Last updated: 27 April 2026 · UK GDPR compliant · Governed by English law
This Privacy Policy explains what personal data SamtHQ collects, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
SamtHQ is operated by Faras Enoon, a sole trader based in the United Kingdom. For the purposes of the UK GDPR, Faras Enoon is the data controller for personal data processed through samthq.com.
Data Controller: Faras Enoon
Email: samthq10@gmail.com
Jurisdiction: England and Wales
Billing is handled by Stripe Inc. We receive subscription plan, status, and Stripe identifiers only. We do not receive or store your full payment card number, CVV, or bank account details.
If you join our waitlist, we collect your email address and selected role, used solely to notify you when access is available.
IP address (for rate limiting — not stored permanently), browser type, device type, pages visited, and referring URL.
| Purpose | Legal Basis | Data Used |
|---|---|---|
| Providing the Service | Contract performance | Account data, content, results |
| Processing payments | Contract performance | Account data, billing data |
| Transactional emails | Contract performance | Email address |
| Fraud prevention and limit enforcement | Legitimate interests | Account data, IP address, usage data |
| Improving the Service | Legitimate interests | Anonymised usage patterns only |
| Support requests | Legitimate interests | Communications data |
| Legal compliance | Legal obligation | As required by law |
| Marketing communications | Consent | Email — only where opted in |
Important: We do not use your uploaded Content to train AI models or build datasets. Your Content is processed solely to generate your analysis.
To generate analyses, your Content is transmitted to third-party AI providers under API agreements that restrict use for model training.
Anthropic, Inc. (Claude) — text analysis and formula detection
OpenAI, LLC (GPT-4o) — visual analysis and attention mapping
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage | EU (AWS) |
| Vercel Inc. | Platform hosting | US/EU |
| Stripe Inc. | Payment processing | US/EU |
| Anthropic, Inc. | AI text analysis | US |
| OpenAI, LLC | AI visual analysis | US |
| Resend Inc. | Transactional email | US |
We do not sell, rent, or trade your personal data to third parties for marketing or any commercial purpose.
| Data Type | Retention Period |
|---|---|
| Account data | Duration of account + 30 days after closure |
| Uploaded Content | Duration of account; free inactive accounts: 12 months |
| Analysis results | Duration of account + 30 days after closure |
| Billing records | 7 years from transaction date (HMRC requirement) |
| Support correspondence | 3 years from last contact |
| Waitlist data | Until unsubscribe or 24 months from collection |
| IP address logs | 30 days |
Contact samthq10@gmail.com to exercise any right. We respond within one calendar month.
Right of Access
Request a copy of the personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure
Request deletion where data is no longer necessary or you withdraw consent.
Right to Restriction
Request restricted processing in certain circumstances.
Right to Data Portability
Receive your data in a structured, machine-readable format where processing is consent or contract based.
Right to Object
Object to processing based on legitimate interests.
Right to Complain
Lodge a complaint with the ICO at ico.org.uk or call 0303 123 1113.
We use only strictly necessary cookies. No advertising, tracking, or cross-site profiling cookies are used.
| Cookie | Purpose | Duration |
|---|---|---|
| Authentication (Supabase) | Maintaining your logged-in session | Session / 7 days |
| CSRF token | Preventing cross-site request forgery | Session |
Security measures include:
In the event of a breach likely to risk your rights, we will notify you and the ICO within 72 hours as required by UK GDPR.
SamtHQ is not directed at individuals under 18. We do not knowingly collect personal data from children. Contact samthq10@gmail.com if you believe we have done so inadvertently.
We will notify you of material changes at least 14 days before they take effect. Continued use after changes take effect constitutes acceptance.
SamtHQ
Data Controller: Faras Enoon (Sole Trader)
Email: samthq10@gmail.com
We respond to all privacy enquiries within 5 business days.