Privacy Policy

1. Who is responsible for your data

The data controller for M&R Edge Engine is Michelle & Rich Essence Ltd. (company number SC 883903), Edinburgh, United Kingdom. You can reach us about privacy at [email protected].

We process personal data in line with the UK GDPR and the Data Protection Act 2018, and with equivalent laws where they apply to you.

2. What we collect

Account data: your name, email address, sign-in method (including Google sign-in), organisation and workspace membership, roles and team tier.

Usage and billing data: plan, token and credit consumption, job records (type, status, cost, timestamps), payment status (card details are handled by our payment processor and never touch our servers), and audit logs of API and console activity.

Content data: briefs, scripts, brand assets and other material you submit, plus the scripts, audio and video the Service generates for you, so we can store and redeliver them in your workspace.

Technical data: IP address, browser and device information, and analytics events collected through our tag manager, used to keep the Service secure and to understand how it is used.

3. How we use it

To provide the Service: authenticate you, run your generation jobs, meter usage, apply team seats and concurrency, and deliver output to your workspace.

To bill you correctly, including crediting failed or blocked jobs; to monitor engine health and service levels; to prevent abuse and secure the platform; and, with your consent where required, to send product updates and newsletters you can opt out of at any time.

We do not sell your personal data, and we do not use your private workspace content to advertise to you.

4. AI processing and subprocessors

Generation requests are processed by AI model providers acting as our subprocessors, under contracts that limit their use of your data to providing the service. The providers active for your workspace are listed in the console, and sovereign or on-prem deployments keep processing inside your chosen boundary.

Other subprocessors include our cloud hosting and database provider, our payment processor, and our email delivery provider. A current list is available on request.

5. International transfers

Some subprocessors process data outside the UK and EEA. Where they do, we rely on adequacy regulations or standard contractual clauses to protect the transfer. Enterprise and sovereign deployments can be pinned to specific regions.

6. Retention

Account and billing records are kept while your account is active and for the period required by tax and accounting law afterwards. Generated content stays in your workspace until you delete it or close your account. Audit logs are retained for security and service-level evidence, then archived or deleted.

7. Your rights

You have the right to access, correct, export and delete your personal data, to restrict or object to processing, and to data portability. Workspace admins can manage member data directly; for anything else, email [email protected] and we will respond within one month.

You also have the right to complain to the UK Information Commissioner's Office (ICO) or your local supervisory authority.

8. Cookies and analytics

We use strictly necessary storage for sign-in sessions, and analytics tags (via our tag manager) to measure site usage. Where the law requires consent for analytics, we will ask for it and honour your choice.

9. Security

We use encryption in transit and at rest, scoped and rotatable API keys, role-based access, row-level isolation between organisations, audit logging on every call, and scheduled security scanning. No method is perfectly secure; if a breach affects your data we will notify you and the regulator as the law requires.

10. Changes

We may update this policy; material changes will be notified in the app or by email before they take effect. The “last updated” date above shows the current version.