Edit9
PricingSign in

Privacy Policy

Last updated: 27 September 2026

This policy explains what personal data Shushuo Ltd. (“Edit9”, “we”, “us”) collects when you use edit9.app, why, who we share it with, and the rights you have over it. We are the controller of that data under the UK GDPR and the Data Protection Act 2018.

Shushuo Ltd., 7 Copperfield Road, Coventry, West Midlands, CV2 4AQ, United Kingdom. Contact: [email protected].

What we collect

  • Account details — your email address, and, if you sign in with Google, the name and profile picture Google shares with us. Your language and market preferences.
  • Your work — the designs you make, the pictures and other files you upload, what you ask the built-in assistant, and the record of each conversation with it, including the steps it took.
  • Billing — your plan, your credit balance and how it was spent, and the identifiers Stripe gives us for your customer record and subscription. Card details go to Stripe directly; we never see or store them.
  • Projects you share — who you invite to a project, by email address, and what role they have.
  • Technical data — IP address, browser and request logs, kept by our hosting provider to run and secure the service.

Why we use it, and on what basis

  • To provide the service you signed up for (performance of a contract): signing you in, storing and rendering your designs, running the assistant, taking payment, and sending the emails the service needs, such as sign-in codes and receipts.
  • To keep it working and secure (our legitimate interests): preventing abuse, diagnosing faults, and understanding why the assistant behaved as it did. Our staff can read an individual design’s assistant record for this purpose. That access is limited to administrators.
  • To meet legal obligations: keeping billing records for tax purposes.

We do not sell your personal data, we do not show you advertising, and we do not use your work to train models of our own.

AI processing

When you ask the assistant for something, or generate a picture, your request, the design it applies to and any pictures involved are sent to a model provider to produce the result. We route these requests through OpenRouter, which passes them to the provider serving the model in use. Those providers process the content to return a response under their own terms.

Who we share it with

We use these processors, each only for the purpose listed:

  • Supabase — sign-in and account verification.
  • Stripe — payments, subscriptions and invoices.
  • Resend — sending email.
  • OpenRouter, and the model providers it routes to — generating text, designs and pictures.
  • Railway, and our cloud storage provider — hosting the application, its database and your files.

We also disclose data where the law requires it, and to a successor if the business is sold or reorganised, under the same protections.

International transfers

Some of these processors store or process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum, so that your data keeps an equivalent level of protection.

Cookies

We set two cookies, and both are strictly necessary:

  • a session cookie that keeps you signed in;
  • NEXT_LOCALE, which remembers the language you chose.

We use no analytics, advertising or tracking cookies, so there is nothing to opt in to.

How long we keep it

  • Account details and your work — for as long as your account exists.
  • Billing records — six years after the transaction, as UK tax law requires, even after your account is deleted.
  • Server logs — for the short period our hosting provider retains them.

To delete your account, email [email protected] from the address you sign in with. We delete your account and your work within 30 days, apart from what we must keep by law.

Your rights

You have the right to access your personal data, to correct it, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. To exercise any of these, email [email protected]. We will answer within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put it right first.

Children

Edit9 is not for anyone under 13, and we do not knowingly collect their data.

Changes

We will update this page when our practices change and revise the date at the top. If a change is significant, we will tell you by email before it takes effect. See also our Terms of Service.