Last updated: 23 September 2026
This policy explains what personal information Brightleaf collects, why we collect it, and what you can do about it. We have tried to write it in plain English rather than legal boilerplate.
Who we are
Brightleaf ("we", "us") sells downloadable digital guides through this website.
- Trading name: Brightleaf
- Seller: B.A Daniel, a sole trader trading as Brightleaf
- Business address: Northland Road, Moneymore, Northern Ireland, BT45 7QY
- Contact: support@brightleaf.store
We are the data controller for the information described here. If you are in the UK or EU, you can contact us at the email address above about anything in this policy.
What we collect
When you buy a guide
- Your email address
- Your name and billing country, where our payment provider collects them
- A record of what you bought, when, and for how much
When you join our email list
- Your email address, and the date you subscribed
When you contact us
- Your name, email address and whatever you choose to put in your message
When you submit a copyright concern or a seller book for private review
- Your contact details, the work and listing you identify, your explanation, and any rights or permission evidence you provide
- Our review decisions, correspondence and any hold placed on a seller book
Automatically, when you visit
- Standard technical information such as your IP address, browser, device type and the pages you view
- Advertising and analytics identifiers, but only if you consent to them — see Cookies and tracking below
We never see your card details. Card numbers are entered directly with Stripe and never reach our servers.
Why we use it, and our legal basis
| What we do | Why | Legal basis (UK GDPR) |
|---|---|---|
| Take payment and deliver your guide | To perform our contract with you | Contract |
| Send your receipt and download link | To perform our contract with you | Contract |
| Answer your support messages | To help you and keep a record | Legitimate interests |
| Keep records of sales | Tax and accounting obligations | Legal obligation |
| Send marketing emails | To tell you about new guides | Consent, or soft opt-in for existing customers |
| Advertising and analytics cookies | To measure and improve our advertising | Consent |
| Prevent fraud and abuse of downloads | To protect the business | Legitimate interests |
| Review seller rights and investigate copyright complaints | To protect authors, buyers and Brightleaf and respond to rights claims | Legitimate interests; legal obligation where applicable |
Cookies and tracking
We keep this deliberately light.
Always on — strictly necessary. A small amount of browser storage remembers your cookie choice and keeps the site working. These do not track you and cannot be switched off.
Only with your consent — advertising and analytics. We use the Meta Pixel (Facebook and Instagram advertising) to understand which adverts lead to sales. It is not loaded at all unless you accept it in the cookie banner. If you accept, Meta receives information about your visit, including pages viewed and purchases made, and may match it to a Facebook or Instagram account.
You can change your mind at any time using the cookie settings link in the footer, or by clearing your browser storage for this site.
With your advertising consent, our server also sends product-view, checkout-start and confirmed-purchase events through Meta's Conversions API. These include the relevant product, price, currency and an event identifier used to avoid counting the same browser and server event twice. Where available, we include your browser's advertising identifiers, IP address and user agent. For confirmed purchases, your email address is normalized and SHA-256 hashed before it is sent to Meta for matching. Hashing does not make this information anonymous. We do not send card details or the contents of your downloaded books.
Advertising attribution is separate from your purchase records. It expires after seven days, after which it is not used and is removed during the next tracking-consent request. Using Cookie settings to withdraw consent disables further tracking and requests deletion of pending server attribution for that browser. This does not remove information already sent to Meta or affect your purchased downloads.
Who we share it with
We only share what is necessary, and only with providers who process data on our instructions:
- Stripe — payment processing. Stripe is a separate data controller for payment data. See stripe.com/privacy.
- Resend — sends your receipt and download link by email.
- Supabase — stores order records, download entitlements, receipt delivery status, newsletter signups, private seller submissions and copyright reports.
- Meta Platforms — advertising measurement, only if you consented to advertising cookies. See facebook.com/privacy.
- Vercel — website hosting and server logs.
Some of these providers are based in the United States. Where personal data is transferred outside the UK, it is protected by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.
We do not sell your personal information.
When investigating a copyright report, we may share the specific allegation and necessary contact or evidence details with the affected seller so they can respond. We do not publish private rights documents or complaint details on the storefront.
How long we keep it
- Order and payment records: six years after the transaction, because tax law requires it
- Download entitlements: for as long as we offer lifetime access to your purchase
- Marketing list: until you unsubscribe, then a suppression record so we do not email you again by mistake
- Support emails: two years after the conversation ends
- Copyright reports and private rights evidence: reviewed for deletion when no longer needed for a claim, sale, dispute or legal obligation; a live dispute may require longer retention
- Server logs: typically 30 days
Your rights
Under UK and EU data protection law you can ask us to:
- Give you a copy of the personal data we hold about you
- Correct anything that is wrong
- Delete your data, where we are not required to keep it
- Restrict or object to how we use it
- Send your data to another provider
- Withdraw consent at any time, including for advertising cookies and marketing email
Email support@brightleaf.store and we will respond within one month.
If you are not satisfied with our response, you can complain to the Information Commissioner's Office at ico.org.uk, or to your local supervisory authority if you are in the EU.
Marketing email
If you join our list, we will email you about new guides and offers. Every email has an unsubscribe link, and we act on it immediately. We do not pass your address to other companies for their own marketing.
Children
This website is not aimed at children, and we do not knowingly collect personal data from anyone under 16.
Changes
If we change this policy we will update the date at the top. If the change is significant, we will say so on the website.