Privacy notice

This notice explains what personal data Infinity Curve holds about you when you use Schemahaus, why we hold it, and what you can do about it. It covers you as a Schemahaus customer. Where we process personal data on your behalf — the content and contacts inside your organisation — we are a processor and the data processing agreement governs that instead.

What we hold, and why

Your account. Your name, email address and password hash, so you can sign in. Without these there is no account. We keep them while your account exists.

Your organisation. Its name, the sites in it, the members and their roles, so the product can decide who may do what. We keep this while the organisation exists.

What you did. An audit log of actions that change something — publishing, inviting, revoking a key — with the actor, the time and the affected record. This is how a customer answers "who changed this", and it is how we investigate abuse. We keep it for the period your plan states, up to a year.

Sessions and security. A session cookie, the IP address a request came from, and rate limit counters. These exist to keep the account secure and the service standing up. IP addresses are kept for a short period and are not used to profile anybody.

Billing. Paddle takes the payment and is the merchant of record. We never see or store your card details. We hold a Paddle customer identifier, your plan, and the state of your subscription, so the software knows what you are entitled to.

Email you asked for. If you subscribe to the newsletter we hold your address and the fact that you confirmed it. Every message has an unsubscribe link, and unsubscribing works without signing in or replying.

Support. Whatever you send us when you write to us, for as long as it takes to deal with it and a reasonable period afterwards.

What we do not do

We do not sell personal data. We do not buy it. We run no advertising, no advertising cookies, no third-party analytics, and no scripts from anybody else's domain — the content security policy would refuse them. We do not use your content or your customers' data to train machine-learning models.

Why we are allowed to

Most of this is because we need it to give you the service you asked for — the contract between us. The security and abuse-prevention parts rest on our legitimate interest in keeping the service safe, which we have weighed against your interests and consider proportionate because the data is minimal and is not used for anything else. The newsletter rests on your consent, which you may withdraw at any time. Some records we keep because tax or accounting law says we must.

Where it lives

Content and media are stored in the European Union. Databases and object storage are in the EU; backups are in the EU. The one exception is machine translation: if you use it, the text being translated is sent to Anthropic, which processes it outside the EU under the appropriate transfer safeguards. That feature is optional, off unless you use it, and can be disabled per site.

Who else sees it

Only the subprocessors on the subprocessor list, each for a stated purpose, and anyone we are legally compelled to disclose to. The list names every one of them and we give notice before adding another.

What you can ask for

You can ask us for a copy of your personal data, to correct it, to delete it, to restrict what we do with it, or to object to processing that rests on legitimate interest. You can export your organisation yourself from the dashboard at any time, in JSON, with a manifest of your media.

Closing your organisation marks it for deletion and purges it after thirty days. That window is deliberate: it is the difference between a mistake and a catastrophe.

You may complain to your local data protection authority. We would rather you told us first, but it is your right either way and you do not have to.

Children

Schemahaus is a tool for people doing a job, and is not directed at children. We do not knowingly collect personal data from anyone under sixteen.

Changes

If this notice changes materially we will tell subscribers and account holders by email before it takes effect, and the date at the top of this page will change.