Privacy Policy
Last updated 13 October 2026. This policy explains what personal data Sweeney Creative Co collects when you use Discipuli, why, and the choices you have. We keep it to what we need to run the service.
Who we are
Sweeney Creative Co is the controller of your personal data for Discipuli. Contact us about privacy at hello@discipuli.app.
What we collect
- Account details: your email address, and when you signed up and last signed in.
- Billing details: your subscription status, plan and billing history. Card details are collected and held by Stripe; we never see your full card number.
- Your workspace: the agents, workflows, prompts, knowledge, memory and settings you create, so they're saved and available on your devices.
- AI provider keys: keys you add are encrypted (AES-256) before they're stored and are never shown back in full.
- Technical data: IP address, browser type and basic request logs, used for security, rate limiting and fixing problems.
How we use it, and our legal basis
- To provide the service you pay for (contract): creating your account, signing you in, saving your workspace and running your agents.
- To take payment and keep records (contract and legal obligation): subscriptions, invoices, tax and accounting.
- To keep the service secure and working (legitimate interests): preventing abuse and fraud and diagnosing errors.
- To email you about your account (contract): sign-in links, billing and important service changes. We don't send marketing emails unless you've opted in.
We don't sell your data, and we don't use your content to train AI models.
When your agents run
When you run an agent, its instructions, your task and any relevant workspace content are sent to the AI provider you chose (for example Google, Anthropic or OpenAI) using your own API key. That provider processes it under your agreement with them and their privacy policy. Pages that agents fetch with web tools are retrieved by our servers on your behalf.
Who we share it with
We use these service providers to run Discipuli. They only process your data on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and sign-in (accounts, workspaces, encrypted AI keys) | Ireland (EU) |
| Vercel | Website hosting and server functions | EU / US |
| Stripe | Payments, subscriptions and invoices | EU / US |
| Resend | Sending sign-in and account emails | Ireland (EU) |
| Cloudflare | Domain name system and forwarding emails sent to us | Global |
Where data is transferred outside the UK, it's protected by adequacy regulations or standard contractual clauses. We may also disclose data if the law requires it.
Cookies and local storage
We only use what's needed to make Discipuli work: your sign-in session and your preferences are kept in your browser's storage. We don't use advertising or cross-site tracking cookies. Stripe sets its own cookies on its checkout pages to prevent fraud.
How long we keep it
- Your account and workspace are kept while your subscription is active, and for 30 days after it ends so you can come back or export your data. After that they're deleted.
- Billing records are kept for 6 years, as UK tax law requires.
- Server logs are kept for a short time (usually under 30 days).
- You can delete AI keys, memories and other content yourself at any time.
Your rights
Under UK data protection law (UK GDPR) you can ask to access, correct, delete or receive a copy of your data, object to or restrict how we use it, and withdraw consent where we rely on it. Email hello@discipuli.app and we'll respond within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to help first.
Security
Data is encrypted in transit (HTTPS) and at rest. Each customer's data is isolated with database access rules, AI keys are separately encrypted, and payments are handled by Stripe. No system is perfectly secure, but if a breach affects your data we'll tell you and the ICO as the law requires.
Children
Discipuli is not intended for anyone under 18, and we don't knowingly collect their data.
Changes
If we change this policy in a significant way we'll email you before it takes effect. See also our Terms of Service.