Privacy Policy

28 Aug 2026

This policy applies to the Sequence Tool® website, macOS application, and related services. It describes how Rock Stars Unlimited Ltd (“we”, “us”, “our”) processes personal data in line with UK data protection law.

1. Who we are

Sequence Tool® is operated by Rock Stars Unlimited Ltd (Company No. 13875186), registered in the United Kingdom. For privacy-related requests, use the privacy email.

2. Legal bases

We rely on the following legal bases under the UK GDPR. Contract: to provide your account, licensing, purchases, essential transactional email (for example receipts and magic-link sign-in), and required diagnostics if you voluntarily join the Sequence Circle early-access programme. Legitimate interests: to keep our services secure, investigate abuse, process pseudonymised authentication telemetry as described in section 3, run strictly limited and scrubbed error monitoring for failures that may occur before you can make a consent choice (for example pre-authentication login failures), and run privacy-focused website analytics in cookieless mode (we balance these interests against your rights). Consent: for optional in-app product analytics (PostHog) and broader in-app error monitoring (Sentry) outside Sequence Circle, which we enable after you agree and which you can turn off in the app’s Settings. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

3. Data we collect

Account and identity: email address when you create an account or sign in (for example via magic link).

Payment and licensing: information needed to process purchases (via Stripe), licence activation, and device association.

Support and issue reports: if you choose to report an issue from the Sequence app, we open an email draft addressed to support. The draft may include information you provide, plus auto-collected diagnostics such as app version and build, macOS version, Mac model, and whether the app support and cache directories are accessible. For model-related reports, the draft may also include model status and relevant local model path details. You can review and edit the email before sending it.

Product analytics and error monitoring: with your consent in the Sequence Tool app, we use PostHog for product analytics and Sentry for broader error monitoring and diagnostics. App analytics events use pseudonymous identifiers. When you are signed in and have enabled product analytics, we may internally associate a pseudonymous analytics identifier with your Sequence account and therefore with the email address held for that account. This allows us to understand product usage across your installations and account. We do not send your email address, name, account credentials, licence key, or authentication data to PostHog: PostHog receives the pseudonymous identifiers and a restricted set of product-usage fields. Strictly limited, scrubbed Sentry reporting may operate before a consent choice only for failures that can prevent you reaching or completing that choice, such as pre-authentication login failures; it does not attach your email or a Sentry user profile. On the website, PostHog runs in a cookieless configuration (no analytics cookies or local storage for that purpose).

Sequence Circle: if you join our voluntary early-access programme, we record your membership and require Sentry error reporting while you remain enrolled. Circle diagnostics may include app/build and operating-system versions, hardware characteristics, crash traces, performance information, feature or operation context, and scrubbed technical identifiers. Product analytics remains optional. Leaving Circle restores your previous error-reporting preference. See the Sequence Circle Terms.

Session replay (website): website session recording is disabled. We do not send website session-replay recordings to PostHog.

Security and authentication telemetry: to protect accounts and detect abuse, we process pseudonymised authentication logs, including hashed IP address and user-agent, coarse geolocation, a device fingerprint hash, and sign-in outcomes. These data can still identify you indirectly and are personal data. Default retention is 90 days. This processing is based on legitimate interests.

Technical data: we process IP addresses transiently at our network edge (for example Cloudflare) for security, abuse prevention, and service delivery. We do not durably store raw IP addresses in our product analytics or authentication telemetry systems; we retain pseudonymised, hashed identifiers derived from them as described above. We may also process browser and device type where needed to operate the service.

Email and newsletter: we send email through Postmark. Transactional messages (for example receipts, magic-link sign-in, account or security notices, and product onboarding email) do not use link tracking, links go directly to our sites and services. If you subscribe to our newsletter, we use double opt-in (you must confirm by email before your subscription is activated) and we store consent timestamps. Marketing newsletters may use link tracking so we can measure engagement in aggregate; we do not use email open tracking. Where a link is tracked, clicking it may cause Postmark to process the time of the click, IP address, approximate location, and browser or device information (for example via click.pstmrk.it).

We do not sell your personal data. We use it to provide the service, process payments, communicate with you, and improve and secure our product, as described in this policy.

4. How we use your data

We use the data we collect to: operate your account and licensing; process payments; send transactional email and (where you have confirmed) newsletters; run consented product analytics and, outside Sequence Circle, broader error monitoring in the app; require Sentry error reporting, which may include the Circle diagnostics described above, while you remain enrolled in Sequence Circle; diagnose strictly limited pre-consent login failures; run cookieless website analytics as described above; detect and investigate abuse using authentication telemetry; respond to support and security reports; improve and secure our app and website; and comply with legal obligations.

5. Third-party processors

We use processors who handle data on our behalf, including: Cloudflare (hosting, CDN, and edge security); Stripe (payments); Postmark (email delivery; link tracking on marketing newsletters only); PostHog (product analytics, cookieless on the website; in the app, only with consent); and Sentry (required error reporting, which may include Circle diagnostics, during Sequence Circle membership; otherwise consented in-app error monitoring, plus the strictly limited pre-consent login-failure reporting described above). We do not provide PostHog with the account-to-email mapping described in section 3; that mapping remains within Sequence’s account systems. Processors are bound by contracts (including data processing terms) that limit use of your data to providing services to us. We may also disclose data when required by law or to protect our rights and safety.

6. Cookies and similar technologies

We use cookies and similar technologies where needed for essential functions (for example keeping you signed in and security). Our website analytics (PostHog) runs without analytics cookies or local storage for that purpose. Because we do not use non-essential analytics cookies, we do not show a cookie consent banner. For full detail, see our Cookie Policy.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your data, or to object to or restrict certain processing. You may withdraw consent for optional in-app analytics and error reporting at any time in the app’s Settings. To exercise these rights or submit a data subject access request, see our Your rights page or contact us using the details below. You may also have the right to lodge a complaint with a supervisory authority.

8. Retention and security

Retention depends on the data: for example, authentication risk telemetry defaults to about 90 days; account and billing records are kept while your account is active and for a period afterwards where required for tax, legal claims, or compliance. Website session replay is disabled. Other data is retained only as long as needed for the purposes in this policy. We use appropriate technical and organizational measures to protect your data; no system is completely secure, and we cannot guarantee absolute security.

9. International transfers

Your data may be processed in countries outside the UK, including the United States, where providers such as Postmark, PostHog, Sentry, and Stripe operate. We ensure appropriate safeguards where required by applicable law, including the UK International Data Transfer Addendum or Agreement (IDTA) and EU Standard Contractual Clauses (SCCs), together with adequacy regulations where they apply.

10. Changes

We may update this policy from time to time. We will post the updated version on this page. We will notify you of material changes in an appropriate way (for example by email or an in-product notice). Where a change requires your consent under data protection law, we will seek that consent before the change takes effect.

11. Contact

For privacy questions or to exercise your rights, use the privacy email.

Sequence is made and operated by Rock Stars Unlimited Ltd. You can also read the company-wide UK GDPR Policy and verify our Information Commissioner’s Office registration (ZB688253). You may complain to the ICO; we would appreciate the opportunity to address your concern first.