Last updated: 16 March 2026

Privacy Policy

This policy explains what personal data FourCandles collects, why we collect it, how we use it, and your rights under the UK GDPR and EU GDPR.

1. Who we are

FourCandles ("we", "us", "our") is an AI prompt management platform. For the purposes of data protection law, we are the data controller responsible for your personal data.

If you have any questions about this policy or how we handle your data, please contact us at privacy@fourcandles.ai.

2. Data we collect

We collect and process the following categories of personal data:

• Account data: your name and email address, provided when you sign in via Google OAuth or Replit Auth.
• Usage data: the prompts you create and save, AI conversations you conduct within the platform, and your activity history.
• Credit and transaction data: your current credit balance, tier, and a log of credit transactions (grants, deductions).
• Technical data: IP address, browser type, session identifiers, and server access logs.
• Communications: any messages you send to us directly (e.g. by email).

We do not collect payment card details directly. Any payments made externally are handled by the relevant payment processor.

3. How we use your data

We use your personal data to: provide, operate, and improve the FourCandles platform; authenticate you and maintain your account; process AI requests; manage your credit balance; detect and prevent abuse, fraud, and security incidents; comply with legal obligations; and respond to your enquiries and support requests.

4. Legal basis for processing

We rely on: contract performance, legitimate interests (security monitoring, fraud prevention), legal obligation, and consent.

5. Third parties we share data with

We share your data only as necessary to deliver the service: Google (OAuth & Gemini API), Replit (Auth & hosting), OpenAI, Anthropic, Perplexity AI, Neon (database hosting), and Google Cloud Storage. We do not sell your personal data to any third party.

6. International data transfers

Some third-party providers process data outside the UK and EEA. Where this occurs, we ensure adequate safeguards are in place.

7. Data retention

Account data is retained until you request deletion. Prompts and AI conversation history are retained until you delete them or close your account. Credit transaction logs are retained for up to 7 years. Server access logs are typically retained for 90 days.

8. Your rights

Under UK/EU GDPR you have rights of: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object. To exercise these rights, contact us at privacy@fourcandles.ai.

9. Cookies and tracking

FourCandles uses session cookies necessary for authentication. We do not use advertising or cross-site tracking cookies.

10. Security

We implement appropriate technical and organisational measures including encrypted connections (HTTPS), AES-256-GCM encryption at rest, access controls, and regular backups.

11. Children

FourCandles is not directed at children under 16. We do not knowingly collect personal data from anyone under 16.

12. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top.