Privacy Policy

FakedexBuilder ("the Platform", "we", "us", "our") is committed to protecting your privacy and handling your personal data transparently and responsibly.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what your rights are. It applies to all users of the Platform, including visitors who do not create an account.

This Policy is incorporated into and should be read alongside our Terms and Conditions of Use. By using the Platform, you acknowledge that you have read and understood this Policy.

The Platform is operated by a sole trader based in the United Kingdom and is subject to UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The operator of FakedexBuilder is the data controller for the personal data described in this Policy. This means we are responsible for deciding how and why your personal data is processed.

We are registered with the Information Commissioner's Office (ICO) as a data controller under registration reference ZC161045. The controller's identity and correspondence address are available on the ICO's public register of fee payers at ico.org.uk.

Contact: fakedexbuilder@gmail.com

UK GDPR requires us to have a lawful basis for each processing activity. The table below sets out our processing activities, the data involved, and the basis on which we process it.

Where we rely on legitimate interests as our lawful basis, we have assessed that our interests are not overridden by your data protection rights. You have the right to object to processing based on legitimate interests — see the Your Rights section for details.

We use the following third-party services to operate the Platform. Each is a data processor acting on our instructions. We have data processing agreements (DPAs) in place with each processor where required.

We do not sell your personal data to any third party. We do not share your personal data with third parties for their own marketing purposes.

We use a small number of cookies on the Platform. A cookie is a small file stored on your device that allows us to recognise you and remember your preferences.

• System notifications — emails about your account, content decisions, and important platform changes. These are sent on the basis of contract performance, as they are necessary to operate the service. You cannot opt out of these while your account is active.
• Promotional emails — news, announcements, and community content. These are sent on the basis of your consent. You can unsubscribe at any time using the link in any promotional email, or by contacting us at fakedexbuilder@gmail.com.

Emails are delivered via Resend. We comply with the Privacy and Electronic Communications Regulations 2003 (PECR) in relation to all email marketing.

Some of our third-party processors are located outside the UK. Where we transfer personal data internationally, we ensure appropriate safeguards recognised under UK GDPR are in place. Depending on the processor, these are one or more of:

• The UK–US Data Bridge — the UK extension to the EU–US Data Privacy Framework, covering transfers to certified US organisations.
• The UK Addendum to the EU Standard Contractual Clauses, or the ICO's International Data Transfer Agreement (IDTA) — contractual safeguards approved for UK transfers that require recipient organisations to protect your data to UK GDPR standards.

The specific mechanism relied on for each processor is set out in that processor's data processing agreement, referenced in the Third-Party Data Processors section. PostHog processes data within the European Union, which is an adequate territory under UK law; no additional transfer mechanism is required.

The Platform is available only to users aged 13 and over, in accordance with our Terms and Conditions. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has created an account, we will delete that account and its associated personal data promptly.

We recognise that a significant portion of our user base is aged between 13 and 17, and that these users are children for the purposes of the ICO's Age Appropriate Design Code (Children's Code). We take our obligations under the Code seriously. In particular:

• We collect only the minimum personal data necessary to operate the Platform.
• We do not use children's data for profiling, behavioural advertising, or any purpose beyond operating the service they have requested.
• Our analytics does not store identifiers on users' devices and does not track users across other websites or services.
• We do not knowingly use children's data to make inferences that could affect their interests.
• Account deletion permanently removes associated personal data as described in the Data Retention and Deletion section.

If you are a parent or guardian and have concerns about your child's use of the Platform, please contact us at fakedexbuilder@gmail.com.

We retain personal data only for as long as necessary for the purposes set out in this Policy, or as required by law. Our general retention periods are:

• Account data — retained for the duration of your account. Upon account deletion, personal data and User Content are permanently removed from our live systems — including our database, our authentication provider (Clerk), and our file storage provider (UploadThing) — promptly following deletion. Any copies retained in routine database backups are purged within 30 days.
• Analytics data — session-level data is retained per PostHog's configured retention periods. Aggregated, anonymised analytics data may be retained indefinitely.
• Email communications — retained for the duration of your account. Unsubscribe records are retained to evidence your consent preferences.
• Legal and compliance data — retained for the period required by applicable law (for example, financial records when payments are introduced).

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• Encrypted data transmission (HTTPS/TLS)
• Access controls and authentication safeguards via Clerk
• Trusted third-party processors with their own security certifications

No system is completely secure. If you become aware of any security concern relating to your account or the Platform, please contact us immediately at fakedexbuilder@gmail.com.

You have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete personal data.
• Right to erasure — you can ask us to delete your personal data in certain circumstances. You can also delete your account directly via your account settings.
• Right to restrict processing — you can ask us to pause processing of your data in certain circumstances.
• Right to data portability — you can request your data in a structured, commonly used format.
• Right to object — you can object to processing based on legitimate interests (including analytics). We will stop that processing unless we have compelling legitimate grounds.
• Right to withdraw consent — where we process data based on your consent (such as promotional emails), you can withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at fakedexbuilder@gmail.com. We will respond within one calendar month of receiving your request. We may need to verify your identity before processing the request.

If you have a complaint about how we handle your personal data, please contact us in the first instance at fakedexbuilder@gmail.com. We will endeavour to resolve complaints promptly.

If you are not satisfied with our response, or if you believe we are processing your data unlawfully, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113

We may update this Privacy Policy from time to time. Where changes are material, we will notify users via the Platform or by email with reasonable notice before the changes take effect.

The "last updated" date at the top of this document reflects when the Policy was last revised. Your continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Policy.