Privacy, in plain English.

Kreyd Labs Ltd, trading as SSTC.ai ("SSTC", "we", "us"), provides property-marketing software for estate agencies. Kreyd Labs Ltd is registered in England and Wales under company number 17152066. Kreyd Labs Ltd is the controller of personal information used to run accounts, secure the service, communicate with users and operate our own social-platform integrations. Contact us at support@kreydlabs.com.

An agency is normally responsible for the property, customer and staff information it chooses to put into Studio. Where we handle that information only to provide the service on the agency's instructions, SSTC acts as its processor. Agencies must have the rights and notices needed for the content they upload.

Information we collect

Account and agency information

We collect your name, work email address, password credentials in protected form, authentication and session records, agency name, timezone, contact details, logo and membership role. We also record security and audit events such as sign-in, approval, publishing and account changes.

Property and creative content

Studio processes listing URLs and source references, property facts and addresses, photographs and file metadata, brand settings, edits, approvals, schedules, generated copy, images, brochures and video. It may also process rights, consent and provenance records supplied by your agency. Property information can identify owners, occupiers or staff even where it is not submitted as a contact record.

Connected social accounts

If you choose to connect Meta or TikTok, we receive the connected account or Page identifiers, display names, account type, capabilities, granted permissions, encrypted access or refresh credentials, token expiries and connection status. We process the media, caption, destination, approval and schedule you select, plus provider operation identifiers, delivery status, errors and webhook events needed to complete or reconcile the action.

Optional visitor analytics

If you accept analytics cookies, we collect a random browser identifier, session identifier, general page paths, referring website hostname and campaign tags, plus events for sign-up, email verification, agency onboarding and checkout. With consent, these journeys can be linked to your account identifier so we can understand where people get stuck. Analytics does not read the contents of name, email, password or verification-code fields, property content or full page URLs. Please do not put personal information in campaign tags. We filter recognised automated traffic and exclude internal and review accounts from customer conversion reports.

Visitor analytics is stored in our existing Convex backend and is available only to authorised SSTC service owners. We keep analytics events for 90 days after the event, and visitor identifiers and attribution for 90 days after the visitor's last activity, with hourly expiry processing. Account-linked analytics consent expires 180 days after the choice is made unless you actively renew it. Account and payment records are also used separately to operate the service and measure aggregate business activity; declining analytics does not prevent sign-up, payment or access.

Technical and support information

When you use the service, our hosting and security systems process IP address, device and browser information, request timestamps, routes used, diagnostic events and similar logs. If you contact us, we process the message, attachments and contact details you provide.

How and why we use information

• Provide the service: authenticate users, create workspaces, import and review listings, store media, generate marketing assets, export files and carry out approved social actions.
• Keep SSTC secure and reliable: isolate agency workspaces, prevent abuse, investigate faults, maintain audit evidence and recover from incidents.
• Communicate: send account verification and recovery messages, respond to support requests and provide important service notices.
• Improve the product: understand aggregate service performance and fix usability or quality problems. We do not use customer property content to train our own general-purpose model.
• Meet legal and platform obligations: handle rights requests, provider deauthorisation or deletion events, disputes and lawful requests.

Our main lawful bases are performance of our contract with you or your agency, our legitimate interests in operating and securing a business service, and compliance with legal obligations. We rely on your consent for optional visitor and conversion analytics, which you can withdraw through Cookie preferences. Where another choice requires consent—such as authorising a social connection—we rely on that consent or authorisation for the relevant processing, and you can disconnect it.

Automated processing and AI

Studio automates formatting, classification and generation of property-marketing drafts. If an administrator enables visual photo classification, reduced-size property images are sent securely to OpenAI to suggest room or scene labels; the request is configured not to be stored by the model provider. Users review property facts, media and outputs before approval. SSTC does not make solely automated decisions about people that produce legal or similarly significant effects.

Who receives information

We disclose information only where needed to operate the service, follow your instruction, protect SSTC, or comply with law. Current categories include:

• Convex for application data, authentication and secure file storage;
• Railway for the Studio application and render runtime;
• Vercel for the public SSTC.ai website;
• Brevo for transactional account emails such as verification and password recovery;
• OpenAI for optional server-side photo classification when configured;
• Meta and TikTok when you connect an account or instruct SSTC to transfer approved content; and
• professional advisers, authorities or a successor to the business where reasonably necessary and legally permitted.

We do not sell or rent personal information.

International processing

Some suppliers and social platforms operate internationally, so information may be processed outside the UK. We use UK adequacy regulations where available and, where required, contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with appropriate transfer assessments. Email support@kreydlabs.com to ask about safeguards relevant to your information.

How long we keep information

We keep account, workspace and approved project records while the relevant account or agency is active and then only as long as reasonably needed for deletion, disputes, security, legal duties and backup expiry. Studio's temporary render jobs and generated runtime files are deleted after seven days by default. Signed media-delivery links expire much sooner.

Disconnecting or deleting a social connection disables destinations, cancels pending work and removes provider credentials and provider-derived data, subject to minimal security or legal audit evidence. Exact periods can vary by record type and active legal hold. We review records against purpose, sensitivity, contractual requirements and legal limitation periods rather than keeping them indefinitely.

Security

We use access controls, agency isolation, encrypted transport, protected credential storage, short-lived signed links, audit records and secret-redaction controls. No online system is completely secure, so please use a unique password, protect your account and tell us promptly about suspected misuse.

Your choices and rights

Depending on the circumstances, UK data-protection law gives you rights to access, correct, erase or restrict personal information; receive certain information in a portable form; and object to processing based on legitimate interests. Where we rely on consent, you may withdraw it without affecting earlier lawful use.

You may object at any time to processing based on our legitimate interests. Email support@kreydlabs.com with enough information for us to identify the relevant account. If SSTC processes the information only for your agency, we may direct your request to that agency.

You may complain to the UK Information Commissioner's Office through ico.org.uk/make-a-complaint. We would appreciate the chance to address the concern first.

Required information, browser storage and children

Name, work email, password and agency details are needed to create and secure an account; without them we cannot provide Studio. Other property, creative and social information is optional, but the corresponding feature cannot work without its inputs.

SSTC does not use advertising cookies. Studio uses strictly necessary browser storage and session mechanisms for authentication, security and user-requested settings. Optional analytics cookies are created only after you choose Accept analytics. The consent preference lasts 180 days, the visitor identifier and first-touch attribution last 90 days, and the shared session identifier expires after 30 minutes without activity. These cookies use the sstc.ai domain so your choice and consented journey work across the marketing site and Studio. You can reject analytics or withdraw consent at any time through Cookie preferences on the website or in Studio. Withdrawal stops new visitor tracking and, for a signed-in user, removes the account's consented tracking link; it does not automatically erase earlier records. Contact us to request deletion of those records. SSTC is a business service and is not intended for children under 18.

Changes and contact

We may update this notice when the product, suppliers or law changes. We will publish the new date here and provide a prominent notice where a change materially affects users.

Questions, rights requests and privacy concerns can be sent to support@kreydlabs.com.