Privacy Policy

Last updated: 25 October 2026

Brackstone Digital ("we", "us", "our") is committed to protecting your personal data. This policy explains what data we collect, why we collect it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Brackstone Digital is a B2B digital growth service based in Yorkshire, UK. Brackstone Digital Limited is the controller of the personal data described in this policy, except where Section 3 or Section 6 says we act for a client business as its processor. For any data protection queries, email us at info@brackstonedigital.co.uk. Please do not use the teardown booking form for these, because that form reports bookings to Google Ads when you have accepted cookies.

Brackstone Digital Limited is registered with the Information Commissioner's Office (registration number ZC268817). You can check the ICO register.

2. What data we collect

When you submit our contact form, we collect:

• Your full name
• Your email address
• The type of business, if you tell us
• Your message

When you request a free trial, we collect:

• Your name, if you provide it
• Your business name, email address and phone number
• Your industry and, if you choose Other, your description of the business
• Your website and notes about missed calls, if you provide them
• A security-check token, your IP address and browser information to check requests and limit spam

Only if you accept advertising cookies, we also send the page where you made the request, the ad click ID (gclid) and UTM tracking tags with your trial request to help us understand which advert brought you here. Declining cookies does not stop your trial request.

Whenever you visit this website, our website host, GitHub Pages, receives your IP address, browser information and the address of each page you request, and logs IP addresses for security. This happens whether or not you accept cookies (see Section 5). Advertising cookies are set only if you accept them (see Section 7).

3. Why we use it and our legal basis

We use your data for the following purposes. Each one names the legal basis we rely on under UK GDPR.

• To respond to your enquiry: We use your name and email to reply to your message. Legal basis: legitimate interests, so we can answer the people who contact us.
• To follow up on your enquiry: We may send a small number of follow-up emails about it. Legal basis: legitimate interests.
• To run the free trial you asked for: We record your trial request, contact you and set up your receptionist. Legal basis: taking steps at your request before entering into a contract, and then providing the trial.
• To send service emails about your trial: The emails needed to run the trial, such as go-live instructions, access details, usage and a pause. Legal basis: taking steps at your request before entering into a contract, and then providing the trial.
• To send marketing emails to trial users: Including tips on getting the most from the trial, suggestions to move to a paid plan, and news about our own similar services. Legal basis: legitimate interests. Under the Privacy and Electronic Communications Regulations we rely on the "soft opt-in": you gave us your details when requesting a trial, you can refuse marketing at sign-up by ticking "Don't send me marketing emails" on the trial request form, and every marketing email has an unsubscribe link you can use at any time, including during the trial.
• To check requests and limit spam: Using the security-check token, IP address and browser information. Legal basis: legitimate interests in keeping our forms safe.
• To host this website and keep it secure: Our host's request logs, including IP addresses. Legal basis: legitimate interests in running a secure website.
• To measure visits from our adverts, and which advert brought you here: Only if you accept advertising cookies, we tell Google Ads when you visit, send a trial request or book a teardown, and we tell Meta when you visit or send a trial request (Meta is not told about teardown bookings). We use their cookies, the click ID and the tracking tags sent with a trial request (see Section 5). Legal basis: your consent, given on the cookie banner.
• To run adverts through our Meta app: See Section 6. Legal basis: legitimate interests in advertising our own and our clients' businesses. Where we hold a client's contact details to run their adverts, the basis is our contract with that client.
• To handle enquiries from adverts we run for a client business: See Section 6. We act on the client business's instructions, as its processor. The client business decides why your details are used and the legal basis it relies on.
• To keep business and tax records: Such as invoices. Legal basis: legal obligation.

We record your trial request in the Brackstone Dashboard at dashboard.brackstonedigital.co.uk. Our team reviews it and receives an internal onboarding notification by email so we can contact you and set up your receptionist.

We send service emails about the trial you requested, such as go-live instructions, access details, usage and a pause. Unless you ticked "Don't send me marketing emails", we may also send marketing emails, such as tips on getting the most from the trial and suggestions to move to a paid plan. Marketing emails include an unsubscribe link. Unsubscribing stops marketing emails, including during the trial; service emails about your requested trial can continue.

When your receptionist answers calls for your business, during the trial or afterwards, we handle the callers' details and the call recordings, transcripts and summaries on your behalf, as your processor, so that you can see them in the dashboard. Apart from that and the advert enquiries described in Section 6, this policy covers the personal data we decide how to use, as controller.

4. How long we keep your data and how we protect it

We keep personal data only as long as we need it for the purpose we collected it for:

• Enquiries and trial requests that do not lead to paid work: Deleted no later than 12 months after your last contact with us.
• Customers: Kept while we provide our services to you, then deleted no later than 12 months after our work together ends, except for the records below.
• Records the law requires us to keep: Invoices and other accounting and tax records, which can include names and contact details, are kept for as long as company and tax law requires, usually six years.
• Marketing choices: If you unsubscribe or refuse marketing, we may keep your email address on a list of people not to email, so that we keep respecting your choice. We keep this short record even if you ask us to delete your other data, because deleting it would mean we could email you again.
• Consent cookie: 180 days, as described in Section 7.

If you ask us to delete your data sooner, we will, except where the law requires us to keep it and except for the short do-not-email record above. Our data deletion instructions explain how.

We store your data with the service providers listed in Section 5, and we take reasonable steps to keep it secure, such as limiting who can access it.

5. Who we share it with

We do not sell your personal data. We may share data with:

• Website hosting: GitHub Pages serves this website and receives the request details described in Section 2, including your IP address, which it logs for security
• Our mailbox: Google Workspace holds our email, including your enquiry, our replies and follow-ups, and internal notifications about trial requests
• Dashboard hosting and database: Railway hosts the Brackstone Dashboard, where we record trial requests and support onboarding
• Security checks and site functions: Cloudflare checks contact and trial requests with Turnstile to help prevent spam, runs the function that passes contact form messages to us, and, if you accepted advertising cookies, runs the function that sends the trial request event to Meta described below
• Email delivery: Resend sends service and marketing emails about your trial, and delivers contact form messages and internal trial notifications to our mailbox
• Google Ads: Only after you accept advertising cookies, Google Ads measures visits from our adverts, accepted trial requests and teardown bookings. Google receives that a request or booking happened, with its own cookies and the ad click ID. We do not include form contents in conversion events.
• Meta pixel and Conversions API: Only after you accept advertising cookies, Meta measures visits and an accepted 7-day trial request on /get-started/. Meta receives the address of each page you visit (including any ad click ID in it, and the industry of the advert you came from, such as industry=garages), your IP address, your browser's user agent, and the Meta cookies and ad click ID on your device. For an accepted trial request Meta also receives your email address and phone number, only as SHA-256 hashes, not in readable form. Meta is not told about a teardown booking. The other form fields (your name, business name, industry, website and notes) are never sent to Google or Meta.
• Meta adverts: When we run adverts on Facebook or Instagram, Meta receives the adverts and their settings through our Meta app (see Section 6)
• Meta lead forms and WhatsApp: When we run lead form or click-to-WhatsApp adverts for a client business, Meta and WhatsApp collect the responses and pass them to that business (see Section 6)

We do not currently use an analytics service such as Google Analytics. If we add one, we will name it here before we use it, and it will run only after you accept cookies.

Where a provider handles data for us and offers data processing terms, those terms apply. Meta acts as an independent controller for the data it collects on Facebook and Instagram, under its own privacy policy, and not on our behalf. For the Meta pixel and Conversions API, we and Meta Platforms, Inc. are joint controllers for collecting the data on this website and sending it to Meta, under the UK Controller Addendum in Meta's Business Tools Terms; Meta then uses it as an independent controller. Under that arrangement we are responsible for telling you about this collection, in this policy, and for asking for your consent, on the cookie banner. Meta is responsible for the data once it receives it, including requests to access or delete it, under the Meta Privacy Policy. You can make a request to either of us. If you email us about data Meta holds, we will pass your request to Meta and tell you we have done so.

Some of these providers store or access data outside the UK, for example in the United States. Each of these transfers is covered by a safeguard recognised under UK data protection law:

• Google, GitHub, Cloudflare and Resend: UK adequacy regulations, because each is certified under the UK Extension to the EU-US Data Privacy Framework. Google relies on the UK Extension for its advertising services, including measurement, as Google explains here.
• Railway: the UK Addendum to the EU Standard Contractual Clauses (the International Data Transfer Addendum issued by the Information Commissioner), in Railway's data processing terms
• Meta: the UK Addendum to the EU Standard Contractual Clauses (the International Data Transfer Addendum issued by the Information Commissioner), in Meta's UK Data Transfer Addendum
• WhatsApp: for messages sent to a client business from a click-to-WhatsApp advert. WhatsApp LLC provides WhatsApp in the UK. For its own handling of your data it relies on UK adequacy regulations, the International Data Transfer Agreement or the International Data Transfer Addendum, as WhatsApp's UK privacy policy explains. Where it acts as the business's processor for the business's customer contact details, such as your phone number, the UK Addendum in WhatsApp's UK Data Transfer Addendum applies; that addendum does not cover the content of your messages, which WhatsApp chats protect with end-to-end encryption (see Section 6).

Email us at info@brackstonedigital.co.uk to ask about the safeguard for a given provider, or for a copy of it.

6. Our Meta advertising app

We run a Meta app called Brackstone Automations. Only Brackstone uses it, through a system user in our own Meta business account. It works on our own Meta ad account. We use it to:

• Create and edit advertising campaigns, ad sets and adverts, which we keep paused until they are approved
• Upload the images and text used in those adverts
• Read advert results, such as reach, clicks and spend

When we run adverts for a client, the adverts appear under the client's own Facebook Page or Instagram account, and only after the client has given us access to it in Meta.

The app does not offer Facebook Login, so it never connects to your personal Facebook account. It does not read your profile, friends, posts or private messages. Advert results come from Meta as totals and do not identify anyone.

When we run click-to-WhatsApp adverts, the button opens a chat with the client business, not with us. The app only sets up the advert.

Meta handles data on its platforms under the Meta Privacy Policy, and WhatsApp under the WhatsApp UK Privacy Policy.

Lead forms and WhatsApp adverts we run for client businesses

Some adverts we run for a client business on Facebook or Instagram include a Meta lead form, where you type in your details, or a button that opens a WhatsApp chat with that business (a click-to-WhatsApp advert). If you respond to one of these adverts:

• Who is responsible: The client business whose advert it is, and whose name appears on it, is the controller of your details. It decides how they are used, and its own privacy notice applies. Where we handle your details, we do so only on that business's behalf and on its instructions, as its processor, under our contract with it.
• What is collected: For a lead form, the answers you give, usually your name, email address and phone number and any questions the business asks, with the advert and the time you sent it. For WhatsApp, your WhatsApp phone number and profile name, the messages you send and the advert you came from.
• Why: So that the business can reply to your enquiry, and so that we can tell it how many enquiries each advert produced. We do not use your details for our own marketing, we do not add them to our own lists, and we do not sell them.
• How we access it: Lead form answers are held by Meta, and WhatsApp messages go to the business's own WhatsApp account. Our Meta app does not download lead form answers or read WhatsApp messages. If a business asks us to handle its enquiries, for example to pass new ones on, we use the access that business has given us in its own Meta or WhatsApp account.
• How long it is kept: We keep a copy only as long as the business tells us to, and we delete it, or return it to the business, when our work for that business ends. Meta keeps lead form answers under its own policies. WhatsApp normally removes messages from its servers once they are delivered; its UK privacy policy explains what it keeps.
• Transfers outside the UK: Meta and WhatsApp may process this data outside the UK, including in the United States. Meta's transfers are covered as set out in Section 5. WhatsApp LLC, which provides WhatsApp in the UK, covers its own transfers with UK adequacy regulations, the International Data Transfer Agreement or the International Data Transfer Addendum, as WhatsApp's UK privacy policy explains. Where WhatsApp acts as the business's processor for the business's customer contact details, such as your phone number, the UK Addendum in WhatsApp's UK Data Transfer Addendum applies. That addendum does not cover the content of your messages.
• Your rights: You can ask the business whose advert it was. You can also email us at info@brackstonedigital.co.uk. We will pass your request to that business without undue delay, help it respond, and delete what we hold for it when it tells us to.

To ask us to delete data, see our data deletion instructions.

7. Cookies and tracking

Analytics and advertising cookies are set only after you accept. If you decline, that choice is remembered and those cookies are not set.

• Consent cookie: Stores whether you accepted or declined. It is named brackstone_consent, lasts 180 days, and is shared with dashboard.brackstonedigital.co.uk so the dashboard can follow the same choice. A second cookie, brackstone_consent_scope, records which version of the banner you answered (180 days), so we ask again before adding a new advertising partner.
• Advertising cookies: Google Ads, used to measure ad visits, trial requests and teardown bookings, and the Meta pixel, used to measure ad visits and trial requests. Set only after you accept.

We do not currently set analytics cookies. You can change your choice at any time with Cookie settings, which is also at the bottom of every page. Declining after you accepted stops the Google tag and the Meta pixel, removes their cookies from this site and reloads the page without them.

8. Your rights

Under UK GDPR, you have the right to:

• Access: Request a copy of the data we hold about you
• Rectification: Ask us to correct inaccurate data
• Erasure: Ask us to delete your data
• Restriction: Ask us to stop using your data, other than storing it, while a concern is resolved
• Object: Object to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds, or need the data for legal claims. If you object to marketing, we will always stop it.
• Portability: Request data you gave us in a machine-readable format, where we process it by automated means on the basis of your consent or a contract with you
• Withdraw consent: Where we rely on your consent, such as for advertising cookies, withdraw it at any time by choosing Decline under Cookie settings at the bottom of any page. You can also email us. Withdrawing consent does not affect what we did before you withdrew it.

To exercise any of these rights, email us at info@brackstonedigital.co.uk. We will respond without undue delay and within one month. If a request is complex, the law lets us take up to two more months, and we will tell you within the first month if we need to. Our data deletion instructions explain how to ask us to delete your data.

9. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with an updated date.