How F.I.D. Studio handles legal compliance, GDPR, data protection, copyright, and company structure across its SaaS product portfolio.
Building software is fun. Building a legal and compliant software business is less fun — but it's non-negotiable. Here's how F.I.D. Studio approaches the legal and data protection side of our work.
Company Structure
All F.I.D. Studio products are operated under F.I.D. Integrated Services Ltd, a UK-registered company (Company No. 17005482, D-U-N-S: 234542901). We don't register a separate company for each product. Instead, each product is a trading name of the same legal entity: "F.I.D. Integrated Services Ltd trading as [product name]."
This means our Terms and Conditions, Privacy Policies, invoices, and data-controller statements all reference the same registered company. It's simpler, cleaner, and ensures consistent legal accountability across every product.
Copyright and Intellectual Property
Original code, designs, written content, and graphics created by F.I.D. Studio are protected by UK copyright automatically — there's no registration required. The copyright owner is F.I.D. Integrated Services Ltd.
All product materials carry the notice: "© 2026 F.I.D. Integrated Services Ltd. All rights reserved."
Trade-mark registration is optional and is being considered selectively for our strongest brands through the UK Intellectual Property Office. We're not rushing this — a trade mark is an investment that should be made when a brand is established enough to warrant protection.
GDPR and Data Protection
As a UK-based company processing user data, we're subject to the UK GDPR and the Data Protection Act 2018. Here's how we approach this:
Lawful basis: Each product has a clear lawful basis for processing user data, documented and communicated through Privacy Policies.
Special category data: Products like ChurchNote that process data revealing religious beliefs are classified as handling GDPR Article 9 special category data, requiring explicit user consent and additional safeguards.
Data minimisation: We collect only the data needed to provide each product's core functionality. No unnecessary data harvesting.
User rights: Users can access, export, and delete their data. These rights are built into each product, not added on request.
Row-level security: Where applicable, our data architecture uses row-level security to ensure users can only access their own data.
Sub-processors: We use established, reputable service providers (including authentication, payment processing, and hosting providers) and maintain awareness of their data protection practices.
What We Don't Do
- We don't sell user data. Ever.
- We don't use personal data for advertising profiling.
- We don't deploy tracking pixels or third-party analytics that compromise user privacy.
- We don't store payment credentials — all payment processing is handled by our payment providers under their own PCI-DSS compliant infrastructure.
- We don't place sensitive credentials, API keys, or service account files in public repositories or unsecured locations.
Ongoing Legal Work
We're transparent about the fact that some legal work is still in progress:
- We're working with a solicitor to confirm our legal structure, data-controller language, and contractor agreements.
- We're reviewing brand-name availability before any trade-mark investment.
- We're maintaining clear records of third-party licences, open-source obligations, and contractor assignments.
Legal compliance isn't a one-time checkbox — it's an ongoing process. We treat it that way.