Privacy Policy

Life Performance Studio is a software-as-a-service platform for creating, reviewing, approving, scheduling and publishing marketing and educational content. The operator of the Service is the data controller for the personal data described in section 2 under “Our role as controller”.

Privacy enquiries and data protection requests: privacy@lifeperformancestudio.com. We respond to rights requests within the timescales required by applicable law (one month under UK/EU GDPR, extendable by two further months for complex requests).

Our role as controller. We act as controller for account and user data (for example names, email addresses, login and security events, billing records, support correspondence, and product usage analytics), and for our website visitors.

Our role as processor. Content and records that a customer uploads or generates inside their workspace — including content packages, research notes, product information, media files, knowledge base entries and connected-channel data — are processed on that customer’s instructions. The customer organisation is the controller for that data; we process it only to provide the Service, and a data processing agreement governs that processing.

Workspaces are logically isolated. Data belonging to one workspace is not made available to another.

• Account and profile data: name, email address, password hash or federated identity (for example Google sign-in), profile image, workspace membership and role.
• Authentication and security data: sign-in timestamps, IP address, browser/device information, session tokens, and audit log entries recording actions taken in a workspace.
• Workspace content: text, images, video, documents, schedules, review notes and approvals you create or upload.
• Connected channel data: OAuth access and refresh tokens, account and destination identifiers (such as a Facebook Page, Instagram business profile, YouTube channel, LinkedIn organisation or Pinterest board), granted permission scopes, and delivery/performance metrics returned by those platforms.
• Billing data: plan, subscription status and invoice records. Card details are handled by our payment provider and are never stored on our systems.
• Support and communications: messages you send us and our replies.
• Technical and usage data: pages viewed, feature usage, performance timings and error diagnostics.

We do not ask for special category data (such as health data about identifiable individuals) and you should not upload it into workspace content unless you have a lawful basis and appropriate safeguards for doing so.

• To create and administer accounts, workspaces and role-based permissions.
• To provide the Service: content creation, review workflows, approvals, scheduling, publishing and reporting.
• To authenticate users, prevent unauthorised access, detect abuse and maintain audit trails.
• To deliver content to the channels you connect, on your instruction or schedule.
• To provide support, service notifications and important account communications.
• To bill customers and keep the financial records we are legally required to keep.
• To maintain, secure, debug and improve the Service, using aggregated or minimised data wherever practical.
• To comply with legal obligations and to establish, exercise or defend legal claims.

We do not sell personal data, and we do not use workspace content for advertising or cross-customer profiling.

• Contract — to provide the Service to you or to the organisation that granted you access.
• Legitimate interests — security, abuse prevention, service reliability, and product improvement, balanced against your rights and freedoms.
• Legal obligation — tax, accounting and lawful requests from authorities.
• Consent — optional cookies or analytics where required, and optional marketing email. You can withdraw consent at any time.

The Service uses third-party AI models to draft content, summarise research, produce images or audio, and generate analytical briefings. When you use these features, the relevant prompt material — which may include workspace content you supply — is sent to the model provider through our AI gateway solely to return the requested output.

We instruct our AI providers not to use customer prompts or outputs to train their foundation models. AI output is generated automatically and may be inaccurate; it is intended as a draft for human review, and the Service’s approval workflow exists so that a person signs off before publication.

We do not make decisions about you that are solely automated and that produce legal or similarly significant effects.

When you connect a social platform, you authorise the connection through that platform’s own OAuth consent screen. We receive only the permission scopes required to list your publishing destinations, publish on your instruction, and read back delivery and performance metrics.

Access and refresh tokens are encrypted at rest, held server-side only, scoped to a single workspace, and never exposed to the browser. You can disconnect a channel at any time in Settings → Connections, which revokes our stored authorisation; you can also revoke access from the platform’s own security settings. Your use of each platform remains governed by that platform’s terms and privacy policy.

We share personal data only with service providers that help us run the Service, under written contracts limiting them to our instructions. Categories include:

• Cloud hosting, database, authentication and file storage infrastructure.
• AI model providers accessed through our AI gateway.
• Transactional email delivery.
• Payment and subscription processing.
• Error monitoring and product analytics.
• The social platforms you choose to connect.

We may also disclose data where legally required, to protect rights and safety, or in connection with a merger or acquisition — in which case we will notify affected customers.

A current list of sub-processors is available on request from privacy@lifeperformancestudio.com.

Some providers process data outside the UK and European Economic Area. Where that happens we rely on an adequacy decision, or on the UK International Data Transfer Addendum and the European Commission’s Standard Contractual Clauses, together with supplementary technical measures such as encryption in transit and at rest. Details of the safeguards for a specific transfer are available on request.

• Account and workspace data: for the life of the account.
• Workspace content: until deleted by the customer, or up to 30 days after account closure, after which it is removed from live systems and purged from backups within a further 60 days.
• Connected-channel tokens: until disconnected, revoked or expired.
• Security and audit logs: typically 12 months.
• Billing and tax records: as required by law, commonly six to seven years.

We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and at rest, encryption of third-party credentials, row-level database access controls that isolate each workspace, role-based permissions, least-privilege server-side access to secrets, audit logging, and monitoring. No system can be guaranteed completely secure; if a personal data breach affects you we will notify the relevant supervisory authority and affected parties as required by law.

Please report suspected vulnerabilities to privacy@lifeperformancestudio.com.

Depending on where you live, you may have the right to:

• Access a copy of your personal data.
• Correct inaccurate or incomplete data.
• Delete data (subject to legal retention requirements).
• Restrict or object to certain processing, including direct marketing.
• Receive your data in a portable format.
• Withdraw consent where processing relies on consent.
• For California residents: know, delete, correct, and opt out of “sale” or “sharing” of personal information (we do neither), and not be discriminated against for exercising these rights.
• Lodge a complaint with your data protection authority — in the UK, the Information Commissioner’s Office.

If your data sits inside a customer’s workspace, we will forward your request to that customer, who is the controller, and support them in responding.

For step-by-step instructions on disconnecting a social channel or requesting deletion — including Facebook and Instagram data deletion requests — see our data deletion instructions.

Use of the platform is also governed by our Terms of Service.

We use strictly necessary cookies and local storage to keep you signed in, maintain your session and workspace selection, and protect against abuse. These are required for the Service to function. Any optional analytics or performance cookies are used only where permitted, and you can control cookies through your browser settings.

The Service is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child’s data has been provided to us, contact us and we will delete it.

Customers may use the Service to publish health, nutrition or supplement content. Such content is created and approved by the customer and is general information, not medical advice. The Service’s compliance tooling assists review but does not constitute legal or regulatory approval, and the publishing customer remains responsible for the accuracy and lawfulness of what it publishes.

We may update this policy as the Service evolves or the law changes. The “last updated” date above always reflects the current version, and we will give advance notice of material changes by email or in-app notice before they take effect.

For any privacy question, data protection request or complaint, email privacy@lifeperformancestudio.com. Please tell us which workspace you belong to so we can locate your records.