Privacy Policy

Connect Solutions
Registered address available on request — email info@connectsolutions.me
Email: info@connectsolutions.me

For all data protection enquiries, please contact us at the email above. We will respond within 30 days.

We collect the following categories of personal data:

• Account data: email address, full name, password (hashed — we never see it in plain text).
• Organisation data: organisation name and URL slug you choose.
• Usage data: page visits, feature usage, error logs — to improve the Service.
• Billing data: handled directly by Stripe. We store only your Stripe customer ID and subscription status — never your card number.
• Consent records: timestamps and choices recorded when you accept terms or opt in/out of marketing.
• Uploaded media submitted for analysis: the image, video, audio or text you submit. For a standalone check the original is deleted once the analysis completes; it is retained where you ask us to keep it (see below).
• Analysis records: the verdict, the AI-likelihood score, the file name and the file's SHA-256 cryptographic hash.
• Preview images: a small downscaled preview of the analysed media, kept with the record so the report can be read later. A workspace can switch previews off.
• Generated evidence images: images our analysis derives from your media — error-level-analysis and noise maps, region-of-interest crops and attention overlays — kept with the report as its exhibits.
• Vaulted originals (Evidence Vault, optional): where your organisation has enabled it under its agreement, the unmodified original of every file, encrypted with AES-256-GCM.
• Case files and attachments: media and documents you attach to a case, plus the case's own title, description, reference numbers and reviewer name. Case material is retained as that case's evidence file.
• Intake metadata: for the optional WhatsApp intake channel, the sending phone number, so the result can be returned to it.

Uploaded media, previews, generated evidence images, vaulted originals and case attachments are held encrypted at rest in object storage in the EU region, separately from the database.

We do not sell your data. We do not use it for advertising. We do not use your uploaded media to train models.

• Contract performance (Art. 6(1)(b)): processing your account and organisation data to deliver the Service.
• Consent (Art. 6(1)(a)): marketing emails — you can withdraw consent at any time by clicking "unsubscribe" or emailing us.
• Legitimate interest (Art. 6(1)(f)): usage analytics and security logging to maintain and improve the Service.
• Legal obligation (Art. 6(1)(c)): tax records and billing history where required by law.

We use the following third-party processors. All have executed Data Processing Agreements with us:

• Supabase Inc. — database and authentication. Data stored in eu-central-1 (Frankfurt, Germany). Privacy policy.
• Vercel Inc. — application hosting (edge functions process requests; no personal data is stored at edge nodes). Privacy policy.
• Stripe Inc. — payment processing. Stripe is independently PCI-DSS compliant. Privacy policy.

Your personal data is stored in Frankfurt, Germany (EU) by default. Some of our sub-processors (Vercel, Stripe) are headquartered in the United States. Data transfers to the US are covered by the EU–US Data Privacy Framework or Standard Contractual Clauses (SCCs) pursuant to GDPR Art. 46.

• Active account data: retained for the duration of your account.
• Deleted accounts: soft-deleted immediately; hard-deleted after 30 days. Backups purged within 90 days.
• Billing records: retained for 7 years as required by tax law.
• Consent logs: retained for 5 years as evidence of lawful processing.
• Usage logs: aggregated and anonymised after 90 days.
• Uploaded originals (standalone check): deleted as soon as the analysis attempt ends — whether it succeeded or failed.
• Analysis records, previews and generated evidence images: retained with the check for the life of the workspace, so a report stays verifiable. Previews can be switched off per workspace, and an organisation admin can delete retained evidence for a check at any time.
• Vaulted originals (Evidence Vault): retained for as long as your organisation's agreement provides, and deletable on request. Only organisations that explicitly enable the Vault have originals retained at all.
• Case files and attachments: retained for the life of the case so its evidence file stays intact — this is the point of a case, and it means media attached to a case is NOT deleted after analysis. Deleting the case deletes its attachments.

All of the above is stored encrypted at rest in object storage in the EU region. On account deletion, retained media, previews, evidence images, vaulted originals and case attachments are deleted on the same schedule as the account (hard-deleted after 30 days, backups purged within 90).

You have the following rights regarding your personal data:

• Access (Art. 15): request a copy of all data we hold about you.
• Rectification (Art. 16): correct inaccurate data.
• Erasure (Art. 17): request deletion of your account and associated data.
• Portability (Art. 20): receive your data in a machine-readable format (JSON).
• Restriction (Art. 18): request that we restrict processing while a dispute is resolved.
• Objection (Art. 21): object to processing based on legitimate interest.
• Withdraw consent: for marketing emails, at any time, without affecting prior processing.

To exercise any right, email info@connectsolutions.me. We will respond within 30 days. You may also submit a request from your account settings.

If you believe we have violated your rights, you may lodge a complaint with the German Federal Commissioner for Data Protection (BfDI) at bfdi.bund.de, or with the supervisory authority in your country of residence.

We use strictly necessary cookies to maintain your authenticated session. We do not use third-party tracking or advertising cookies. For full details, see our Cookie Policy.

We implement appropriate technical and organisational measures including:

• AES-256 encryption at rest (Supabase managed)
• TLS 1.3 in transit
• Row-Level Security enforced at the database layer
• Service-role API keys never exposed to the client
• Passwords hashed with bcrypt (handled by Supabase Auth)

In the event of a data breach, we will notify affected users and the relevant supervisory authority within 72 hours as required by GDPR Art. 33.

We will notify you of material changes by email and/or by posting a notice in the application at least 14 days before the change takes effect. Continued use of the Service after that date constitutes acceptance of the updated policy.