Privacy Policy

Last updated: 4 May 2026

This Privacy Policy explains how Strand Support collects, uses, stores and protects personal data when you contact us, open a support ticket, or use a support portal that we operate on behalf of a studio. It is written for compliance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the UK GDPR.

1. Who we are

Strand Support is the data controller for personal data that you provide directly to us through this support platform.

Our registered address is:

Strand Support, Room 73, The Mansion House Wrest Park, Silsoe, Bedford.

If you have any questions about this Privacy Policy or about how we handle your personal data, you can contact us using the address above or through any of the support channels you used to reach us.

When you open a ticket through a studio that uses Strand Support, the studio you contacted is normally the data controller for your relationship with them, and Strand Support acts as a data processor on their behalf for the purpose of running their support service. In that situation we still apply the security and retention rules described in this policy to the data we hold.

2. What personal data we collect

The personal data we process depends on how you interact with us. We typically collect the following:

Identity and contact data, such as the name and email address you give when opening a ticket.
Account data, where you have a login to a studio panel or to the support platform, including a user ID and any display name you choose.
Ticket content, including the messages, attachments, screenshots and order references you send us, and any messages we and the studio send back to you.
Order and product data, where the studio uses Tebex or a similar system, such as a transaction ID or product reference that you share with us so we can verify a purchase.
Technical data, such as your IP address, browser, device information and basic logs that are recorded when you visit a support portal or open a ticket.
Communication data, including timestamps, language preferences and translation history when our agents reply to you.
Cookies and similar identifiers used to keep you logged in on a support portal, to protect against abuse, and to remember your preferences.

We try to collect only the personal data we need to provide and improve the support service. Please do not include sensitive personal data (such as health, political opinions or financial details beyond what is needed to verify a purchase) in your tickets unless we have specifically asked for it.

3. How we use your personal data and the legal basis

We process your personal data for the following purposes and on the following legal bases under Article 6 of the GDPR:

To provide the support service. We use your contact details and ticket content to receive your request, respond to it, ask for more information and resolve your issue. The legal basis is the performance of a contract or, where you contact us before any contract exists, the steps you have asked us to take before entering into one (Article 6(1)(b)).
To verify purchases and product entitlements. Where you ask for help with a paid product, we use the order references you provide, and information from systems such as Tebex, to confirm that you have a valid licence. The legal basis is the performance of a contract (Article 6(1)(b)) and our legitimate interests in preventing abuse of the support service (Article 6(1)(f)).
To keep our service secure. We use technical data and logs to protect against fraud, brute-force attempts, spam and abuse, and to investigate incidents. The legal basis is our legitimate interests in maintaining a secure support service (Article 6(1)(f)).
To improve the support service. We use anonymised or aggregated data, and a limited amount of identifiable ticket content, to improve our quality, train our agents, refine our knowledge base and improve any AI assistance we use. Where we use AI to suggest replies, the suggestion is reviewed by a human before it is sent. The legal basis is our legitimate interests in providing a better service (Article 6(1)(f)).
To meet legal obligations. We may need to keep records, respond to lawful requests, or share information with regulators or law enforcement. The legal basis is compliance with a legal obligation (Article 6(1)(c)).
With your consent, where required. Some optional features (such as marketing emails or non-essential cookies) only run if you have given us your consent. The legal basis is your consent (Article 6(1)(a)). You can withdraw consent at any time without affecting the lawfulness of any processing carried out before you withdrew it.

We do not sell your personal data, and we do not use your ticket content to train any third-party AI models.

4. Who we share your personal data with

We share your personal data only where it is needed to run the support service or to meet a legal obligation. The categories of recipient are:

The studio you contacted. When you open a ticket through a studio support portal, the staff of that studio (and our agents working on their behalf) can see the ticket content, your name, your email address and any attachments you provided.
Our service providers. We use carefully selected third parties to host the platform, send notification emails, run security checks, store files, and provide cloud infrastructure. These providers act as our processors under written contracts and are only allowed to use your data as we instruct.
Tebex and similar order systems. Where the studio uses Tebex, we may pass an order reference back to Tebex to confirm a purchase. We do not share the content of your ticket with Tebex.
Discord. Where the studio uses Discord and you choose to interact with support through Discord, the relevant message content and your Discord identifier are shared with Discord as part of how the platform works.
Authorities and advisors. Where required by law, court order, or to protect our rights, we may share information with regulators, law enforcement, our insurers or our legal advisors.

We never share your personal data with third parties for their own marketing purposes.

5. International transfers

Some of our service providers process personal data outside the UK or the European Economic Area. Where that happens, we make sure there is an appropriate safeguard in place, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a transfer to a country that has been recognised as providing an adequate level of protection.

If you would like more information about the safeguards we use for international transfers, please contact us using the details in section 1.

6. How long we keep your personal data

We keep your personal data only for as long as we need it for the purposes described in this Privacy Policy, or for as long as we are required to by law.

In practice this means:

Active tickets are kept while the ticket is open and for a reasonable period afterwards so that you and the studio can refer back to them.
Closed tickets and the messages within them are kept by the studio according to the studio's own retention policy. We assist with deletion on request.
Account, order verification and security logs are kept for as long as we need them to run the service, to detect abuse, and to meet legal record-keeping requirements.
Backups containing personal data are kept for a short rolling period and are then overwritten.

When we no longer need your personal data, we delete it or, where deletion is not technically possible, we securely anonymise it.

7. Your rights under the GDPR

Subject to certain conditions, you have the following rights in relation to your personal data:

The right to be informed about how we use your personal data. This Privacy Policy is part of how we meet that right.
The right of access to a copy of the personal data we hold about you.
The right to rectification of inaccurate or incomplete personal data.
The right to erasure of your personal data in certain circumstances ("right to be forgotten").
The right to restrict our processing of your personal data in certain circumstances.
The right to data portability, which lets you receive personal data you provided to us in a structured, machine-readable format, or ask us to send it to another controller.
The right to object to processing that we carry out on the basis of our legitimate interests, including for direct marketing.
The right to withdraw consent at any time, where we rely on your consent to process personal data.
The right not to be subject to a fully automated decision that produces legal or similarly significant effects on you. We do not use your personal data for that kind of decision-making.

To exercise any of these rights, please contact us using the details in section 1. We will respond within the time limits set out in the GDPR, which is normally one month. We may need to ask you for proof of identity before we act on a request.

For the right to erasure in particular, we have built a self-service tool. Visit /privacy-policy/delete-my-data, enter the email address you used when contacting support, and follow the link we send to that email. After you confirm, your name, email and other identifying details will be replaced with the word REDACTED on every ticket you ever opened with us, while the ticket history itself is kept so support records remain accurate.

If you contacted us through a studio that is the data controller for your relationship with them, we may need to forward your request to the studio so that they can respond.

8. Your right to complain to a supervisory authority

If you are not happy with how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live, where you work, or where the alleged infringement took place.

In the United Kingdom the supervisory authority is the Information Commissioner's Office (ICO), which can be contacted at ico.org.uk.

9. Cookies and similar technologies

We use a small number of cookies and similar technologies on our support portals and on the Strand Support website. These include:

Strictly necessary cookies, which are required to keep you signed in to a portal, to remember your secure ticket link and to protect against abuse. These do not need your consent.
Functional cookies, which remember preferences such as dark mode or language.
Security cookies, used by services such as reCAPTCHA to help us tell humans from bots.

We do not use advertising cookies or third-party tracking cookies for marketing purposes.

10. Security

We take the security of your personal data seriously. We use a combination of organisational and technical measures, including encryption in transit, access controls, audit logging, virus scanning of attachments, secure authentication for staff, and least-privilege access for our service providers.

No system is perfectly secure. If we ever become aware of a personal data breach that is likely to affect your rights and freedoms, we will tell you and the relevant supervisory authority without undue delay, in line with our obligations under the GDPR.

11. Children

Our support service is intended for adults. We do not knowingly collect personal data from children under the age of 16 without the consent of a parent or guardian. If you believe a child has sent us personal data without that consent, please contact us so we can remove it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in the law, in our services, or in how we use personal data. The "Last updated" date at the top of the policy shows when it was last revised. Where the changes are significant, we will take reasonable steps to bring them to your attention.

13. Contact us

If you have any questions about this Privacy Policy, or if you want to exercise any of your rights, please contact us at:

Strand Support, Room 73, The Mansion House Wrest Park, Silsoe, Bedford.

We are happy to help and we will respond to every reasonable request.