This page is for customers and their advisers who need to know how Player One fits with UK and EU data protection law. Read it with our Privacy Policy, which describes what we collect and why.
Player One is the controller for the website, accounts, billing and support. Email: hello@1p.dev.
You are the controller for everything inside your Player One instance. We are your processor.
We are established outside the UK and the EU and have not yet appointed representatives there under Article 27. You can contact us directly on any data protection matter at the email above.
| Purpose | Lawful basis |
|---|---|
| Providing your account and the service you bought | Contract (Art 6(1)(b)) |
| Taking payment and keeping billing records | Contract (Art 6(1)(b)); legal obligation for record-keeping (Art 6(1)(c)) |
| Support | Contract (Art 6(1)(b)) |
| Security, fraud prevention and defending payment disputes | Legitimate interests (Art 6(1)(f)) |
| Website analytics (cookieless, not linked to your account) | Legitimate interests (Art 6(1)(f)) |
| Service notices | Contract (Art 6(1)(b)); legal obligation where required |
| Marketing emails | Consent (Art 6(1)(a)) |
Inside your instance we act only on your instructions, which are the settings you choose and the tasks you give your agents. We process that data solely to host and operate your instance. We do not use it for our own purposes and we do not use it to train or improve any model.
Your responsibilities as controller. You must have a lawful basis for any personal data you put into your instance or connect to it, and you are responsible for the language-model providers you choose to connect. Content sent to those providers is processed under your agreement with them, and they are not our sub-processors.
Data processing agreement. Our data processing terms are available on request at hello@1p.dev. We are working to incorporate them into our customer terms so that they apply to every customer automatically.
Sub-processors. The third parties that process instance data on our behalf, under our own accounts. Each processes data for us under its own published data processing terms, linked here so that you can read them:
Google and Groq are mandatory and cannot be replaced. Indexing and voice transcription are intrinsic to the service. They cannot be disabled, and you cannot substitute your own provider account for ours. Google and Groq are therefore our sub-processors for every customer. If you are a controller, storing personal data in your instance means transferring it to Google under our account; you must have a lawful basis for that, and your own privacy notice and processor arrangements need to reflect it. If your obligations do not permit onward transfer to a processor you have not contracted with, do not store that data in Player One. Audio is sent to Groq only when voice features are used.
We will email customers at least 30 days before adding a sub-processor or changing what one receives, so that you can object or make other arrangements before the change takes effect.
Requests from people whose data is in your instance. We will refer them to you, and assist you in responding.
Where we are the controller, you may ask us to: give you access to your data (Art 15); correct it (Art 16); erase it (Art 17); restrict processing (Art 18); provide it in a portable format (Art 20); stop processing based on legitimate interests (Art 21); and withdraw consent (Art 7(3)).
Email hello@1p.dev. We may ask you to verify your identity. We respond within one month, extendable by up to two further months for complex requests, in which case we will tell you.
You may complain to a supervisory authority at any time: the Information Commissioner's Office in the UK (ico.org.uk), the data protection authority in your EU country, or the Office of the Privacy Commissioner for Personal Data in Hong Kong (pcpd.org.hk).
We are established in Hong Kong. Your instance is hosted in the United States, and the Google and Groq processing described in section 3 takes place in the United States. Neither Hong Kong nor the United States is covered by a UK or EU adequacy decision, so if you are in the UK or the EU your data is transferred outside those territories.
Transfers from us to our sub-processors are covered by the mechanisms in each provider's data processing terms, linked in section 3: Akamai Technologies, Inc. and Linode LLC are certified under the EU-US Data Privacy Framework and its UK Extension, which you can check on the Data Privacy Framework participant list at dataprivacyframework.gov; Google's Cloud Data Processing Addendum and Groq's Data Processing Addendum each incorporate the European Commission's standard contractual clauses and the UK transfer terms.
Transfers from you to us. Because we are established in Hong Kong, the transfer of personal data from you to us needs its own safeguard, separate from the ones above. We have not yet put the standard contractual clauses and the UK International Data Transfer Addendum in place for that transfer. If you are in the UK or the EU and need that safeguard before you store personal data, contact us at hello@1p.dev and we will provide the clauses for signature.
We keep personal data only as long as needed for the purpose it was collected, and then delete it. The periods for account, billing and support data are set out in the Privacy Policy.
Instance data is retained for as long as your subscription is active. After cancellation or non-payment your instance is deactivated and its data is then deleted. There is no infrastructure backup, so deletion is final. Export your data before your subscription ends.
Measures in place:
Not in place, stated so that you can assess suitability for your data:
If we become aware of a breach affecting instance data we will notify the affected customer without undue delay, with the information you need to meet your own obligations. Where we are the controller we will notify the relevant supervisory authority within 72 hours where required, and affected individuals where the breach is likely to result in a high risk to them. We keep a record of all breaches.
hello@1p.dev. Player One.