Privacy notice

This notice explains how Bednal Limited ("we", "us"), trading as Producticity, collects and uses personal data when you use Producticity. We are the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Bednal Limited, Unit 4 Clifford Court, Cooper Way, Carlisle, CA3 0JG. Registered in England and Wales, company number 12582198. ICO registration number CONFIRM ZA000000. For anything about your data, email privacy@producticity.app.

What we collect

• Account data: your name, email address(es), phone number(s) and addresses you add, and your sign-in methods (passkeys, Google or Apple sign-in, two-factor settings).
• Transaction data: what you buy or sell and amounts. Card details are collected and held by our payment processor, Stripe; we never see your full card number.
• Technical data: session information, a one-way hash of your IP address, and your browser's user agent, used for security and fraud prevention.
• Communications: messages you send us and service emails we send you.
• Diagnostic data [CONFIRM]: when something breaks in your browser, or when you choose to include diagnostics with feedback, we record what we need to find and fix the problem: the page and the last few pages you visited, which buttons or fields you used just before (never what you typed), the addresses of recent requests to our servers (without their contents), recent error messages, and your device's screen size, language, time zone and browser. If the problem happened on something of yours, such as a booking, we link the report to it, and we keep a step-by-step log of what happened to your bookings and orders so we can investigate.
• Page-view counts [CONFIRM]: when you open a public page of our website (not your account or the app), we add one to a daily count for that page. The count also records the website that linked to the page (its domain name only), any campaign tag in the link (utm_source), and whether the device is a phone or a computer. We count this for every visitor, without cookies: nothing is stored on your device for it, and the counts hold no IP address, browser details, account or other identifier, so they can't be linked to you.
• [CONFIRM any other categories specific to this product]

Why we use it, and our lawful basis

• To provide the service you asked for (contract): creating your account, signing you in, processing payments, sending receipts.
• To keep the service secure (legitimate interests): detecting abuse, rate limiting, keeping an audit log of security-relevant actions.
• To find and fix faults (legitimate interests) [CONFIRM]: recording errors with the diagnostic data above. It is collected only around an error or with feedback you send, is not used for analytics or advertising, and nothing is stored on your device for it.
• To understand how people find our website (legitimate interests) [CONFIRM]: the page-view counts above. To limit abuse of the counter, our rate limiter briefly keeps a one-way hash of your IP address [CONFIRM how long]; it is never stored with the counts.
• To meet legal obligations (legal obligation): keeping financial records for tax and accounting, for [CONFIRM 6 years].
• Marketing (consent): only if you opt in; you can withdraw at any time.

Who we share it with

We use processors who act on our instructions: hosting ([CONFIRM Vercel]), database ([CONFIRM Neon]), payments (Stripe), email delivery (Resend), and rate limiting ([CONFIRM Upstash]). [CONFIRM: only if Google Analytics is configured] With your consent, Google Ireland Limited (Google Analytics 4) receives page paths with identifiers removed, campaign tags and events such as purchases (order reference, value, currency), never your name or contact details; Google may process this outside the UK/EEA under its standard contractual clauses [CONFIRM]. [CONFIRM list any others.] Some process data outside the UK; where they do, transfers are protected by UK adequacy regulations or the International Data Transfer Agreement / Addendum.

How long we keep it

We keep account data while your account is open. Error reports are kept for [CONFIRM 30 days] (diagnostics included) and record step logs for [CONFIRM 90 days]. If you delete your account we remove your personal data after a 30-day grace period, except records we must keep by law (such as financial transactions), which we keep without your contact details for [CONFIRM 6 years].

Your rights

You can ask to access, correct, delete, restrict or object to the use of your data, and to receive it in a portable format. You can export and delete your data from your account settings or by emailing privacy@producticity.app. You can also complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to help first.

Changes

We will post changes here and, if they are significant, tell you by email.