Privacy Policy

1. Who We Are

BraceKit ("we", "us", "our") operates bracekit.co.uk. BraceKit is operated by Synapted Ltd, a company registered in England and Wales (company number 16202593), with its registered address at 110 Cronin Street, London, SE15 6JD. We are the data controller for the personal data we collect. You can reach us at hello@mail.bracekit.co.uk.

2. What Data We Collect

3. Legal Basis for Processing (GDPR)

We process your data under the following lawful bases:

• Contract. Processing your account data and payment is necessary to provide you with the service you signed up for.
• Legitimate interest. Fraud prevention and security monitoring.
• Consent. Analytics cookies and site-usage tracking (you can manage this via the cookie settings link in the footer), and optional marketing emails (we don't currently send any). You have the right to withdraw your consent at any time by updating your cookie preferences or contacting us at hello@mail.bracekit.co.uk. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

4. Third-Party Services

We use the following third-party services that may process your data:

• Firebase Authentication (Google) — account management and sign-in. Privacy info
• Google Cloud Firestore — database storage. Privacy info
• Firebase Analytics (Google) — anonymous usage analytics. Privacy info
• Stripe — payment processing. Stripe acts as an independent data controller for payment data. Privacy info

Your data is stored on servers within the EU/UK or in jurisdictions that provide adequate data protection under UK GDPR. Where data is transferred outside the UK, appropriate safeguards (such as Standard Contractual Clauses) are in place.

5. Cookies

We use the following cookies:

• Authentication cookies — to keep you signed in. These are essential for the site to function.
• Analytics cookies (Firebase/Google Analytics) — to understand site usage. These are non-essential.
• Stripe cookies — set during the checkout process for fraud prevention and payment processing.

You can control non-essential cookies using the cookie settings link in the site footer, or through your browser settings. Blocking essential cookies may prevent the site from functioning correctly.

6. Data Retention

• Account data is retained for as long as your account is active.
• Payment records are retained for 7 years to comply with UK tax and accounting obligations.
• Analytics data is retained for up to 14 months (Google Analytics default).

When you delete your account, we will remove your personal data within 30 days, except where retention is required by law.

7. Your Rights (UK GDPR)

You have the right to:

• Access — request a copy of the data we hold about you;
• Rectification — ask us to correct inaccurate data;
• Erasure — ask us to delete your data ("right to be forgotten");
• Restriction — ask us to limit how we use your data;
• Portability — request your data in a machine-readable format;
• Object — object to processing based on legitimate interest.

To exercise any of these rights, email hello@mail.bracekit.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

8. Security

We take reasonable measures to protect your data, including encrypted connections (HTTPS), secure authentication via Firebase, and access controls on our backend systems. No system is 100% secure, but we work to protect your information.

9. Children

BraceKit is not directed at children under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Changes to This Policy

We may update this policy from time to time. We will post prominent notice of material changes on the Site. The "last updated" date at the top will always reflect the latest version.

11. Contact

For any questions about this policy or your data, email us at hello@mail.bracekit.co.uk.