Privacy Policy

1. Who is responsible

Build It For Me is a service of Capefield Ltd, a company registered in England and Wales (company no. 14103443), registered office 27 Old Gloucester Street, London WC1N 3AX, United Kingdom. Capefield Ltd is the controller of your personal data and is registered with the Information Commissioner's Office. Privacy questions: privacy@capefieldacademy.com. Support: support@capefieldacademy.com.

2. What we collect

• Account details — your email address and password (stored only in hashed form by our authentication provider), and your name, business name, phone and WhatsApp number if you give them.
• Project information — your intake form answers, files you upload, the price and currency of your project, and the updates and messages on your dashboard.
• Payment information — card payments are handled by Stripe. We receive payment records (amount, currency, date, status) but never see or store your full card details.
• Correspondence — emails and WhatsApp messages you send us, and your contact details.
• Technical information — sign-in times and security logs. Our hosting and authentication providers also process network information such as IP addresses and browser details.

3. Data we process for you

When we build and host a site or app for you, we may process personal data about your visitors on your behalf — for example, contact form messages, or anonymous page-view counts (page path, referring site and device type, with no cookies and no stored IP addresses) for your dashboard's visitor figures. For that data, you are the controller and we act as your processor under our Terms of Service (clause 19).

4. Why we use it

• To provide the service you booked: creating your account, building from your brief, taking payment, hosting and support — contract (UK GDPR Art. 6(1)(b)).
• To keep the service secure, prevent fraud and misuse, and improve how it works — legitimate interests (Art. 6(1)(f)).
• To keep financial and tax records and meet other legal duties — legal obligation (Art. 6(1)(c)).
• Marketing emails — only with your consent (Art. 6(1)(a)), and only if you opt in. We do not sell your data or use advertising tracking.

5. Who helps us

We use these providers to run the service:

• Supabase — database, authentication and file storage.
• Stripe — card payments, subscriptions and the billing portal.
• Postmark (ActiveCampaign) — transactional emails such as confirmations, updates and renewal reminders. Open and link tracking are switched off.
• Vercel — hosting for this website and dashboard.
• Namecheap Private Email — our support and privacy mailboxes.
• WhatsApp (Meta) — only if you choose to message us there.

If you choose our domain and mailbox add-on, we also share the details needed to register your domain with the registrar. We may disclose information where required by law or needed for legal claims.

6. International transfers

Some providers process data outside the UK, including in the United States. Where that happens, we rely on appropriate safeguards such as UK adequacy regulations, the International Data Transfer Agreement, or Standard Contractual Clauses with the UK Addendum. Ask us for details.

7. How long we keep it

• Account data: while your account is active, then 6 years after closure (UK tax and contract limitation periods).
• Payment records: 7 years.
• Project intake data and files: for as long as we host your project, plus 6 years.
• Dashboard messages: for as long as we host your project, plus 2 years.
• Marketing preferences: until you withdraw consent.

8. Your rights

Under UK data protection law you can ask to access, correct, erase or restrict your personal data, to receive a copy in a portable format, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. Email privacy@capefieldacademy.com. We normally respond within one month, and we may need to verify your identity first.

9. Security

We use encrypted connections (HTTPS/TLS), access controls, row-level database security, regular software updates and backups. No system is perfectly secure, so please use a strong, unique password for your dashboard.

10. Cookies and browser storage

We use only what the service needs to work — no analytics or advertising cookies. See the Cookie Policy for the full list.

11. Children

Our services are for adults aged 18 and over. We do not knowingly collect data from children.

12. Changes

We will update this policy when the service or our handling of personal data changes. We tell existing clients about material changes by dashboard message at least 30 days before they take effect.

13. Complaints

Please contact us first at privacy@capefieldacademy.com and we will try to put things right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.