, sites, links, click records and collected leads are permanently deleted.
• Analytics events: automatically deleted 30 days after they are recorded (via a database TTL mechanism).
• Visitor lead and booking data: kept until the relevant Coach deletes it or closes their account.
• Invoice and transaction records: may be retained (by our payment provider) for the period required by applicable tax and commercial law.

When a Coach enables a contact form, subscription lock or booking on their public page, they collect personal data from their visitors. The Coach is the data controller for that visitor data; we store it only as a processor, on the Coach's behalf and instructions.

If you are a Coach, you are responsible for informing your visitors, obtaining any required consent, and processing the data you collect in line with KVKK/GDPR. If you are a visitor, requests about how your data is used should first be directed to the Coach who collected it.

Under UK GDPR and KVKK you have the following rights regarding your personal data:

• To request information about, and access to, the data we process,
• To request correction of inaccurate or incomplete data,
• To request erasure of your data (right to be forgotten),
• To request restriction of, or to object to, processing,
• To receive your data in a structured format (data portability),
• To withdraw any consent you have given, at any time,
• To lodge a complaint with a supervisory authority (UK: the ICO; Türkiye: the Personal Data Protection Authority, KVKK Kurumu).

We apply reasonable technical and organisational measures to protect your data: encryption in transit (HTTPS), keeping session tokens in server-only (httpOnly) cookies, using a salted hash instead of raw IP in analytics, per-account data isolation, and bot/spam protection on form submissions.

While no method is 100% secure, we strive to maintain industry-standard safeguards to protect your data.

The service is not intended for anyone under 18, and we do not knowingly collect personal data from people under 18. If we become aware that we hold data belonging to someone under 18, we will delete it.

We may update this Privacy Policy from time to time. For material changes we will update the "Last updated" date on this page and, where appropriate, notify you. The current version is always published on this page.