This is a detailed starting-point draft, not legal advice. If you have or expect users in the EU/UK, California, or anywhere else with specific privacy law (GDPR, CCPA/CPRA, etc.), have a lawyer confirm this actually complies — those laws have specific requirements (like a legal basis for processing, or a "Do Not Sell" mechanism) that a generic template can't guarantee you meet.
Fill in every [bracketed placeholder] before publishing this for real.
Privacy Policy
Last updated: 4 September 2026
Company details
Badeca Springs Ltd, a company registered in England and Wales.
Registered office: 16 Queen Street, Bude, Cornwall, EX23 8BB, United Kingdom.
As a UK company, we're subject to UK GDPR and the Data Protection Act 2018 for the personal data we process.
Who this policy covers
This policy explains what Badeca Springs Ltd ("Zenith," "we," "us") collects from people who create an account and use Zenith ("users"), and separately, from people who visit an app a user has published ("visitors") — those are different groups with different data collected about them, covered separately below.
What we collect from account holders
Your email address, the prompts you send and the app code generated from them (stored so your projects persist), and basic usage events (like when you generate an app or upgrade a plan) so we can operate, secure, and improve the product.
What we collect from visitors to published apps
When a user publishes a project to a live URL, we record basic traffic data for that URL: referring source and whether the visit was from a desktop or mobile device. We do not use cookies, do not store IP addresses, and do not attempt to identify individual visitors. This data is shown to the app's owner in their stats dashboard.
What we don't collect
We don't collect payment card details directly — those are handled by Stripe, our payment processor, under their own privacy policy. We don't sell personal information to third parties.
How we use it
To provide the service (generating and saving your apps, running publish/domain features), to process payments, to respond to support requests, to detect and prevent abuse, and to understand usage patterns so we can improve the product.
Legal basis for processing (UK GDPR)
Because Badeca Springs Ltd is UK-registered, UK GDPR applies to our processing of your personal data regardless of where you're based. Our legal basis for each category: account and billing data — performance of a contract (we need it to provide the service you've signed up for); basic usage events and published- app visitor data — legitimate interests (operating, securing, and improving the product, and providing you with stats about your own published apps). [A lawyer should confirm this characterization is complete and correctly documented — this is a reasonable starting position, not a substitute for a proper legitimate-interests assessment where required.]
Who we share it with
Service providers that make the product work: Supabase (hosting your account and data), Stripe (payments), Anthropic (the AI model that generates app code from your prompts — your prompts and existing project code are sent to Anthropic's API to generate a response), and Vercel (hosting for published apps and connected domains). We may also disclose information if required by law or to protect the rights, safety, or property of Zenith or others.
Data retention
We keep your account data for as long as your account is active. If you delete your account, we delete your profile, projects, and associated data, and take down anything you'd published, within 30 days. [Confirm this matches what your account-deletion flow actually does technically — the self-service deletion in the app runs immediately, so this is likely accurate, but verify rather than assume.]
Your rights and choices
You can delete individual projects from your dashboard at any time, and delete your entire account and all associated data from the account settings — this is immediate and permanent. Depending on where you live, you may also have rights to access, correct, or export your data, or to object to certain processing; contact badecaspringsltd@gmail.com to exercise these.
Cookies
We use a session cookie to keep you signed in — that's it; we don't use tracking or advertising cookies on the Zenith app itself. [If you add analytics tooling later that uses cookies, update this section and your cookie consent mechanism accordingly.]
Children's privacy
Zenith isn't directed at children under 16, and we don't knowingly collect personal information from them. Contact us if you believe a child has created an account so we can remove it.
International data transfers
This applies to you: our infrastructure providers (Supabase, Vercel, Anthropic, Stripe) may process data outside the UK, including in the United States. Where we transfer personal data outside the UK, we rely on appropriate safeguards such as the UK's International Data Transfer Addendum or providers' participation in recognized data protection frameworks. [A lawyer should confirm the actual transfer mechanism each specific provider uses — this varies by provider and can change, so it needs verifying against their current terms rather than assumed.]
Security
We use industry-standard practices (encrypted connections, row- level access controls on our database) to protect your data, but no method of transmission or storage is 100% secure, and we can't guarantee absolute security.
Changes to this policy
We may update this policy as the product changes. For material changes, we'll make reasonable efforts to notify you before they take effect.
Contact
Questions about this policy: badecaspringsltd@gmail.com.