Privacy policy
This explains what personal data we collect when you use Authority or visit our site, why, who we share it with, how long we keep it, and your rights. If you came here because you signed up to someone's webinar, read section 9 first.
1. Who's responsible
DRAFT: seller's legal name, trading as Authority, DRAFT: address line 1, DRAFT: town, postcode, United Kingdom is the controller of the data in this policy. Contact: support@useauthority.live.
2. What we collect
- Your account: your name, business name, email address and password (stored only as a scrambled hash we can't read back), your team's names and emails, and your settings.
- Signing in: when you and your team sign in, from which internet address, and a short description of the device and browser. We use this for security and so you can see and end your sessions.
- Agreeing to terms: which version of our terms and billing terms you accepted, when, and from which internet address.
- Billing: your plan, invoices and payment status, and the customer number Stripe gives us. Stripe holds your card. We never see the full number.
- Usage: webinars you run, how many people came, watching hours, AI use. We use this to bill you, to keep within plan limits, and as evidence if a payment is ever disputed.
- Support: what you send us, and a log of every time our support opens your account (which you can see too).
- Sign-up check: Cloudflare's bot check on our sign-up form looks at your browser to tell people from bots.
- Our public site sets no cookies and runs no analytics or advertising trackers.
3. Why we use it, and our lawful basis
| What for | Lawful basis (UK and EU GDPR) |
|---|---|
| Running your account, billing you, sending account emails (verification, password reset, receipts, renewal and usage warnings) | Contract |
| Security: sign-in limits, bot checks, sign-in records, our support access log | Legitimate interests (keeping accounts and the service safe) |
| Keeping usage records to answer payment disputes | Legitimate interests |
| Keeping invoices and payment records | Legal obligation (tax law) |
| Telling you about important changes to Authority or these policies | Contract and legitimate interests |
We don't sell personal data, and we don't send you marketing unless you've agreed to it.
4. Who we share it with
Only the companies that help us run Authority, under contracts that limit what they can do with it:
| Company | What they do for us | Where |
|---|---|---|
| Contabo | Servers that run the app and its database today | Germany |
| Hetzner | The dedicated server the app is planned to move to before launch (planned) | Germany or Finland |
| Bunny (bunny.net) | Delivers live and recorded video to viewers; planned home for recordings | Slovenia, with delivery points worldwide |
| Cloudflare | Domain names (DNS) and the bot check on our sign-up form | United States, worldwide network |
| Resend | Sends emails: account emails, and webinar reminders and follow-ups for our customers | United States |
| Bird | Sends text messages, only for customers who switch texts on (only when texts are switched on) | Netherlands |
| Anthropic | The AI model behind the AI features (chat moderation, question sorting, lead notes, the design assistant) | United States |
| Encrypted nightly backups (Google Drive) | United States and EU | |
| Stripe | Takes our customers' subscription payments; stores card details (we never see full card numbers) | Ireland and United Kingdom |
We also share data if the law makes us, or to protect our rights or someone's safety.
Things we do on our own servers, without sending data to anyone: turning recordings into text, and working out a visitor's country from their internet address (using the free country database from DB-IP, licensed CC BY 4.0).
5. Data outside the UK
Our servers are in Germany. Some of the companies above are in the United States. Where data leaves the UK or the EU, we rely on the safeguards the law allows, such as the UK-US data bridge, the EU-US Data Privacy Framework, or standard contract clauses.
6. How long we keep it
- Account data: while your account is open. When it's closed, 30 days (so you can reopen it), then deleted.
- Backups: encrypted, kept for a few weeks, then overwritten. Deleted data leaves the backups when they roll off.
- Invoices and payment records: 6 years, because UK tax law says so.
- Sign-in records and usage records: while your account is open, and up to 13 months after a payment in case it's disputed.
7. Your rights
You can ask to see, correct, delete or move your data, or object to how we use it. Account → Download everything gives you a full copy at any time. To use any right, email support@useauthority.live. We'll answer within a month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk), or your own country's data protection authority.
8. Cookies
The app uses only the cookies it needs to work, such as keeping you signed in. The list is in our cookie notice.
9. If you signed up to a webinar run on Authority
The business that runs the webinar decides what happens to your details. They're the controller. We store and process your details for them, as their processor. That includes your name, email, phone number if asked for, answers on the sign-up form, what you write in chat or questions, when you watched, your country, and, if you're on camera or speak in a recorded webinar, the recording. The business's own privacy policy, linked from its sign-up page, explains how they use them. To use your rights, contact that business. It can delete everything tied to your email address itself, in Authority, and download a copy for you first (our encrypted backups still hold it for a few weeks, until they roll off). If you contact us, we'll pass your request to them.
10. Children
Authority isn't for anyone under 18, and we don't knowingly collect their data.
11. Changes
If we change this policy in a way that matters, we'll email account owners and update the date at the top.