1. What we collect
We collect only what we need to deliver the templates you bought and to run a small business:
- Account data, email address, hashed password, and (optionally) your name.
- Order data, the products you've bought, the price, and a receipt reference. Stripe handles the card details, we never see them.
- "How did you find us?" survey, if you answer the voluntary one-tap survey on your download page, we store your chosen channel (for example "Google search" or "Friend or colleague") against your order and use it only to understand which channels work; it is optional and asks for no free text or personal detail.
- Support correspondence, emails you send us, retained for the duration of the issue.
- Technical data, basic analytics (page views, country, device class) and, if you accept all cookies, Microsoft Clarity session-replay data (pages viewed, clicks, scrolling), retained for up to 12 months to help us improve the site. We also set a first-party
ls_acqcookie (30 days) recording how you reached us (referrer and campaign) so we can attribute a sale to a channel.
2. Lawful basis
We rely on three lawful bases under UK GDPR:
- Performance of a contract, to deliver the template you bought.
- Legitimate interests, to fight fraud, monitor site performance, and improve our products.
- Consent, for optional marketing emails only. You can withdraw consent at any time by clicking "unsubscribe".
3. Who we share data with
- Stripe, payments (PCI-DSS Level 1).
- Supabase, hosted database and auth, on AWS eu-west-2 (London).
- Resend, transactional email (receipts, download links).
- Vercel, static site hosting and CDN.
- Microsoft, product analytics and session replay (Microsoft Clarity), loaded only if you accept all cookies.
We do not sell your data. We do not share it for third-party marketing purposes, and we do not use advertising or remarketing cookies. If you accept all cookies, Microsoft Clarity records a replay of your session (pages viewed, clicks, scrolling) to help us improve the site; we do not use this to build an advertising profile of you.
4. International transfers
Our primary hosting region is the UK/EEA. Some support subprocessors (Resend, Vercel, and Microsoft Clarity where you have accepted all cookies) may process data in the United States under UK Addendum-compliant Standard Contractual Clauses.
5. How long we keep data
- Order records, 7 years (HMRC requirement for business records).
- Account data, until you ask us to delete it.
- Analytics, 12 months.
- Support emails, 24 months after the ticket closes.
6. Your rights
Under UK GDPR you have the right to:
- Access, request a copy of your data.
- Rectification, correct anything wrong.
- Erasure, ask us to delete your account (we'll keep order records for HMRC).
- Portability, get your data in a machine-readable format.
- Objection, opt out of marketing at any time.
- Complain, to the UK Information Commissioner's Office at ico.org.uk.
Email richard@letsafeuk.co.uk with the subject "Data request" to exercise any of these rights. We respond within one calendar month.
7. Security
Passwords are salted and hashed (bcrypt). All traffic is HTTPS-only with HSTS. Download links are signed with a 48-hour expiry. We enforce MFA on all staff admin accounts.
8. Cookies
We use strictly-necessary cookies for login sessions, and optional analytics cookies (Microsoft Clarity and the first-party ls_acq attribution cookie) that load only with your consent. See the cookie policy for the full list.
9. Children
LetSafe UK is a B2B product for adults. We do not knowingly collect data from anyone under 18. If you believe a child has submitted data to us, email us and we'll delete it immediately.