Console Privacy Policy
Last updated: 14 October 2026
1. Who we are
Console is the trading name of Paul Alexander Films Ltd, a company registered in England and Wales (company number 16949226), registered office Cardigan House Ground Floor, Castle Court, Swansea, Wales, SA7 9LA. We make Cue, a booking and management platform for studios and venues.
This policy explains what personal data we collect as a controller, why, and what your rights are. It covers people who visit getconsole.app, people who sign up for or run a Console account, and people who contact us. It does not cover data that studios process through Cue about their own customers; section 2 explains that.
2. If you booked a studio that uses Cue
If you booked a room, joined a membership, or messaged a studio through a booking page powered by Cue, that studio is the controller of your data. We process it on the studio's behalf as its processor, under the studio's instructions and our Data Processing Addendum. The studio's own privacy notice applies.
To exercise your rights over that data, contact the studio directly. If you contact us instead, we will pass your request to the studio within 5 working days. We do not use studio customers' data for our own marketing.
3. What we collect
Account data. Your name, email address, phone number, business name and address, the subdomain you choose, and the login details for you and anyone you invite to your account.
Billing data. Your plan, billing history and invoices. Card details are collected and stored by Square, our payment provider, not by us. We see only the card type and last four digits.
Usage data. How you use the Service: pages visited, features used, actions taken, device and browser type, IP address and approximate location, and error logs. We use this to run and improve the Service and to keep it secure.
Support data. Anything you send us by email or through the Service when you ask for help, including screenshots.
Connected services. If you connect Stripe, Square, Meta, Microsoft 365, Google or Xero, we store the access tokens those services issue so the connection keeps working. We only read or write what the connection needs.
Marketing data. If you email us or sign up for updates, your name, email and what you told us about your business.
4. How we use it and why we are allowed to
| What we do | Data used | Lawful basis |
|---|---|---|
| Provide the Service and run your account | Account, usage, connected services | Performance of our contract with you |
| Take payment and send invoices | Account, billing | Performance of contract; legal obligation to keep accounting records |
| Send service emails (confirmations, billing, security alerts, changes to terms) | Account | Performance of contract |
| Answer support requests | Account, support | Performance of contract |
| Keep the Service secure and prevent abuse | Account, usage | Legitimate interest in protecting the Service and other tenants |
| Improve the Service and fix problems | Usage (aggregated where possible) | Legitimate interest in running a reliable product |
| Send product news and offers | Account, marketing | Consent for people who sign up on the website; legitimate interest for existing account holders, with an unsubscribe link in every email |
| Comply with the law and respond to lawful requests | Any | Legal obligation |
We do not sell personal data and we do not make automated decisions about you that have legal or similarly significant effects.
5. Who we share it with
We share personal data only with the providers we need to run the Service, each under a contract that restricts what they can do with it:
- hosting and database providers (Supabase, Railway, Vercel, Cloudflare)
- email and SMS delivery (Resend, Twilio)
- payment processing for your subscription (Square)
- messaging and social platforms you connect (Meta)
- AI processing for enquiry triage and suggested replies (Anthropic, which does not train on your data)
- our accountants, for billing records
- a buyer or successor if we sell or restructure the business, in which case this policy continues to apply
- regulators, courts or law enforcement where the law requires
The full list of sub-processors for studio data is in our Data Processing Addendum.
6. Cookies and analytics
The Service uses strictly necessary cookies and local storage to keep you signed in, remember your preferences and protect against attacks. These do not need consent.
The getconsole.app marketing site currently sets no analytics or advertising cookies. If we add them in future, they will only be set after you accept them in a cookie banner, and we will update this policy first. We do not place advertising cookies inside the Service itself.
7. International transfers
We store data in the UK and EU. Some providers process data in the United States. Where that happens we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK extension to the EU-US Data Privacy Framework, so your data gets the same level of protection as in the UK.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account data | While your account is open, then 30 days so it can be recovered, then deleted |
| Billing records | 6 years after the tax year they relate to, as HMRC requires |
| Usage and security logs | Up to 12 months |
| Support emails | 2 years after the issue is closed |
| Marketing sign-ups | Until you unsubscribe, or 2 years after your last interaction with us |
| Backups | Overwritten on a rolling schedule; not restored except for disaster recovery |
9. Your rights
Under the UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you
- correct anything that is wrong
- delete your data, where we no longer need it
- restrict or object to how we use it, including stopping marketing at any time
- give you your data in a portable format
- withdraw consent, where consent is the basis we rely on
Email hello@getconsole.app and we will respond within one month. We may ask you to confirm your identity first. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk, though we would welcome the chance to sort it out with you first.
10. Security
We protect your data with encryption in transit, encrypted storage at our hosting providers, per-tenant data isolation, role-based access, multi-factor authentication on administrative access, and daily backups. No system is perfectly secure, so please use a strong, unique password and tell us straight away if you think your account has been compromised.
11. Changes and contact
We may update this policy. If the change is significant we will email account holders before it takes effect. The date at the top shows when it was last changed.
Questions about this policy or your data: hello@getconsole.app, or write to Paul Alexander Films Ltd, Cardigan House Ground Floor, Castle Court, Swansea, Wales, SA7 9LA.