Privacy Policy

Effective date: 12 July 2026

Baruchiel ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have. It applies to the Baruchiel website at baruchiel.com and all Baruchiel software products.

1. Who Is the Data Controller

Baruchiel is the data controller for personal data collected through the baruchiel.com website and through products where you deal with us directly (for example, your Mythos account).

An important exception:where a Baruchiel product is deployed for an organization and that organization enters its own members' personal data into it (as with Collector), the organization is the data controllerof its members' data and Baruchiel acts as a data processoron the organization's behalf, under a Data Processing Addendum forming part of that organization's agreement. Members with questions about how their data is handled in such a product should contact their organization first. See Section 6a below.

For all privacy-related requests and enquiries, contact us at [email protected].

2. Data We Collect

We collect only what is necessary to provide and operate our Services:

  • Identity and contact data: Your name and email address, collected when you create an account, subscribe to a product, or submit a contact form enquiry.
  • User-generated content: Data, files, and content that you voluntarily input into our software products in the course of using them.
  • Payment data: Payment transactions are processed entirely by our payment providers — Lemon Squeezy (Merchant of Record for self-serve subscriptions such as Mythos) and Paystack (online member payments in Collector). Baruchiel does not receive, store, or process your raw card details, mobile-money credentials, or banking information at any point.
  • Technical and server log data: When you access our Services, our servers automatically record standard information such as your IP address, browser type, and the date and time of your request. This data is used solely for security monitoring and operational debugging and is not used to profile or identify you.

3. What We Do Not Collect

We do not use cookies, advertising pixels, behavioural tracking scripts, or any third-party analytics tools on the baruchiel.com website. We use Google Search Console, which provides aggregated, anonymised data about how our site appears in Google Search results — it does not track individual users and sets no cookies on your device.

4. How We Use Your Data

We use your personal data for the following purposes:

  • To create and manage your account and deliver the Services you have subscribed to;
  • To send transactional emails — including account confirmations, billing notices, and support responses — via Resend, our email delivery provider;
  • To respond to enquiries submitted through our contact form;
  • To monitor and maintain the security and stability of our Services;
  • To send marketing or product update emails, but only where you have separately and explicitly opted in to receive them. Marketing opt-in is never bundled with account creation or Terms acceptance.

5. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and United Kingdom, we process your personal data on the following legal bases:

  • Contract performance: Processing necessary to manage your account, deliver your subscription, and provide the Services you have agreed to receive.
  • Legitimate interests: Security monitoring, fraud prevention, and maintaining the reliability of our infrastructure, where these interests are not overridden by your rights.
  • Consent: Marketing communications, where you have explicitly opted in. You may withdraw consent at any time.
  • Legal obligation: Where we are required to retain or disclose data to comply with applicable law.

6. Data Sharing

We do not sell, rent, or trade your personal data. We share data only with the following service providers, and only to the extent necessary for them to perform their function:

  • Lemon Squeezy: Payment processing, subscription management, and tax compliance in all jurisdictions as our Merchant of Record for self-serve subscriptions (e.g. Mythos Pro).
  • Paystack: Card and mobile-money payment processing for online member payments made through Collector.
  • Resend: Transactional email delivery (account, billing, and support emails).

These providers operate under their own privacy policies and are bound by appropriate data processing agreements.

6a. Product-Specific Data Practices

Mythos. Mythos is offline-first: manuscripts and worldbuilding data created in the desktop app are stored locally on your own device and are not transmitted to Baruchiel unless you create an account and enable cloud sync (a Pro feature). When sync is enabled, your content is stored on our servers solely to deliver synchronisation, version history, and backups, and remains yours.

Collector.Each Collector customer organization runs on its own single-tenant deployment. The organization controls what member data is entered (names, contact details, payment records) and configures its own SMS and email providers for member notifications; those providers act as sub-processors in respect of that organization's data. Baruchiel processes this data only on the organization's documented instructions, under the Data Processing Addendum in the organization's agreement, and never shares one organization's data with another. The public Collector demo instance contains sample data only — please do not enter real personal data into the demo.

7. International Data Transfers

Baruchiel is based in Ghana. Our service providers Lemon Squeezy and Resend are headquartered in the United States, and Paystack operates from Nigeria with regional entities. When your data is transferred outside your country of residence, we rely on appropriate legal mechanisms — including standard contractual clauses where required by GDPR — to ensure your data receives an adequate level of protection.

8. Data Retention

  • Account data: Retained for the duration of your account, plus two (2) years following account closure to enable dispute resolution and comply with applicable legal obligations, after which it is securely deleted.
  • Contact form submissions: Retained for twelve (12) months from the date of submission, then deleted.
  • Server logs: Retained for up to ninety (90) days for security purposes, then deleted.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data where we no longer have a lawful basis to retain it.
  • Portability: Request your data in a structured, machine-readable format.
  • Restriction: Request that we restrict processing of your data in certain circumstances.
  • Objection: Object to processing based on legitimate interests.

To exercise any of these rights, email [email protected]. We will respond within 30 days. We may request verification of your identity before processing your request.

10. Children's Privacy

Our Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at [email protected] and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email before the changes take effect. The updated policy will also be published at this page with a revised effective date.

12. Contact

For any privacy-related questions, requests, or complaints, contact us at [email protected].