Privacy Policy & GDPR

Simifran (UK) Ltd t/a KbitNetwork ("we", "us") is the data controller for personal data processed through KbitPrompt. We are based in England and Wales. Contact our privacy lead at admin@kbitnetwork.uk.

This policy explains what we collect, why, how long we keep it, who we share it with and your rights under the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU GDPR.

• Account data: email address, hashed password (handled by our authentication provider), account ID, and — if you use Google sign-in — your Google name, email and profile image.
• Workspace data: the parameters you select, text you enter (lyric concepts, reference descriptors, vocal styles), reference URLs or audio files you provide, generated prompts, saved blueprints and titles.
• Usage data: monthly generation counts, plan and feature usage, timestamps.
• Guest abuse-prevention data: a one-way SHA-256 hash of your IP address used only to enforce the 5 free sandbox generations. We do not store your raw IP address for this purpose.
• Billing data: Stripe customer and subscription IDs, plan, status and renewal date. Card details are collected and held by Stripe, never by us.
• Support data: messages and details you send in support tickets or emails.
• Technical data: browser type, device, error logs and essential storage described in our Cookie Policy.

• Providing the Service, your account, generations and Prompt Vault — performance of a contract (Art. 6(1)(b)).
• Processing payments and managing subscriptions — contract and legal obligation (tax and accounting records, Art. 6(1)(c)).
• Enforcing usage limits, preventing fraud, abuse and prompt injection, and securing the Service — legitimate interests (Art. 6(1)(f)).
• Answering support requests — contract and legitimate interests.
• Service and welcome emails about your account — contract and legitimate interests.
• Optional marketing, and non-essential cookies — your consent (Art. 6(1)(a)), which you may withdraw at any time.

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

To generate prompts, your sanitised workspace parameters are sent to our AI model provider through a secure gateway. They are processed to return a result and are not used by us to train third-party models. Please do not include sensitive personal information (such as health data) in prompt fields.

We use carefully selected processors bound by contracts requiring them to protect your data:

• Lovable / Supabase — application hosting, database and authentication.
• AI model providers (e.g. Anthropic) via the Lovable AI Gateway — prompt generation.
• Stripe — payments, subscriptions, tax and fraud prevention.
• Google — optional sign-in if you choose it.
• Audio rendering providers — only if you use in-app audio rendering when available.

We do not sell your personal data. We may disclose data if required by law, to protect rights and safety, or as part of a business transfer under equivalent protections.

Some providers process data outside the UK/EEA, including in the United States. Where this happens we rely on UK adequacy regulations, the UK International Data Transfer Addendum or EU Standard Contractual Clauses, or equivalent safeguards.

• Account and workspace data: while your account is active, and deleted within 30 days of account closure.
• Guest IP hashes: up to 12 months.
• Billing records: 6 years, as required by UK tax law.
• Support tickets: up to 2 years after resolution.
• Security logs: up to 90 days.

Under UK GDPR you have the right to:

• access a copy of your personal data (subject access request);
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict or object to processing, including direct marketing;
• data portability — receive your saved prompts in a machine-readable format;
• withdraw consent at any time, without affecting earlier processing.

To exercise any right, email admin@kbitnetwork.uk or open a ticket in the Help Centre. We will respond within one month and may ask you to verify your identity. There is normally no fee.

If you are unhappy, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113, or your local supervisory authority if you are in the EU. We would appreciate the chance to address your concerns first.

We use encryption in transit (HTTPS), row-level access controls so each user can only access their own records, hashed credentials, server-side input sanitisation and rate limiting. No system is perfectly secure; we will notify you and the ICO of qualifying data breaches as required by law.

The Service is not directed at children under 18 and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

We will post updates here with a new date and notify you of material changes by email or in-app.