Yes. WipeAway is operated by a UK-based sole trader and is designed to comply with UK GDPR (which mirrors EU GDPR following Brexit) and the UK Data Protection Act 2018.
What personal data WipeAway processes
WipeAway processes minimal personal data:
- Email address — collected at purchase and used to deliver your licence key and associate it with your Google account
- Google account email — read via OAuth to validate your licence; stored to prevent key sharing
- Payment data — handled entirely by Stripe; WipeAway never sees or stores card details
WipeAway does not process calendar event content as personal data — it is read transiently to perform the deletion you request and is never stored or logged.
Legal basis for processing
- Contract performance — processing your email address and licence information is necessary to fulfil the licence contract
- Legitimate interests — retaining email addresses for licence validation prevents fraudulent key sharing
Your rights under UK GDPR
- Right of access — you can request a copy of the personal data we hold about you
- Right to erasure — you can request deletion of your personal data (see How do I request deletion of my data?)
- Right to rectification — you can ask us to correct inaccurate data
- Right to object — you can object to processing based on legitimate interests
To exercise any of these rights, contact us. We will respond within one month as required by UK GDPR.
Data transfers
WipeAway uses US-based service providers (Stripe, Vercel, Resend, Upstash). These transfers are covered by the providers' own compliance frameworks (including EU-US Data Privacy Framework where applicable).