Privacy Policy

This Privacy Policy explains how iago ("we", "us") handles personal data when you use www.iago.cymru (the marketing site) and app.iago.cymru (the subtitle product), together the "Services".

For data protection purposes, the controller is the operator of iago. Contact: hari@iago.cymru.

This is a practical policy for our invite-only beta. It is not a substitute for legal advice. Please ask us if anything is unclear.

Account data: name, email address, password hash, approval status, and role when you request access or log in.

Project and media data: videos or audio you upload, derived audio files, transcripts, subtitle files (such as SRT, VTT, and JSON), project metadata, and edit history needed to run the product.

Technical data: basic logs, security events, and (if you consent) analytics about visits to the marketing site.

Communications: messages you send us by email, and transactional emails we send you (for example invite, approval, and password reset links).

To provide the Services: create accounts, process media, generate and store subtitles, and let you edit and export files.

To operate the invite-only beta: review access requests, approve users, and send account emails.

To keep the Services secure and reliable: prevent abuse, debug failures, and maintain backups where needed.

With consent, to understand marketing-site traffic using optional analytics cookies.

Our usual lawful bases are: contract (providing the product you asked for), legitimate interests (security, product improvement, beta operations), and consent (optional analytics).

We use trusted service providers to run iago. Depending on the feature, this may include: Vercel (hosting and deployment), cloud object storage for media files, a managed Postgres database, Inngest (background jobs), Resend (email), AWS (including GPU infrastructure in the UK/EU region for Welsh speech recognition where configured), Techiaith / Bangor University language technology APIs, and OpenAI (speech and translation processing).

Some providers may process data outside the UK or EEA. Where that happens, we rely on appropriate transfer mechanisms offered by those providers (such as standard contractual clauses) and limit what we send to what is needed for the feature.

Uploaded media and subtitle text may be sent to AI providers solely to provide transcription, translation, or related processing you request in the product.

We keep account data while your account is active and for a reasonable period afterwards if needed for security, disputes, or legal obligations.

Project media and subtitle files are kept so you can continue working in the product. You can delete projects in the app. During beta we may also remove inactive or test content as part of operations.

If you want an account deleted, email hari@iago.cymru and we will action the request within a reasonable time, subject to any legal retention needs.

Under UK GDPR you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability where applicable.

To exercise these rights, contact hari@iago.cymru. You can also complain to the UK Information Commissioner's Office (ICO) if you are unhappy with how we handle your data.

The Services are aimed at professionals and adult users. They are not directed at children under 16. If you believe a child has provided personal data, contact us and we will delete it.

We may update this policy as the beta evolves. The "Last updated" date at the top of the page will change when we do. Significant changes will be highlighted on the site or by email where appropriate.