Privacy policy

1. Who controls your data

ActivateDigital is a brand of SIGNALANALYTICS.AI LTD, registered in England and Wales, company no. 16798718. We are the data controller for the personal data described here, and we are registered with the UK Information Commissioner's Office, registration ZC137914.

This policy covers activatedigital.ai, the Workspace, the Shopify app, the WooCommerce plugin, integrations we add later, published passports at dppcode.org and emails you send us. It is written to meet UK GDPR and the Data Protection Act 2018.

The Shopify app has its own short app privacy policy as Shopify asks. It says the same things as this page for the app alone.

2. What we collect and why

• On the website. The pages you view, the tools you use and basic details about your device and browser, so we can keep the site working and improve it. Analytics only runs as section 4 describes. If you use a free tool, such as the GTIN checker, what you type is used to give you the answer.
• When you sign in. Your name, email address and profile picture from your Google sign-in, so we can run your account.
• About you. The optional questions about your business, such as the products you work with. They are kept in your browser until you sign in and then saved to your account. We use them to show you what applies to you, to understand our users in aggregate and to tell you about relevant updates. They are never sold, shared with advertisers or used for advertising. You can change or delete them at any time.
• In the Workspace. Your product data, the documents you attach and your answers and approvals. Also your business details, such as company name and role. This is what we use to build your passports.
• Through apps and plugins. What each integration needs and nothing more. The Shopify app reads products and inventory and no customer or order data. Each integration's listing says what it reads and writes.
• Billing. Your plan and payment history. Card details are handled by Stripe or Shopify and never reach us.
• Published passports and scans. A published passport is public and holds product facts, plus the business details the law requires on it. When someone opens a passport, the dppcode.org resolver sets no cookies and uses no analytics or browser storage. Standard server logs are kept for security.
• When you contact us. Your email address and what you write, so we can reply.

We do not seek special category data, and we do not sell personal data.

3. Our legal basis

• Contract: running your account, building and publishing your passports, and billing.
• Legitimate interests: replying to you, keeping the service secure and improving it.
• Consent: analytics cookies and marketing emails. You can withdraw consent at any time.
• Legal obligation: keeping records the law requires, such as tax records.

4. Cookies and analytics

Essential cookies keep the site working, keep you signed in and remember your cookie choice. They are always on.

Analytics cookies are off until you consent. On your first visit we ask, and you can change your mind at any time with Cookie settings at the foot of every page.

We use Google Analytics for this. Advertising storage is always denied, so nothing feeds advertising or remarketing. Until you consent, no analytics cookie is set and Google receives only signals without cookies, such as which page was viewed.

5. Who processes data for us

We use these processors under written contracts, and only where the service needs them:

• Google Cloud and Firebase: hosting, sign-in and storage. Data is held in London and Belgium.
• Google Analytics: website analytics, with your consent.
• Stripe: card payments.
• Shopify: billing for stores that use the Shopify app.
• Resend: sending account emails.

6. Transfers outside the UK

Your data is held in the UK and the EU. The EU has a UK adequacy decision. Where a processor handles data outside the UK or EU, for example in the United States, we rely on the UK International Data Transfer Addendum or Standard Contractual Clauses.

7. How long we keep data

• Your account and Workspace data: while your account is open. When you close it, we delete it, except as below.
• Published passports: kept at their address permanently. Products already sold carry that address, so it has to keep resolving after you close your account or uninstall an app.
• Billing records: for as long as tax law requires.
• Emails to us: for as long as we need them to deal with what you asked.
• Analytics: kept in Google Analytics under its retention settings, and never used to identify you.

When you ask us to delete something, we confirm in writing once it is done.

8. Your rights

You have the right to be told how your data is used, to have a copy of it and to have it corrected or deleted. You can also ask us to restrict or stop using it, or take it elsewhere. You also have the right not to be subject to decisions made only by automated means that significantly affect you.

To use any of these rights, email hi@activatedigital.ai. We reply within one month, and there is usually no charge.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Children

The service is for businesses and is not meant for children. We do not knowingly collect data about children.

10. Security

Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Access is limited by role to the people who need it and is logged. If a breach puts your data at risk, we tell the ICO within 72 hours where the law requires it, and we tell you where the law requires it.

11. Changes to this policy

We review this policy at least once a year. If we change it in a way that matters, we will say so on this page and, if you have an account, by email.

12. Contact

Email hi@activatedigital.ai.

ActivateDigital is a trading name of SIGNALANALYTICS.AI LTD, registered in England and Wales, company no. 16798718. ICO registration ZC137914.