Privacy Policy

What we collect, and why

When you create an account

Your name, email address and password. The password is handled by our sign-in provider and we never see it. We need this to give you an account and to let a machine recognise you.

When you subscribe or buy a drink

Your card details go straight to Stripe, our payment provider. We never see or store your card number. We keep a record of each payment — the amount, the date, the machine, and the fee Stripe charged us — because we are legally required to account for it, and because it is how we know what you have paid for.

When you take a drink

Which drink, what size, which machine and when. This is what lets your subscription allowance work, and it tells the venue and us how the machine is being used.

If you use a referral code

The code you used and who referred you, so the right person gets their reward.

If you turn on notifications

A device token from your phone, so we can send you a push notification. Turning notifications off in your phone's settings stops this.

If you tick the marketing box

That you agreed, when, and the exact wording you were shown. We keep the wording so we can show you what you actually agreed to, even if we word it differently later.

Using a machine at a gym with your gym membership

If you scan a gym membership rather than the HydraX app, we check with the gym's system whether you are entitled to a drink, and record the drink that was poured. We receive a membership reference from the gym; we do not receive your gym account details.

Why we are allowed to hold it

We do not make any automated decisions about you that have a legal or similarly significant effect, and we do not profile you.

Who else sees it

We use a small number of companies to run the service. Each one only gets what it needs:

• Stripe — payments and subscriptions.
• Supabase — the database and sign-in behind the app.
• Google Firebase — push notifications.
• Resend — emails we send you.
• Railway and Vercel — hosting for the service and the operator dashboard.

We never sell your information, and we do not share it for anyone else's marketing.

Where it is held. Our database and your account sit on servers in Frankfurt, Germany. Some of the other providers listed above process data outside the UK and the EU. Where they do, that transfer is covered by the safeguards UK law requires — an adequacy decision, or the UK's International Data Transfer Agreement.

How long we keep it

• Your account: until you delete it.
• Payment and accounting records: six years from the end of the relevant tax year, which is what HMRC requires.
• Drinks poured: kept as a record of machine use.

When you delete your account we remove your login and your details, and cancel any subscription. The payment and drink records we must keep stay, but your name is removed from them — they no longer identify you.

Your rights

You can:

• See what we hold about you.
• Correct anything wrong.
• Delete your account — in the app, under Settings → Delete my account. It takes effect within 2 working days.
• Stop marketing emails — the switch in Settings, or the unsubscribe link at the bottom of any marketing email. One click, no sign-in needed.
• Ask for a copy of your information in a portable form.
• Object to or restrict what we do with it.

Ask us through the contact form at hydra-x.co.uk/contact and we will answer within one month.

If you think we have got it wrong, you can complain to the Information Commissioner's Office at ico.org.uk, or call 0303 123 1113. We would rather you told us first so we can put it right.

Children

HydraX is not intended for children. You need to be 18 or over to hold a HydraX account, because an account can hold a payment method and a subscription.

Changes

If we change this policy we will update the date at the top, and tell you in the app if the change matters to you.