Privacy Policy
Effective date: 5 March 2026 · Last updated: 5 March 2026
This policy explains how Deltastring Ltd ("we", "us", "our") collects, uses, and protects your personal data when you use Beacon ("the Service"). We are registered in England and Wales and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Data controller
Deltastring Ltd is the data controller. Contact us at hello@deltastring.com for any data protection queries.
2. What we collect
Account information
- Email address and password (hashed) when you register, or email address via Google OAuth.
- Plan tier and subscription status.
Zendesk connection data
- Zendesk subdomain, API credentials (encrypted at rest using AES-256), and authentication type.
- Configuration snapshots: every administrative configuration object Zendesk exposes across Support, Help Centre, Chat, and Talk. We do not access or store ticket data, customer personal data, or agent conversations.
Payment information
- Payment is processed by Stripe. We store your Stripe customer ID and subscription ID. We do not store card numbers or bank details.
Technical data
- Server logs (IP address, browser type, pages visited) for security and operational purposes.
- We do not use third-party analytics or advertising trackers.
3. How we use your data
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Providing the Service | Contract performance (Art. 6(1)(b)) |
| Processing payments | Contract performance (Art. 6(1)(b)) |
| Account security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Service communications (e.g. password resets) | Contract performance (Art. 6(1)(b)) |
| Product updates and feature announcements | Legitimate interest (Art. 6(1)(f)) |
4. Data sharing
We share data only with:
- Stripe — payment processing (Stripe acts as an independent controller for payment data).
- Railway — infrastructure hosting (data processor, servers in the US).
- Google — if you use Google OAuth to sign in.
We do not sell your data. We do not share your data with advertisers.
5. International transfers
Our infrastructure is hosted by Railway in the United States. Data transferred outside the UK is protected by standard contractual clauses or equivalent safeguards as required by UK GDPR.
6. Data retention
- Active accounts: data retained while your account is active.
- Deleted accounts: personal data deleted within 30 days. Server logs retained for up to 90 days for security purposes.
- Payment records: retained for 7 years as required by UK tax law.
7. Data security
- Zendesk API credentials are encrypted at rest using AES-256.
- Passwords are hashed using bcrypt.
- All connections use HTTPS/TLS.
- Access to production systems is restricted to authorised personnel.
8. Your rights
Under UK GDPR, you have the right to:
- Access your personal data.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten").
- Restrict processing in certain circumstances.
- Data portability — receive your data in a structured format.
- Object to processing based on legitimate interest.
- Withdraw consent where consent is the legal basis.
To exercise any of these rights, email hello@deltastring.com. We will respond within 30 days.
9. Cookies
Beacon uses only essential cookies required for the Service to function (session authentication, CSRF protection). We do not use tracking cookies, analytics cookies, or advertising cookies. Because these cookies are strictly necessary, consent is not required under PECR.
10. Children
The Service is not intended for anyone under 18. We do not knowingly collect data from children.
11. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via email. The "last updated" date at the top of this page will be revised accordingly.
12. Complaints
If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
13. Contact
Deltastring Ltd · hello@deltastring.com