1. Who is the data controller?
J Wilkins trading as Wixfit AI, 2 Quin Court, Braughing, SG11 2PY, United Kingdom, is the data controller for the personal data described in this policy.
Contact our data representative: jmilkinsmaq@outlook.com · +44 7967 779794
2. What data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Full name, email address, phone number | You, at registration |
| Billing data | Subscription plan, payment method type, last 4 digits, billing history | You, via our payment processor (Stripe) |
| Usage data | API requests made, models used, credit consumption, timestamps | Automatically, when you use the service |
| Technical data | IP address, browser type, device type, session tokens | Automatically, via our servers |
| Communications | Emails and messages you send us | You, directly |
We do not collect or store the content of your AI conversations (your prompts or the model outputs) on our servers beyond the minimum required to route and complete each request. We do not use your inputs or outputs to train any AI model.
3. How we use your data
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Providing and managing your subscription | Performance of contract (Art. 6(1)(b)) |
| Processing payments and preventing fraud | Performance of contract; legitimate interests (Art. 6(1)(b)(f)) |
| Sending transactional emails (invoices, alerts) | Performance of contract (Art. 6(1)(b)) |
| Monitoring usage to enforce fair-use policies | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Sending marketing communications (with opt-in) | Consent (Art. 6(1)(a)) |
4. Sharing your data
We do not sell your personal data. We share it only where necessary:
- Stripe Inc. — payment processing. Stripe is PCI-DSS compliant and processes card data on our behalf. Stripe Privacy Policy.
- AI model providers — your API requests are forwarded to the relevant upstream provider (Anthropic, OpenAI, Google, xAI, DeepSeek, Moonshot AI). Your request content is subject to that provider's data-processing terms. We recommend reviewing their policies.
- Hosting infrastructure — our servers are hosted on VPS infrastructure in the EU/UK. Data is not transferred outside the UK/EEA without appropriate safeguards.
- Law enforcement — where required by law, court order or regulatory authority.
5. Cookies
We use only strictly necessary cookies to maintain your session and remember authentication state. We do not use advertising or tracking cookies. No third-party analytics scripts are loaded on our site.
6. Data retention
We retain your account data for the duration of your subscription and for up to 7 years after termination for legal and tax compliance purposes. Usage logs are retained for 12 months. You may request earlier deletion — see section 7.
7. Your rights
Under UK GDPR you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data (subject to legal retention requirements).
- Restriction — ask us to restrict processing in certain circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Object — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, email jmilkinsmaq@outlook.com. We will respond within 30 days. If you are not satisfied with our response you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
8. Security
We implement appropriate technical and organisational measures to protect your personal data, including HTTPS encryption in transit, access controls and regular security reviews. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.
9. Children
Our service is not directed at anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.
10. Changes to this policy
We may update this policy from time to time. We will notify you of material changes by email or prominent notice on our website. The "Last updated" date at the top of this page indicates when it was last revised.