Privacy Policy

Last updated 18 June 2026

This policy explains what personal data Cruxlab collects when you use this site or buy a review, why we collect it, and the rights you have over it. We keep what we collect to the minimum needed to do the work and run the business.

What we collect

We only collect what you give us and the minimum our suppliers need to run the service:

• Order details. Your email address and the brief you send us — the link, copy, campaign, or deck you want reviewed, plus any context you choose to add.
• Payment confirmation. When you pay, our payment processor (Stripe) confirms the transaction to us. We never see or store your card number — Stripe handles card data directly.
• Correspondence. Emails you send us and our replies.
• Basic technical logs. Our host (Cloudflare) keeps standard server logs (such as IP address and request time) to deliver the site securely and prevent abuse.

We do not use advertising trackers or analytics cookies, and we do not build profiles of visitors.

Why we use it, and our lawful basis

• To deliver the review you ordered — lawful basis: performance of a contract.
• To take payment and keep accounting records — performance of a contract and our legal obligation (tax/accounting law).
• To run, secure, and improve the service (for example, preventing fraud and abuse) — our legitimate interests, balanced against your rights.
• To reply to enquiries — performance of a contract or our legitimate interest in answering you.

Who we share it with

We do not sell your data and we do not share it for marketing. We use a small number of trusted suppliers ("processors") who only act on our instructions:

• Stripe — payment processing. See Stripe's privacy policy at stripe.com/privacy.
• Cloudflare — website hosting, content delivery, and security.
• Our email provider — to receive your brief and send your report.

We may also disclose data if the law requires it, or to establish or defend legal claims.

International transfers

Some of our suppliers are based outside the UK. Where personal data is transferred abroad, it is protected by appropriate safeguards recognised under UK data protection law (such as UK adequacy decisions or the International Data Transfer Agreement / Standard Contractual Clauses). This site self-hosts its fonts and assets, so simply loading a Cruxlab page does not transfer your data to any third party.

How long we keep it

• Order and payment records are kept for as long as the law requires us to (generally six years, for tax and accounting).
• The material you send for review is kept only as long as needed to do the work and handle any follow-up, then deleted. You can ask us to delete it sooner once your report is delivered.

Your rights

Under UK GDPR you have the right to: access the data we hold about you; have inaccurate data corrected; have your data erased; restrict or object to how we use it; and receive a copy in a portable format. To exercise any of these, email hello@cruxlab.xyz and we will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the UK regulator, the Information Commissioner's Office, at ico.org.uk — though we would appreciate the chance to put things right first.

Cookies

This site sets no advertising or analytics cookies. Our host (Cloudflare) may set a strictly necessary cookie to keep the site secure. No consent banner is needed for that, and nothing here tracks you across other sites.

Changes to this policy

If we change how we handle data, we will update this page and change the "last updated" date above.