Privacy notice

Effective 16 October 2026

The short version.

We collect what we need to run your account and your designs, and to keep the Service secure.
We never sell your data, never use your designs to train machine-learning models, and use no advertising or analytics cookies.
Payments are handled by Lemon Squeezy under its own privacy policy. We never see your card details.
You can ask to see, correct, export or delete your data at any time, and you can delete your account yourself.

1. Who we are

Helio Stitch is operated by City Embroidery Ltd (company number SC795815, registered office 1 Craigswood Gate, Baillieston, Glasgow, G69 7FD). We are the controller of the personal data described here. Contact us about anything in this notice at [email protected].

2. What we collect

Account details: your name, email address, password (stored only as a one-way hash, never in readable form), the business name and main use you give when signing up, and whether your email is verified. If you sign in with Google: your Google account identifier, name, email address and profile picture address.
Your content: your projects and designs, and the files you upload or import — stitch files, images, SVG files, fonts — plus thread palettes and settings saved to your account. Your content may itself contain personal data, such as names you embroider.
Teams: which team you belong to and your role in it, invitations you send (including the email address you invite) and who made each design. Everyone in a team can see and change the team’s designs, and sees the names of the other members.
Pictures and Auto digitize: pictures you add to your image library, and pictures you send to Auto digitize, with a record of each run and what it cost us.
Digitising services you connect: if you connect a digitising service (such as NetDigitizing) so its finished orders reach your account, the login you give for it — locked as soon as you save it, so that only the part of our system that fetches your orders can use it, and never shown again, even to you — and what we fetch with it: your orders’ names and numbers, their design files and run sheets, the service’s preview pictures and the artwork you sent the service. We use the login only to sign in to that service for you and fetch your finished orders.
Usage records: how much of your plan’s allowances you have used each month.
Shared links: if your plan has them, the designs you choose to publish by link, and how many times each link was viewed.
Sign-in sessions: for each device you are signed in on, a record of the browser description and IP address, so you stay signed in and can see and end your sessions.
Security and technical data: IP addresses and request details in our server logs, used for security, rate limiting and preventing abuse.
Error reports: when the app crashes it sends us a report — the error and where in the app it happened, technical details of what the app was doing, the page address, your browser description and your IP address — so we can fix it.
Billing: when you buy a paid plan, Lemon Squeezy tells us what we need to run it — customer and subscription identifiers, your plan and its status. We never receive your card details.
Messages: anything you send us by email.

3. Why we use it, and our lawful basis

Purpose	Lawful basis
Creating and running your account; storing, processing and showing you your designs; exports	Contract
Verifying your email, password resets, and service emails (security notices, changes to our terms)	Contract; legitimate interests in keeping accounts secure
Security, preventing fraud and abuse, rate limiting, server logs	Legitimate interests in keeping the Service and its users safe
Running teams: invitations, roles, and showing a team its own designs	Contract
Auto digitize: turning a picture you send into an editable design	Contract
Signing in to a digitising service you connect and fetching your finished orders from it	Contract
Fixing faults from error reports	Legitimate interests in a working Service
Running paid plans	Contract
Answering support requests, complaints and rights-holder notices	Legitimate interests; legal obligation where the law requires a response
Meeting legal and regulatory obligations	Legal obligation

We do not send marketing email unless you have asked for it. We do not sell your data, do not use your content to train machine-learning models, and do not make decisions about you by automated means that have legal or similarly significant effects.

We use these service providers, who process data only on our instructions:

Hetzner Online GmbH — hosts our servers and database, in the European Union.
Cloudflare, Inc. — network security and delivery; it handles connection data for every visit.
Brevo (Sendinblue SAS), France — sends account emails such as verification and password resets.
Anthropic, PBC, United States — only the pictures you send to Auto digitize, which its AI model reads to describe the design. It does not keep them to train its models.
Google — only if you choose to sign in with Google. Google’s own privacy policy covers your Google account.

Lemon Squeezy sells paid plans on our behalf as merchant of record. For the data you give at checkout it is an independent controller, not our service provider, and its own privacy policy applies.

We may also share data with professional advisers, with authorities where the law requires it, and with a buyer of our business if it is sold (we would tell you first). We never sell personal data.

5. International transfers

Hetzner and Brevo process data in the European Union, which UK law recognises as giving adequate protection. Anthropic processes the pictures you send to Auto digitize in the United States. Cloudflare and Google may also process data outside the UK and the EU, including in the United States; Lemon Squeezy, as an independent controller, does so under its own policy. Where our service providers transfer data outside the UK, we rely on the UK’s adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework for certified recipients) or on the Information Commissioner’s International Data Transfer Agreement or Addendum.

6. How long we keep it

Data	Kept for
Account details, designs, uploaded files and palettes	Until you delete them or your account. Deleting your account (Account ▸ Delete account) takes effect at once. If we close your account, it is deleted at the end of any export period our Terms give you. If you are in a team with others, the designs you made there belong to the team and stay with it
Pictures sent to Auto digitize	The copy held with the run: 30 days. The copy filed in your image library: until you delete it
Design history	Every change to a design, so it can be put back: 30 days; the state a design arrived in (as digitized, received, imported or copied) is kept while the design exists
The login for a digitising service you connect	Until you remove the connection or delete your account; removing it deletes the login at once. Orders already fetched stay until you delete them
Team invitations	30 days after they are accepted, withdrawn or expire
Shared links	Until you turn the link off or delete the design
Backups containing the above	Encrypted backups are kept for up to three years and are only ever restored whole, after a disaster. If one is restored, every deletion made since it was taken is made again
Server and access logs (including IP addresses)	14 days in our log store. The copy on the server itself is overwritten as it fills and deleted whenever the service is updated
Error reports	90 days
Sign-in sessions	Until you sign out, or 30 days after sign-in
Password-reset and verification links	Until used or expired
Billing records	Held by Lemon Squeezy under its own policy; we keep your subscription identifier, plan, status and dates for as long as the account or team they belong to

7. Security

Connections are encrypted, passwords are stored only as one-way hashes, and access to production systems is restricted. No system is perfectly secure; if a breach affecting your data occurs, we will tell you and the regulator where the law requires.

8. Your rights

You have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent you can withdraw it at any time. To use any of these rights, email [email protected]. We will reply within one month, free of charge, and may need to confirm your identity first. You can export your designs yourself at any time, and delete your account yourself from your Account page.

If you are unhappy with how we handle your data, please tell us. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113.

9. Cookies and browser storage

We set three cookies, all strictly necessary for the Service you ask for, so none needs your consent: hs_session, which keeps you signed in; hs_oauth, which lasts only for the few minutes of a Google sign-in and protects it from forgery; and hs_invite, which holds a team invitation you opened for up to 7 days, while you sign in or create an account to accept it.
Cloudflare may set strictly necessary security cookies to protect the Service from malicious traffic.
The app stores your display preferences (such as units and view settings) in your browser’s local storage, and — if the connection to us drops — keeps unsaved work as a draft in your browser until it can be saved. This stays on your device; clearing your browser data removes it.
We use no analytics, advertising or tracking cookies, and no third-party scripts, so there is no cookie banner.

10. Children

The Service is for people aged 18 and over. We do not knowingly collect personal data from anyone younger.

11. Changes to this notice

We will update this notice when how we use personal data changes, and change the date at the top. If a change is significant, we will email you before it takes effect.