Last updated: 31 August 2026
Privacy Policy
This policy explains how Joao Vitor Humenhuk Achutti, trading as Deadline Engine, handles personal data when you use Deadline Engine. Joao Vitor Humenhuk Achutti is the controller for the account, service and product records it handles. The address for legal documents is Allenby St 38, Tel Aviv-Yafo, Israel. Contact: deadlineengine@thesmios.com.
1. Who we are
Deadline Engine is operated by Joao Vitor Humenhuk Achutti, trading as Deadline Engine. This policy provides the information required by the UK GDPR and the Data Protection Act 2018 where those laws apply. For a purchase completed through Paddle Billing, Paddle acts as merchant of record and an independent controller for the transaction data it collects. Paddle provides its privacy information at checkout.
UK and EEA representatives
Deadline Engine is not accepting paid purchases while it completes its representative arrangements for the United Kingdom and European Economic Area.
2. We collect as little as possible
We deliberately collect the minimum personal data necessary to operate Deadline Engine. Specifically:
- Account: email address, optionally a name, and hashed password.
- Payment and subscription transaction: provided directly to Paddle. We receive the reference IDs, status, amount, currency and other records needed to grant access, reconcile the transaction and provide product support. We do not receive or store full card details.
- Calculations: the trigger date and parameters you enter. We do not require client names, court references, party names, or matter details. If you choose to enter such information in optional fields, it is stored under the security measures described below.
We do not collect, and we do not want, any of the following:
- Solicitor-client privileged information.
- Documents. We do not accept file uploads.
- Raw IP addresses as product records. Security infrastructure may process them temporarily, and a one-way hash may be stored with a terms-acceptance record.
- Browser fingerprints for advertising or cross-site tracking. A one-way hash of the browser user-agent may be stored with an acceptance record solely to evidence that acceptance.
- Tracking pixels from third parties.
- Marketing consent we do not need.
If you accidentally submit privileged information in a calculator field, contact deadlineengine@thesmios.com and we will delete it where we lawfully can.
3. Lawful basis
- Performance of contract for account, calculation, export and service-access data.
- Legitimate interests for security logs, abuse prevention, uptime monitoring, and audit defensibility.
- Legal obligation for accounting, tax, and compliance records.
- Consent for optional analytics.
4. How we use your data
- To authenticate you and manage your account.
- To calculate deadlines and show citations.
- To save calculations and maintain a calculation audit log.
- To support essential account verification and password reset through Neon Auth.
- To let Paddle act as merchant of record, take payment, handle applicable indirect taxes, issue transaction documents and provide transaction support.
- To grant paid access, reconcile transactions and provide product-level support.
- To detect abuse, investigate errors, and keep the service available.
5. Service providers, other controllers and international transfers
| Provider | Role | Purpose | Location | Safeguard |
|---|---|---|---|---|
| Neon | Sub-processor | PostgreSQL database, managed authentication and row-level access control | us-east-2, United States | Treat as an international transfer. Apply contractual safeguards where required. |
| Vercel | Sub-processor | Application hosting, serverless request processing and static asset delivery | Vercel infrastructure. Processing location may vary with the request and account configuration. | Standard Contractual Clauses and UK International Data Transfer Addendum where required |
| Paddle | Independent controller | Merchant of record, billing, transaction support, indirect tax handling and payment processing | United Kingdom, European Union and other locations described in Paddle privacy information | Provider privacy terms and applicable international transfer safeguards; processing location varies by service and customer |
| Plausible | Sub-processor | Analytics | Germany | UK adequacy decision |
| Namecheap | Infrastructure supplier | Domain registration | United States | No customer personal data intentionally processed |
Paddle acts as an independent controller, not our sub-processor, for Paddle Billing transaction data. The role shown for each other provider describes how it is used by Deadline Engine.
Where personal data is transferred outside the UK, the transfer is covered by the applicable provider terms and safeguards described above, including UK adequacy regulations, Standard Contractual Clauses or the UK International Data Transfer Addendum where required.
Deadline Engine does not promise UK-only data residency. The locations above describe the production configuration reviewed on 20 August 2026 and may change after notice under this policy.
Where reasonably practicable, Deadline Engine will give at least 30 days advance notice in writing before adding a material new sub-processor. Urgent security, legal or provider changes may require shorter notice, in which case notice will be given as soon as reasonably practicable. You may terminate your subscription during the notice period if you object to the new sub-processor and we cannot reach an acceptable arrangement.
6. How long we keep your data
| Data type | Retention | Reason |
|---|---|---|
| Account information | While account is active, plus 30 days after deletion | Account recovery |
| Saved calculations | While account is active, plus 30 days after deletion | User access |
| Evidence Record calculation payload | 30 days after checkout | Secure re-download and support |
| Evidence Record rule identifiers and citations | 7 years from checkout | Rule-correction and affected-order records |
| Calculation log | 7 years from calculation date | Audit defensibility |
| Cookie consent records | 13 months from the recorded choice | Evidence of an optional analytics choice |
| Payment and subscription records | 7 years from payment or cancellation | Accounting and tax records |
| Historical automated-email delivery logs | 90 days | Cleanup of records from the retired delivery service |
| Application and uptime logs | 30 days | Operational monitoring and debugging |
| Backup data | 30 days rolling | Disaster recovery |
When the retention period expires, we delete or anonymise the data within 30 days of expiry.
7. Your rights
- Access: request a copy of your personal data. Use account data export for self-service access.
- Rectification: correct inaccurate data. Use your account for self-service changes or contact us.
- Erasure: delete your account and associated personal data. Use account deletion for self-service deletion.
- Portability: receive your data in a machine-readable format. Use account data export.
- Restriction: ask us to limit processing.
- Objection: object to processing based on legitimate interest.
- Withdraw consent: use the cookie preferences link in the footer for cookie consent.
We will respond to rights requests without undue delay and normally within one month. If we need a lawful extension, we will explain it. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office at ico.org.uk.
For rights requests concerning transaction data held by Paddle, contact Paddle directly. You may still ask us about the transaction and subscription records retained by Joao Vitor Humenhuk Achutti.
8. Data-protection questions and complaints
To make a data-protection request, raise a concern or make a complaint, email deadlineengine@thesmios.com and use the subject line “Data protection request” or “Data protection complaint”. We acknowledge complaints within 30 days, investigate them fairly, keep you updated where appropriate and send an outcome without undue delay.
9. Cookies
We use strictly necessary cookies for authentication, security, and consent records. Optional analytics only loads after consent where consent is required. See the Cookie Policy.
10. United States privacy information
Deadline Engine does not sell personal information or share it for cross-context behavioural advertising. We do not use advertising pixels, build advertising profiles or make decisions based solely on automated processing that produce legal or similarly significant effects.
Where an applicable United States state privacy law gives you access, correction, deletion, portability or opt-out rights, you may use the contact route below. We will verify a request before acting and may ask for information needed to protect the account. Read the United States privacy notice for the categories, purposes and choices that apply to that notice.
11. Changes to this policy
Material changes will be notified in the product or on this page. Non-material changes are reflected here with an updated date at the top.