1. Who we are
INTU · recode (“INTU”, “we”, “us”) provides personalised guided audio recordings created from words you supply. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, INTU · recode is the data controller for the personal data described in this policy. Our postal address is INTU · recode, 6i Tudor Road, London E9 7SN, United Kingdom.
Contact for privacy matters: hello@intu-recode.com.
2. Personal data we collect
- Account data — your email address, password credentials held in hashed form by our authentication provider, account creation date and sign-in events.
- Recoding inputs — the theme, keywords and free-text words you write in the creator, plus the requested length of the audio. This free text may contain information about your emotional state, which is treated as special category data (data concerning health) under Article 9 UK GDPR.
- Generated content — the script and audio produced for you (streamed to you for listening, not downloadable), and its title, duration and creation date.
- Membership and minute data — plan, minute balance, minute ledger entries, subscription status and renewal dates.
- Payment data — handled by Stripe. We receive limited billing metadata (last four digits, card brand, expiry, country, subscription IDs). We never see or store your full card number.
- Support data — messages you send us about a recording or your account.
- Technical data — IP address, browser type, device type, and security and error logs, collected when you use the service.
- Marketing email data — if you opt in, your email address, first name if provided, language, the date and wording of your consent, whether you are a free user or a member, and whether you clicked links in our emails.
3. Why we use it and our lawful bases
- To provide the service (creating, storing and playing your audio; managing minutes and your library) — performance of a contract (Art. 6(1)(b)).
- To process your explicit consent for sensitive inputs — where the words you write reveal information about your health or emotional wellbeing, we rely on your explicit consent (Art. 9(2)(a)), given when you submit the creator form. You can withdraw it at any time by deleting the recording and contacting us; withdrawal does not affect processing already carried out.
- To take payment and prevent fraud — contract and legitimate interests (Art. 6(1)(b) and (f)).
- To keep the service secure and reliable, including logging and abuse prevention — legitimate interests (Art. 6(1)(f)).
- To comply with tax, accounting and legal obligations — legal obligation (Art. 6(1)(c)).
- To send service emails (confirmation, password reset, receipts) — contract.
- To send marketing emails, including tips, new soundscapes and membership offers: your consent (Art. 6(1)(a)). You choose this with a separate checkbox, confirm it by email, and can withdraw at any time using the unsubscribe link in every email or your account settings.
4. Automated generation and AI
Your theme, keywords and written words are sent to third-party AI providers to draft the meditation script and to synthesise the narration voice. Providers are instructed not to use your content to train their models. No decision producing legal or similarly significant effects about you is made by automated means.
Our AI does not provide medical, psychological or crisis advice. INTU is a wellness and reflection product only.
5. Who we share data with
We use a small number of carefully selected service providers (processors), each bound by a written data processing agreement and permitted to use your data only on our instructions. They fall into these categories:
- Cloud hosting, database, authentication and encrypted file storage.
- AI text generation, used to draft your meditation script.
- AI voice synthesis, used to narrate your script.
- Payment processing and subscription billing (our payment provider also acts as a controller in its own right for fraud prevention).
- Transactional email delivery.
- Email marketing, provided by MailerLite, for people who opted in.
We may also disclose data to professional advisers, or to regulators and law enforcement where we are legally required to do so, and to a buyer if the business is sold. A current list of the individual named processors is available free of charge on request from hello@intu-recode.com.
We do not sell your personal data and do not share it with advertisers.
6. International transfers
Some providers process data outside the UK, including in the EEA and the United States. Where that happens we rely on UK adequacy regulations, or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with supplementary technical safeguards such as encryption in transit and at rest.
7. How long we keep it
- Account, membership and minute ledger records — for as long as your account is open, then up to 6 years where needed for tax and accounting records.
- Recoding inputs, scripts and audio files — until you delete the recording or close your account. Deleted items are removed from live storage promptly and purged from backups within 30 days.
- Support messages — 24 months.
- Security and error logs — up to 12 months.
8. Your rights
Under UK data protection law you have the right to access your data; to have inaccurate data corrected; to erasure; to restrict or object to processing; to data portability; and to withdraw consent at any time.
To exercise any right, email hello@intu-recode.com. We respond within one month. You can delete individual recordings yourself from your account library at any time.
If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF, ico.org.uk, telephone 0303 123 1113.
9. Security
Your recordings are stream-only: they are played inside your account through short-lived, single-use links and are never offered as a downloadable file. Data is encrypted in transit (TLS) and at rest. Audio files are held in a private storage bucket and served only through short-lived signed links. Access to production data is restricted, row-level security is enforced on all user tables, and passwords are never stored in readable form.
10. Cookies and similar technologies
We use strictly necessary cookies and local browser storage to keep you signed in and to remember your progress in the creator. These are essential to deliver the service you have requested and, under regulation 6(4) of the Privacy and Electronic Communications Regulations 2003, do not require consent. We do not use advertising or third-party tracking cookies.
11. Children
INTU is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email or by a prominent notice on the site before they take effect.