Privacy by design
Privacy, GDPR & Data Security
Last updated 24 September 2026
We collect what is needed to operate your account, provide requested features, process payments, prevent abuse and meet legal obligations. We use layered account controls and give Notes users export and deletion tools.
Who controls your data?
3DJ is the controller for account, billing, support and product-service data. Contact privacy@3dj.co.uk for privacy requests.
What we collect
- Identity and account details, including name, email and acceptance records.
- Security data: hashed login codes and PINs, encrypted authenticator secrets, trusted-device token hashes, device/browser details, IP address and timestamps.
- Notes, reminders, attachments and settings when synchronised to the service.
- Audio, images and text deliberately submitted for transcription, translation or OCR.
- Payment records, product, amount, currency, coupons and Stripe references. Complete card details remain with Stripe.
- Support conversations, diagnostics, usage totals and service logs.
Why and on what lawful basis?
- Contract: account access, synchronisation, requested AI processing, licences, subscriptions, receipts and support.
- Legitimate interests: security, fraud prevention, reliability and troubleshooting.
- Legal obligation: accounting, tax, lawful requests and regulatory records.
- Consent: where a feature or communication specifically asks for it.
Security built into 3DJ
- HTTPS/TLS protects supported production traffic in transit.
- Notes, reminders, revisions, import batches and attachment names use application-level encryption with a separate random key for each account. Account keys are wrapped by a versioned master key kept outside the database.
- Notes attachments are encrypted before storage and decrypted only for an authorised download, export or user-requested AI operation.
- Verification codes and PINs are one-way hashed; authenticator secrets are encrypted at rest.
- Login and sensitive endpoints are rate limited; verification codes expire and have attempt limits.
- Notes offers optional authenticator 2FA, trusted-device controls, inactivity lock/logout and device revocation.
- Trusted-device raw tokens are not stored; only cryptographic hashes are retained.
- Access to notes and attachments is checked against the signed-in account.
- Stripe-hosted checkout keeps complete card data outside 3DJ systems.
- Unique transaction references protect against duplicate fulfilment and receipts.
- Notes users can export account data and delete Notes content through settings.
No internet service can guarantee absolute security. We improve controls according to risk, and users must also secure their email accounts and devices.
Processors and international transfers
We use service providers where needed, including hosting and email providers, Stripe for payments, and OpenAI for AI features you invoke. Submitted content may be processed by those providers under their applicable data-processing terms. Where data leaves the UK, we use an appropriate transfer mechanism where required.
Retention
We retain account and product data while the service remains active. Notes content is removed through the deletion workflow, subject to backups and legal requirements. Authentication records and logs are retained only as reasonably needed for security. Payment and accounting records are normally retained for the period required by UK tax and company law. Support records may be retained to resolve disputes and maintain an audit trail.
Your rights
Depending on the circumstances, UK GDPR gives you rights to access, correct, erase, restrict or object to processing, and receive portable data. You may withdraw consent and complain to the Information Commissioner’s Office. We may verify identity before acting.
Cookies and local storage
We use essential session, security, trusted-device and interface storage for sign-in, offline Notes operation and preferences. With permission, Google Analytics helps us understand visits, pages viewed, approximate location, device/browser information and interactions in aggregate. The Google tag is blocked and sends no data until analytics consent is granted; advertising storage and personalisation remain disabled. You may change or withdraw optional-cookie consent at any time through “Cookie settings”. Withdrawing consent disables further analytics collection and removes known first-party Analytics cookies where technically possible. It does not affect essential cookies required to provide a service you request.
Children and sensitive information
The service is not directed at children without appropriate adult involvement. Avoid unnecessary sensitive data. For AI features, submit only material you are authorised to process and only what is needed.
Questions or complaints
Email privacy@3dj.co.uk. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.
This describes controls represented in the application. Hosting, backup, incident-response, retention and processor contracts must also be verified operationally before launch.
