Legal
Privacy notice
How we use personal data when you visit subtilitas.app, contact us, or use Subtilitas as a business customer.
Last updated: 27 October 2026
1. Who we are
Subtilitas is provided by BHIK Studios Ltd, trading as SYNF ("we", "us"). We are registered in Scotland with company number SC670511, and our registered office is 1 Cambuslang Court, Cambuslang, Glasgow G32 8FH.
For anything about this notice or your personal data, email [email protected] or write to us at the address above.
2. Our two roles
Subtilitas is a service for businesses, and the law treats us differently depending on whose data it is.
Where we are the controller
We decide how and why personal data is used for this website, for enquiries and trial requests, for our own marketing, and for account data: the details of the people who set up, manage and pay for a customer's subscription, and the sign-in and security records we keep to run the service safely.
Where we are a processor
When a customer uses Subtilitas, the guides, photos, videos, uploaded documents and sign-off records it creates are customer content. That includes the names of workers and the records of the guides they completed. The customer, usually your employer or the company you are working for on site, is the controller of that data. We process it only on the customer's instructions and under our data processing agreement.
If you are a worker and want to access, correct or delete records about you in Subtilitas, please contact the company whose site you worked on. If you contact us, we will pass your request to them.
3. What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Website visits: IP address, browser type, pages requested and time, held in our hosting provider's server logs | To deliver the site and protect it from attack and abuse | Legitimate interests |
| Contact and trial forms: name, work email, company, role, industry and your message | To reply to you and set up a trial you ask for | Legitimate interests, or steps you ask us to take before a contract |
| Template pack requests: name, work email and company | To send the pack you asked for | Legitimate interests |
| Product updates and new templates, if you tick the box | To send occasional emails about Subtilitas | Consent, which you can withdraw at any time |
| Business contact details of people we think may be interested in Subtilitas: name, job title, work email and company, taken from company websites and other public business sources | To send a small number of relevant emails to people at companies, with an opt-out in every message | Legitimate interests |
| Account data: names, work emails and roles of customer administrators and billing contacts, billing records, support messages | To provide the service, take payment, give support and meet our legal obligations | Contract, and legal obligation for tax and accounting records |
| Sign-in and security records: account identifiers, IP address, device and browser details, sign-in times | To keep accounts secure, investigate problems and prevent misuse | Legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details of that assessment.
4. Cookies and tracking
This website sets no cookies and uses no analytics, advertising or tracking tools. The Subtilitas app uses only the cookies and on-device storage that are strictly necessary to keep you signed in and to make guides work offline. These do not need consent under the Privacy and Electronic Communications Regulations, and we do not use them for tracking or advertising.
5. Who we share data with
We do not sell personal data. We share it only with:
- service providers who help us run the website and the service, acting on our instructions under contract: Cloudflare for network, DNS and security, DigitalOcean for hosting, Google for our backups, Odoo for our helpdesk, which receives our email and the messages sent through this website's forms, and Stripe for payments once billing starts. The website, the app, its database and files run on a server we manage in DigitalOcean's London data centre. The full list is in our data processing agreement;
- our professional advisers, such as accountants and lawyers, where needed;
- the police, regulators or courts where the law requires it; and
- a buyer of our business or of Subtilitas, who would have to protect the data in the same way.
6. Transfers outside the UK
Cloudflare runs a global network, DigitalOcean and Google are US companies, and Odoo hosts its service outside the UK, so some data may be processed outside the UK. Where it is, we make sure the transfer is covered by UK adequacy regulations or by the ICO's International Data Transfer Agreement or Addendum, with any extra safeguards needed.
7. How long we keep data
| Data | How long |
|---|---|
| Website server logs | Up to 14 days, on our own server |
| Enquiries and trial requests that do not become customers | Up to 2 years from our last contact |
| Marketing preferences and opt-outs | Until you withdraw consent. We keep a record of opt-outs so we do not contact you again. |
| Account data | For the life of the subscription and up to 2 years after it ends |
| Billing and tax records | 6 years after the end of the financial year they relate to |
| Customer content | As the customer instructs. After a subscription ends, it is available for export for 30 days and then deleted, as set out in the data processing agreement. |
8. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, strict separation of each customer's content, access controls for our staff and regular backups. SYNF is certified under the UK government's Cyber Essentials scheme.
9. Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data;
- correct data that is wrong or incomplete;
- delete your data;
- restrict how we use it;
- move data you gave us to another provider; and
- stop using it, including for direct marketing, which we will always do.
Where we rely on consent, you can withdraw it at any time. To use any of these rights, email [email protected]. We will reply within one month. For customer content, see section 2.
10. Complaints
Please tell us first if you are unhappy and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
11. Changes to this notice
We will update this notice when our practices change and show the date at the top. If a change affects customers materially, we will tell them by email.