Privacy Policy

1. Who We Are

MdPlex is operated by AP Resourcing Ltd, a company registered in the United Kingdom. We are the data controller for the personal data described in this policy.

2. What Data We Collect

Account Information

When you create an account, we collect your name, email address, and any other information you provide during registration.

Payment Information

If you subscribe to a paid plan, payment is processed by Creem. Creem collects and stores your payment details (e.g. card number, billing address). We receive a transaction reference and billing status from Creem, but we do not store your full payment card details.

Usage Data

We collect product and site analytics using PostHog. PostHog helps us understand how the site and product are used (e.g. page views, feature usage, referral sources) so we can improve them. Depending on the page, this may involve cookies or similar technologies and may include identifying logged-in users to tie activity to their account.

Content

We store the documents and data you create within MdPlex in order to provide the Service.

3. Cookies

We use a small number of cookies, strictly for functional purposes:

Authentication cookies — to keep you logged in.
Session cookies — to maintain your session state while using the app.

We do not use tracking cookies, advertising cookies, or third-party marketing cookies. Because our cookies are strictly necessary for the Service to function, we do not require cookie consent under UK GDPR/PECR.

4. How We Use Your Data

We use your personal data to:

Provide and maintain your MdPlex account and the Service.
Process payments and manage your subscription.
Send you important service communications (e.g. billing confirmations, security alerts, terms updates).
Respond to support requests.
Detect and prevent fraud, abuse, or security threats.

We do not sell your personal data. We do not use your data for advertising or profiling.

5. Legal Basis for Processing (UK GDPR)

We process your personal data under the following lawful bases:

Contract — processing necessary to provide the Service you signed up for (account management, content storage, payment processing).
Legitimate interests — security monitoring, fraud prevention, and service improvement, where our interests do not override your rights.
Legal obligation — where we are required to retain or disclose data by law.

6. Who We Share Data With

We share data only with:

Creem — our payment processor, to handle subscriptions and billing.
Infrastructure providers — hosting and cloud services that store and serve your data, under data processing agreements.
Law enforcement or regulators — only where required by law.

We do not share your data with advertisers, data brokers, or any other third parties for marketing purposes.

7. International Transfers

Your data may be processed outside the UK where our infrastructure providers operate. Where this happens, we ensure appropriate safeguards are in place (e.g. standard contractual clauses or adequacy decisions) to protect your data in line with UK GDPR.

8. How Long We Keep Your Data

Account data — retained while your account is active, and for up to 90 days after deletion to allow for recovery and comply with legal obligations.
Payment records — retained for up to 7 years as required by UK tax and accounting regulations.
Support correspondence — retained for up to 2 years after resolution.

9. Your Rights

Under UK GDPR, you have the right to:

Access your personal data (request a copy).
Rectify inaccurate or incomplete data.
Erase your data ("right to be forgotten"), subject to legal retention requirements.
Restrict processing in certain circumstances.
Data portability — receive your data in a structured, machine-readable format.
Object to processing based on legitimate interests.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

10. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), secure authentication, and access controls. However, no system is 100% secure, and we cannot guarantee absolute security.

11. Children

MdPlex is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

12. Changes to This Policy

We may update this privacy policy from time to time. We'll notify you of material changes via email or a notice on the website. The "last updated" date at the top shows when the policy was last revised.

13. Complaints

If you're unhappy with how we handle your data, please contact us first at [email protected]. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection authority.

14. Contact

For any privacy-related questions, email [email protected].