GDPR / Data Rights

1. Data Controller

LoreHub is operated by Twilight Works Ltd, a company incorporated in England and Wales (company number 17373842), whose registered office is at Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom, which is the data controller for personal data processed through LoreHub.ai. Data protection enquiries: [email protected]

2. Your Rights Under GDPR

Right of access (Article 15)

You may request a copy of all personal data we hold about you. We will provide this within 30 days of a verified request, at no cost.

Right to rectification (Article 16)

If any personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. Most profile data can be updated directly in your account settings.

Right to erasure (Article 17)

You have the right to request deletion of your personal data. On account deletion, personal data is removed within 30 days. Some data may be retained for up to 7 years where required by law (e.g. billing records).

Right to data portability (Article 20)

You have the right to receive your personal data and content in a structured, machine-readable format. Use the Export function in your account settings.

Right to object (Article 21)

You may object to processing based on legitimate interests. We will assess the objection and either cease processing or explain why our legitimate interests override your rights in this instance.

Right to restriction (Article 18)

In certain circumstances, you may request that we limit how we process your data — for example, while a rectification request is under review.

3. Legal Bases for Processing

• Contract performance — delivering the Platform services you signed up for
• Legitimate interests — platform security, fraud prevention, pseudonymous first-party product-usage analytics
• Legal obligation — tax records, responding to lawful requests from authorities
• Consent — marketing emails (The Journal newsletter), optional analytics cookies

4. How to Submit a Data Subject Request

Email [email protected] with: your full name, the email address associated with your account, the specific right you wish to exercise, and any relevant context. We acknowledge requests within 5 business days and fulfil them within 30 days.

5. International Data Transfers

Your primary personal data is processed within the European Union, on server infrastructure located in Frankfurt, Germany (European Union). Where we use third-party processors with operations outside the EU or UK, we ensure appropriate safeguards are in place. One example: with your Analytics & Replay consent, we use Microsoft Clarity for session replay and heatmaps — some Clarity data is processed by Microsoft outside the UK, under Microsoft's appropriate safeguards for that kind of transfer, and Microsoft may use the resulting data in connection with Microsoft Advertising. See our Privacy Policy for the full third-party services disclosure.

6. Supervisory Authority

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with a supervisory authority. In the UK: the ICO (ico.org.uk). In the EU: the data protection authority in your country of residence.

We keep these documents under review and recommend you take independent legal advice on any that affect you.