Privacy policy

Last updated: 11 June 2026

This policy explains what personal data FablePool collects, why, and what you can do about it. FablePool is operated by Barras Industries Ltd (the "data controller"), a company registered in England & Wales — company number 15954079, registered office Carlisle House, Carlisle Street, Goole, DN14 5DS. For any privacy question or request, contact matthew@barrasindustries.com.

What we collect

• Account data. When you sign in with Google we receive and store your Google account identifier, email address, name, and profile picture. We do not receive your Google password.
• Payment data. Card payments are processed by Stripe. We never see or store your card number — Stripe does. We retain a record of your purchases (amount, currency, date, Stripe reference) for accounting and to maintain your credit balance.
• Activity data. The projects you create, prompts you submit, credits you buy and pool, and the resulting build logs and ledger entries. By design, prompts, build logs, and the credit ledger are public — this is core to how FablePool works.
• Content you submit. Prompts and project material you provide are sent to our AI provider (Anthropic) to plan and run builds.
• Waitlist email. If you joined the launch waitlist, we store your email address and the IP address used to submit it, to prevent abuse.
• Anonymous analytics. We record page views using a daily-rotating anonymous visitor hash. Raw IP addresses and browser user-agents are never stored, and this data cannot be linked back to you.

Why we use it, and our legal basis

• To provide the service (your account, running builds, maintaining your credit balance) — legal basis: performance of our contract with you.
• To process payments and keep financial records — legal basis: contract, and legal obligation (tax and accounting law).
• To keep the service secure and prevent abuse (rate limiting, the waitlist IP record, fraud prevention) — legal basis: our legitimate interests.
• To understand and improve the site via anonymous analytics — legal basis: our legitimate interests.
• To run your builds, which involves sending your prompts and project content to our AI provider — legal basis: performance of our contract with you.

Who we share it with

We do not sell your personal data. We share it only with the service providers needed to operate FablePool:

• Google — sign-in / authentication.
• Stripe — payment processing.
• Anthropic — AI processing of prompts and project content.
• Our hosting and infrastructure providers — to run the service.

We may also disclose data where required by law.

International transfers

Some of our providers (including Google, Stripe, and Anthropic) are based in the United States. Where personal data is transferred outside the UK, it is protected by appropriate safeguards — such as UK adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

Cookies

FablePool uses a single, strictly necessary cookie:

• tp_session — keeps you signed in. It is set only after you log in, is HttpOnly, uses SameSite=Lax, and expires after 30 days.

We do not use advertising, marketing, or third-party tracking cookies, so no cookie consent banner is required. Our analytics run server-side and do not set any cookie.

How long we keep it

• Account data — for as long as your account exists; deleted on request (see below).
• Session records — expire automatically after 30 days.
• Payment and ledger records — retained for as long as required by UK tax and accounting law (generally six years), because the ledger is append-only and double-entry.
• Public records — prompts, build logs, and ledger entries are published as part of the service. We can disassociate your name from a closed account, but financial ledger entries are retained for the legal period above.
• Anonymous analytics — contains no personal data.

Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, or object to our use of your personal data, to data portability, and to withdraw consent where we rely on it. To exercise any of these, email matthew@barrasindustries.com and we will respond within one month.

• Deletion ("right to be forgotten"). Email us and we will delete your account and associated personal data. Note that, because the public ledger and build logs are integral to the service and to our financial records, we will anonymise rather than erase ledger entries we are legally required to keep.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Children

FablePool is not intended for anyone under 18, and we do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top reflects the latest version, and material changes will be noted on the site.