Legal
Privacy Policy
Last updated 8 September 2026
This policy explains what personal data we collect when you use Edit Square, why we collect it, who we share it with, and the rights you have. It applies to our website (editsquare.com), the editor (app.editsquare.com), the dashboard (dashboard.editsquare.com), the player (play.editsquare.com), our API, and our emails.
In short
- You can use the editor without an account. Free projects live in your browser only and are never uploaded to us.
- If you create an account we hold your name, email and account details. Your card details go straight to Stripe; we never see them.
- Cloud projects and the media you upload are stored on servers we control, are private to your team, and are used only to provide the service to you.
- We use PostHog, hosted in the EU, to understand how the product is used. We do not sell personal data or use it for advertising.
- You can ask us to access, correct, delete or export your data at any time by emailing hello@editsquare.com.
1. Who we are
The data controller is Edit Square Ltd, company number 09971898, registered office 71-75 Shelton Street, London, United Kingdom, WC2H 9JQ. Our Information Commissioner’s Office (ICO) registration number is ZB180311.
Contact us about privacy at hello@editsquare.com.
Where you use Edit Square on behalf of a business and your projects contain personal data about other people, your business is the controller of that data and we are its processor. That processing is governed by the Data Processing Addendum in our Terms of Service. This policy covers the data for which we are the controller.
2. The data we collect
2.1 Using the editor without an account
You can use the editor without telling us who you are. In that case:
- your project is stored in your browser’s session storage and is not sent to our servers;
- your browser requests fonts, starter templates, preset previews and other assets from our content delivery network, which sees your IP address and browser details as part of serving those requests;
- if you search stock media, your search terms are sent to Pexels and Pexels’ own privacy policy applies to that request; and
- we collect product analytics events as described in section 2.5.
2.2 Account and profile data
When you create an account, or when someone invites you to their team, we collect your name, email address, and profile picture if you add one, together with the organisation, teams and roles you belong to. Sign-in is handled by our authentication provider, Clerk, which also records the sign-in method you use, the devices and IP addresses you sign in from, and security events.
If you buy a plan before creating an account, we collect your email address at checkout so that we can set up your account after payment.
2.3 Billing data
Payments are processed by Stripe through our billing platform, Autumn. We receive your billing name, email, country, the plan and add-ons you have bought, invoice history, and a token that identifies your payment method (for example, the last four digits and card brand). We never receive or store full card numbers.
2.4 Your content
Cloud projects, the media and fonts you upload, thumbnails and previews we generate, render outputs, template form responses, and the edit history of each project are stored on our systems so that we can provide the service. This may include personal data about you or other people, such as faces, voices and names that appear in your videos. We do not look at your content except where needed to provide support you have asked for, to investigate a suspected breach of our Terms, or where the law requires it. We do not use your content to train AI models.
2.5 Usage and device data
We use PostHog, hosted in the European Union, to collect product analytics: the pages and features you use, the actions you take in the editor (for example “export started”), performance and error information, and technical details such as browser type, screen size, operating system, rough location derived from IP address, and a randomly generated identifier. Once you sign in, these events are linked to your account. We do not record your screen or keystrokes.
Our servers and content delivery network also keep standard logs of requests, including IP address, timestamps and the resource requested.
2.6 Communications
When you email us, contact support, or reply to one of our emails, we keep the correspondence. Our email provider, Resend, records whether transactional emails (such as invitations and sign-in links) were delivered.
2.7 API and integrations
If you use our API or webhooks we log requests, including your API key identifier, IP address, endpoint and response status, and store the webhook endpoints and secrets you configure.
2.8 Data about other people
If you invite someone to your team, we use their email address to send the invitation. If you upload content that contains other people’s personal data, you are responsible for having the right to do so.
3. Why we use your data and our lawful basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Providing the service: running the editor, storing and syncing projects, rendering, teams, API and player | Account, content, usage, API data | Performance of our contract with you |
| Setting up your account after a purchase, and sending sign-in links | Email address | Performance of our contract |
| Taking payment, invoicing, managing subscriptions and preventing fraud | Billing data | Performance of our contract; legal obligation (tax and accounting records) |
| Sending transactional emails: invitations, sign-in links, receipts, render notifications, changes to the service or these terms | Account data | Performance of our contract; legitimate interests in keeping you informed |
| Understanding how the product is used, fixing bugs and improving it | Usage and device data | Legitimate interests in improving the service; consent where required for cookies |
| Keeping the service secure and enforcing our Terms | Account, usage, log and content data | Legitimate interests in protecting the service and our users; legal obligation |
| Providing support when you contact us | Communications, account and, where needed, content data | Performance of our contract; legitimate interests |
| Marketing emails about new features | Email address | Consent, which you can withdraw at any time using the unsubscribe link |
| Complying with the law and responding to lawful requests | Any | Legal obligation |
Where we rely on legitimate interests we have considered the impact on you and believe that it is not outweighed by your rights. You can object to processing based on legitimate interests (see section 8).
4. Who we share your data with
We share personal data only with the service providers below, who process it on our behalf under contracts that require them to protect it, and only as needed to provide the service.
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Clerk | Authentication, accounts and organisations | United States |
| Convex | Application database and backend | United States |
| Bunny.net | File storage and content delivery for uploads, projects, renders, fonts and templates | European Union, with edge servers worldwide |
| Stripe | Payment processing | United States and EU |
| Autumn | Subscription and billing management | United States |
| Resend | Transactional email | United States |
| PostHog | Product analytics | European Union |
| Trigger.dev | Cloud render job orchestration | United States |
| Scaleway | Cloud render workers | European Union (France) |
| Cloudflare | Hosting of our website and apps, and network security | Worldwide edge network |
| Pexels | Stock media search, only when you use it | United States |
We may also disclose personal data where required by law or a court order; to protect the rights, property or safety of Edit Square, our users or others; or to a buyer or successor if our business is sold or merged, in which case we will tell you before your data is transferred and becomes subject to a different privacy policy.
We do not sell personal data, and we do not share it with advertisers.
5. International transfers
We are based in the United Kingdom. Some of the providers above process data in the United States or elsewhere outside the UK and the European Economic Area. Where they do, we rely on one or more of the following safeguards: the UK’s adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified); the UK International Data Transfer Agreement or Addendum; or the EU Standard Contractual Clauses. You can ask us for more information about the safeguards for a particular transfer.
6. How long we keep data
- Free, no-account use: nothing is stored on our servers beyond short-lived request logs and analytics events.
- Account data: for as long as your account exists. When you delete your account, or ask us to, we delete it within 30 days, apart from what we must keep under the next bullet.
- Content: for as long as the project or file exists in your account. When you delete a file it is removed from your account straight away and permanently deleted after a grace period of at least 24 hours. When you delete a project or a render it is removed from your account straight away and permanently deleted in our next monthly purge. Backups are overwritten in the normal cycle of our systems. After a paid plan lapses, we keep your projects for 90 days so that you can export them or resubscribe, then delete them after notice.
- Billing records: six years after the end of the financial year they relate to, as required by UK tax law.
- Analytics: 24 months, after which data is deleted or anonymised.
- Support correspondence: two years after the matter is closed.
- Request and security logs: up to 90 days.
7. Cookies and similar technologies
We use a small number of cookies and browser storage keys:
- Essential. Cookies set by Clerk to keep you signed in across app.editsquare.com and dashboard.editsquare.com, and security cookies set by Cloudflare. Browser storage in the editor holds your free project draft (session storage) and editor preferences such as recently used commands. These do not need consent.
- Analytics. On our website (editsquare.com), PostHog runs in a cookieless mode: it sets no cookies and writes nothing to your browser’s storage, and visits are counted using a server-side hash that cannot be used to recognise you across visits. In the editor and the dashboard, PostHog sets cookies and local storage to recognise your browser across visits and to link events to your account when you sign in.
You can also block or delete cookies in your browser settings, although the service may not work properly without the essential ones. The ICO has guidance on managing cookies at ico.org.uk.
8. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- correct it if it is inaccurate;
- delete it, in some circumstances;
- restrict how we use it, in some circumstances;
- object to processing based on legitimate interests, and to direct marketing at any time;
- port data you gave us to another service in a machine-readable format; and
- withdraw consent where we rely on it, without affecting processing done before you withdrew.
Much of this you can do yourself: you can update your details, export your projects, and delete projects and your account from the dashboard. For anything else, email hello@editsquare.com. We will respond within one month. We may ask you to confirm your identity first. We do not charge for these requests unless they are clearly excessive.
If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. If you live in the EU you can complain to your local supervisory authority. We would appreciate the chance to resolve your concern first.
9. Security
We protect your data using measures including encryption in transit, encrypted storage, signed time-limited URLs for private files, access controls, and regular review of our providers. No system is completely secure, so please use a strong sign-in method and tell us straight away if you think your account has been compromised.
10. Children
Edit Square is not intended for people under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. The current version, with the date it was last updated, is always at editsquare.com/privacy. If we make a material change we will tell you by email if you have an account, or by a notice in the product.
12. Contact
Edit Square Ltd, 71-75 Shelton Street, London, United Kingdom, WC2H 9JQ. Email: hello@editsquare.com.