Privacy Policy

Who we are

Ashley Worrall, trading as Bric the Robot, 11 West Croft, Berinsfield, Oxfordshire, OX10 7NL, United Kingdom. I am the controller of the personal data described here. Contact me through the Contact page.

The short version

We only record your email address, your purchase history and, if you write to us, the name you give. We never sell your details or pass them on to anyone for marketing. They are shared only with the services that are needed to run the shop (listed below).

What we collect

• Email address — to confirm your account, log you in, deliver your downloads and reply to you.
• Password — stored only as a salted one-way hash (scrypt); we can never see or email it back to you.
• Order and subscription records — what you bought, when, the amount, and the payment status sent to us by Stripe (we never see your card details).
• Consent record — the boxes you ticked when you signed up and at checkout (18 or over; the Terms; immediate access / loss of cancellation right), with the time, an anonymised IP hash and your browser type.
• Download log — which file you downloaded and when (to apply the daily limit and prevent sharing).
• Your name — only if you give it to us in the contact form (and Stripe collects the name on your card, which we do not store).
• Messages you send through the contact form.

What we do not collect

No children's data. No analytics or advertising trackers. IP addresses are stored only as a salted one-way hash.

Why (legal basis)

To perform our contract with you; to meet legal obligations (tax and accounting records); and our legitimate interest in keeping the site secure and preventing abuse.

Who we share it with

We do not sell it, rent it or give it to anyone else. The only others who handle it do so on our behalf, for these purposes only:

• Stripe — takes payments, handles tax, fraud checks and the subscription portal.
• Resend — sends the confirmation, password-reset and contact emails.
• Our hosting provider — the server the site runs on.

We will disclose information only if the law requires it.

How long we keep it

• Inactive accounts: if you don't log in for 12 months, we delete your account: your email address, password hash, purchase history, consent records and download log, and with them access to the digital content you bought. We email a reminder at least 14 days before. Active Bric Club members are kept while the membership is live.
• Contact messages: deleted after 12 months.
• Payment records: Stripe is the seller of record and keeps its own payment and tax records as the law requires; we do not control those.
• Login and password-reset links: 15 minutes. Sessions: 30 days.

You can also ask us to delete your account at any time.

Your rights

You can ask to see, correct or delete your data, or object to how we use it, by using the Contact page. You can complain to the Information Commissioner's Office (ico.org.uk).

Last updated: 7 November 2026 · Version 2026-11-08-v3