Privacy Policy

This policy explains how Substrate handles personal data when you use our websites, accounts, the Substrate dashboard, databases, storage, realtime services, workflows, machines, AI services and developer tools (the “Services”).

Substrate is a trading name used by the individual operating the Services. That operator is the controller of personal data used for Substrate's own account, billing, security and business purposes. You can contact us at substrate@gdrl.dev.

This policy does not cover third-party products, integrations or websites, which operate under their own privacy terms.

If a customer uses the Services to process personal data in its applications, databases or other content submitted to the Services (“Customer Data”), that customer normally decides why and how the data is used. The customer is responsible for its privacy notices, permissions, lawful bases, instructions and responses to the people whose data it controls.

Substrate normally processes that data as a service provider on the customer's instructions. Substrate may act as a controller where we use information for our own disclosed purposes, including account administration, billing, security, abuse prevention, legal compliance and eligible Free-plan product-improvement uses.

If your personal data was submitted to Substrate by one of our customers, please contact that customer first. We may refer your request to them or assist them where required by law.

Depending on how you use Substrate, we may collect:

• account, contact, authentication and workspace membership information;
• plan, billing, transaction and usage information;
• device, browser, IP address, request, route, diagnostic, security and activity logs;
• support messages, feedback and other communications;
• Customer Data, prompts, context, AI outputs and tool activity submitted through the Services; and
• cookies, session data and similar information needed to operate the Substrate dashboard.

We receive data directly from you, from workspace administrators and users, from systems connected to the Services, automatically through your use, and from service providers such as authentication and payment providers.

We may use personal data to:

• provide accounts, Services, support, billing and requested features;
• authenticate users and administer workspaces, projects and branches;
• secure, monitor, troubleshoot and improve the Services;
• detect fraud, abuse, unlawful activity and violations of our terms;
• measure performance and understand how the Services are used;
• communicate service, security, billing and product information;
• comply with law and establish, exercise or defend legal claims; and
• complete a financing, reorganisation or transfer of the Services.

Our lawful bases may include performing our contract with you, complying with legal obligations, your consent where required, and our legitimate interests in operating, securing, improving and protecting Substrate and its users. Where we rely on legitimate interests, we consider whether those interests are outweighed by your rights.

On the Free plan, we may use Customer Data, prompts, outputs, usage information, diagnostics and logs to operate and secure Substrate, perform analytics, improve our products, and train or evaluate models owned by Substrate. Do not submit personal or confidential data unless you have the authority and lawful basis needed for these uses.

An eligible paid workspace may provide a setting that disables certain product-improvement uses. Operational, billing, fraud-prevention and security logs may still be processed where necessary. The absence of a product setting does not remove any legal right to object or withdraw consent. If we cannot provide a Free plan without the processing to which you validly object, we may restrict or end that Free-plan access.

We may share data with hosting, cloud, database, model, analytics, security, communications, support, authentication and payment providers where needed for their services. We may also share data with professional advisers, insurers, authorities or other parties where reasonably necessary to comply with law, protect rights and safety, investigate abuse, enforce our terms, or complete a business transfer.

Data is also made available to workspace members, integrations and other recipients according to your configuration and instructions. You are responsible for those choices and for agreements you make with third parties.

We keep personal data only for as long as reasonably needed for the purposes above, taking account of account status, customer instructions, contractual commitments, backup cycles, security, billing, disputes and legal requirements. Retention periods therefore vary by data type and context.

Closing an account does not require immediate deletion from backups, security logs or records we must retain. We may keep genuinely anonymised or aggregated information that no longer identifies a person. Customers are responsible for exporting and independently backing up Customer Data before deletion or termination.

Depending on where you live and the circumstances, you may have rights to access, correct, erase, restrict or receive personal data, object to processing, and withdraw consent. These rights are not absolute, and legal exceptions may apply. We may need to verify your identity before acting on a request.

Send requests to substrate@gdrl.dev. You may also complain to the UK Information Commissioner's Office or your local data-protection authority. We do not currently use personal data to make solely automated decisions that have legal or similarly significant effects about you.