Privacy, in plain English.

Kreyd Labs Ltd, trading as SSTC.ai ("SSTC", "we", "us"), provides property-marketing software for estate agencies. Kreyd Labs Ltd is registered in England and Wales under company number 17152066. Kreyd Labs Ltd is the controller of personal information used to run accounts, secure the service, communicate with users and operate our own social-platform integrations. Contact us at support@kreydlabs.com.

An agency is normally responsible for the property, customer and staff information it chooses to put into Studio. Where we handle that information only to provide the service on the agency's instructions, SSTC acts as its processor. Agencies must have the rights and notices needed for the content they upload.

Information we collect

Account and agency information

We collect your name, work email address, password credentials in protected form, authentication and session records, agency name, timezone, contact details, logo and membership role. We also record security and audit events such as sign-in, approval, publishing and account changes.

Property and creative content

Studio processes listing URLs and source references, property facts and addresses, photographs and file metadata, brand settings, edits, approvals, schedules, generated copy, images, brochures and video. It may also process rights, consent and provenance records supplied by your agency. Property information can identify owners, occupiers or staff even where it is not submitted as a contact record.

Connected social accounts

If you choose to connect Meta or TikTok, we receive the connected account or Page identifiers, display names, account type, capabilities, granted permissions, encrypted access or refresh credentials, token expiries and connection status. We process the media, caption, destination, approval and schedule you select, plus provider operation identifiers, delivery status, errors and webhook events needed to complete or reconcile the action.

Technical and support information

When you use the service, our hosting and security systems process IP address, device and browser information, request timestamps, routes used, diagnostic events and similar logs. If you contact us, we process the message, attachments and contact details you provide.

How and why we use information

• Provide the service: authenticate users, create workspaces, import and review listings, store media, generate marketing assets, export files and carry out approved social actions.
• Keep SSTC secure and reliable: isolate agency workspaces, prevent abuse, investigate faults, maintain audit evidence and recover from incidents.
• Communicate: send account verification and recovery messages, respond to support requests and provide important service notices.
• Improve the product: understand aggregate service performance and fix usability or quality problems. We do not use customer property content to train our own general-purpose model.
• Meet legal and platform obligations: handle rights requests, provider deauthorisation or deletion events, disputes and lawful requests.

Our main lawful bases are performance of our contract with you or your agency, our legitimate interests in operating and securing a business service, and compliance with legal obligations. Where a choice requires consent—such as authorising a social connection—we rely on that consent or authorisation for the relevant processing, and you can disconnect it.

Automated processing and AI

Studio automates formatting, classification and generation of property-marketing drafts. If an administrator enables visual photo classification, reduced-size property images are sent securely to OpenAI to suggest room or scene labels; the request is configured not to be stored by the model provider. Users review property facts, media and outputs before approval. SSTC does not make solely automated decisions about people that produce legal or similarly significant effects.

Who receives information

We disclose information only where needed to operate the service, follow your instruction, protect SSTC, or comply with law. Current categories include:

• Convex for application data, authentication and secure file storage;
• Railway for the Studio application and render runtime;
• Vercel for the public SSTC.ai website;
• Brevo for transactional account emails such as verification and password recovery;
• OpenAI for optional server-side photo classification when configured;
• Meta and TikTok when you connect an account or instruct SSTC to transfer approved content; and
• professional advisers, authorities or a successor to the business where reasonably necessary and legally permitted.

We do not sell or rent personal information.

International processing

Some suppliers and social platforms operate internationally, so information may be processed outside the UK. We use UK adequacy regulations where available and, where required, contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with appropriate transfer assessments. Email support@kreydlabs.com to ask about safeguards relevant to your information.

How long we keep information

We keep account, workspace and approved project records while the relevant account or agency is active and then only as long as reasonably needed for deletion, disputes, security, legal duties and backup expiry. Studio's temporary render jobs and generated runtime files are deleted after seven days by default. Signed media-delivery links expire much sooner.

Disconnecting or deleting a social connection disables destinations, cancels pending work and removes provider credentials and provider-derived data, subject to minimal security or legal audit evidence. Exact periods can vary by record type and active legal hold. We review records against purpose, sensitivity, contractual requirements and legal limitation periods rather than keeping them indefinitely.

Security

We use access controls, agency isolation, encrypted transport, protected credential storage, short-lived signed links, audit records and secret-redaction controls. No online system is completely secure, so please use a unique password, protect your account and tell us promptly about suspected misuse.

Your choices and rights

Depending on the circumstances, UK data-protection law gives you rights to access, correct, erase or restrict personal information; receive certain information in a portable form; and object to processing based on legitimate interests. Where we rely on consent, you may withdraw it without affecting earlier lawful use.

You may object at any time to processing based on our legitimate interests. Email support@kreydlabs.com with enough information for us to identify the relevant account. If SSTC processes the information only for your agency, we may direct your request to that agency.

You may complain to the UK Information Commissioner's Office through ico.org.uk/make-a-complaint. We would appreciate the chance to address the concern first.

Required information, browser storage and children

Name, work email, password and agency details are needed to create and secure an account; without them we cannot provide Studio. Other property, creative and social information is optional, but the corresponding feature cannot work without its inputs.

SSTC does not currently use advertising cookies. Studio uses strictly necessary browser storage and session mechanisms for authentication, security and user-requested settings. SSTC is a business service and is not intended for children under 18.

Changes and contact

We may update this notice when the product, suppliers or law changes. We will publish the new date here and provide a prominent notice where a change materially affects users.

Questions, rights requests and privacy concerns can be sent to support@kreydlabs.com.