R6Strats

Privacy policy

Last updated

Draft. Being reviewed before launch.

This policy explains what personal data R6Strats collects and why. It also covers who we share it with and the rights you have under UK data protection law.

Who we are

Wellington Web Co Ltd runs R6Strats and is the controller of your personal data. That means we decide how and why it's used.

Company
Wellington Web Co Ltd
Based in
Edinburgh, UK
Company number
[Company number]
Registered address
[Registered address]
Email
hello@r6strats.com [to confirm]

Our ICO registration number is [ICO registration number].

What we collect and why

We collect as little as we can. We don't sell your data, use it for advertising or track you across other sites.

Your account

  • What: your email address, your display name and an avatar if you add one.
  • Why: to sign you in with a magic link, show your name and run your account.
  • Lawful basis: contract. We need it to give you the account you asked for.

Your purchases

  • What: which creator you unlocked, when you paid, what you paid including VAT and the payment reference.
  • Why: to give you access, send receipts, handle refunds and keep tax records.
  • Lawful basis: contract, to give you what you bought. Legal obligation, because UK tax law makes us keep sales records.

Payment details

  • What: Stripe collects your card details and billing location when you pay. We never see your full card number.
  • Why: to take payment, work out the right VAT and prevent fraud.
  • Lawful basis: contract and legal obligation. Stripe also acts as a controller in its own right for fraud checks, under its own privacy policy.

Messages you send us

  • What: your name, email address, the topic you choose and your message, whether you use the contact form or email us.
  • Why: to reply and sort out what you've asked about.
  • Lawful basis: legitimate interests, because we need to answer people who contact us. If it's about something you bought, contract.

If you're a creator

  • What: Stripe collects your identity and bank details when you set up Stripe Connect. We keep your Stripe account reference and records of your sales, fees and payouts. Your creator name, avatar and content are public on the site.
  • Why: to sell your content, pay you and keep the records the law requires.
  • Lawful basis: contract and legal obligation. Stripe is a controller in its own right for its identity checks.

Technical data

  • What: your IP address and browser details, which your browser sends whenever it loads a page or the site's font.
  • Why: to deliver the site and keep it secure.
  • Lawful basis: legitimate interests in running a working, secure site.

Who we share it with

We use a few providers to run R6Strats. They only use your data to provide their service to us, under contracts that protect it.

  • Supabase runs our database and sign in.
  • Stripe handles payments, VAT and creator payouts.
  • Vercel hosts the site.
  • Google Fonts serves the site's font, so your browser sends Google your IP address when a page loads.

We'll also share data when the law requires it, for example with HMRC.

How long we keep it

  • Account data: while your account is open. When you close it, we delete it, apart from what the law says we must keep.
  • Purchase and payout records: six years, because UK tax law requires it.
  • Messages: as long as we need to deal with them, then up to two years in case the same thing comes up again.
  • Technical logs: a short time, set by our hosting provider.

International transfers

Some of our providers store or access data outside the UK, including in the US. Our database is hosted in [Supabase region].

When data leaves the UK, we make sure one of the safeguards UK law allows is in place:

  • UK adequacy regulations, including the UK's data bridge with the US where the provider is certified under it
  • the ICO's International Data Transfer Agreement or its Addendum to the EU's standard contractual clauses

Ask us if you'd like details of the safeguard for a particular provider.

Your rights

Under UK data protection law you have the right to:

  • get a copy of the data we hold about you
  • have wrong data corrected
  • have your data deleted
  • limit how we use your data
  • object to us using your data on the basis of legitimate interests
  • get your data in a format you can take elsewhere

Some rights have limits. For example, we can't delete purchase records the law says we must keep.

To use any of these rights, email hello@r6strats.com [to confirm] from the address on your account. It's free. We may ask you to confirm who you are. We'll reply within one month. If a complex request needs longer, we'll tell you.

Complaints

If you're unhappy with how we've handled your data, please tell us first so we can put it right.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. Visit ico.org.uk/make-a-complaint or call 0303 123 1113.

Cookies and local storage

We don't use tracking, analytics or advertising cookies. We only store what the site needs to work:

  • Sign in cookies keep you signed in. They're set by our sign in system.
  • One local storage item remembers the state of the account menu. It stays on your device and isn't sent to us.

These are strictly necessary for the site to work, so the law doesn't require us to ask for your consent. You can clear them in your browser settings, but you'll be signed out.

Stripe's payment pages set their own cookies to prevent fraud. Stripe's cookie policy covers those.

Changes to this policy

We'll update this policy when things change and put the new date at the top. If a change affects you in a significant way, we'll email you.