Privacy Policy

This privacy policy applies to Brandkraft Ltd, a company registered in England and Wales (Company No. 16 — see footer for full registration details), trading as Brandkraft. Our registered office is at Lancashire Digital Technology Centre, Bancroft Road, Burnley, Lancashire, BB10 2TP.

We operate the website brandkraft.co and associated services. When we refer to "Brandkraft", "we", "us" or "our" in this policy, we mean Brandkraft Ltd.

For any privacy-related questions, contact us at hello@brandkraft.co or by post to the address above.

We collect personal data in the following ways:

• —Contact forms — name, email address, phone number, company name, and the content of your message.
• —Book a Call — name, email, and any information you choose to share ahead of your call.
• —Account registration — email address and password (stored securely via Supabase Auth).
• —Project collaboration — files, messages, and feedback shared within the client dashboard.
• —Analytics — anonymised usage data collected via privacy-respecting tools (no personal identifiers).
• —Cookies — session cookies required for authentication; no third-party tracking cookies without consent.

We do not collect sensitive personal data (as defined under UK GDPR Article 9) and we do not knowingly collect data from children under 16.

We use your personal data for the following purposes and on the following legal bases:

We do not sell your personal data. We share it only with trusted third-party service providers who help us operate our business, and only to the extent necessary:

• —Supabase — database, authentication, and file storage (EU/US region, SOC 2 compliant).
• —Resend — transactional email delivery.
• —OpenAI — AI-assisted features within the client dashboard (no personal data is used to train models).
• —Vercel — website hosting and deployment (EU edge network).
• —Calendly / third-party scheduling tools — if you book a call via an embedded scheduler.

All processors are bound by data processing agreements and are required to handle your data in accordance with UK GDPR. Where data is transferred outside the UK/EEA, appropriate safeguards (Standard Contractual Clauses or adequacy decisions) are in place.

We use cookies solely to keep you logged in to the client dashboard (session cookies). These are strictly necessary and do not require consent. We do not use advertising, tracking, or analytics cookies that identify you personally.

You can control cookies through your browser settings. Disabling session cookies will prevent you from accessing the authenticated dashboard.

We retain personal data only for as long as necessary:

• —Enquiry and contact data — up to 2 years after last contact, unless you become a client.
• —Client project data — for the duration of the engagement plus 6 years (UK statutory accounting requirement).
• —Account data — until you request deletion or your account is inactive for 3 years.
• —Marketing consent records — until you withdraw consent plus 1 year.

Under UK GDPR, you have the following rights regarding your personal data. To exercise any of them, email hello@brandkraft.co and we will respond within 30 days.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

We take reasonable technical and organisational measures to protect your data against unauthorised access, disclosure, or loss. These include encrypted data storage, access controls, and secure authentication. No transmission over the internet is completely secure, but we take all practical steps to protect your information.

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. For significant changes, we will notify active clients directly. Continued use of our website or services after changes constitutes acceptance of the updated policy.

For any privacy-related queries or to exercise your rights, please contact: