1. Introduction

This Privacy Policy explains how personal data is collected, used, and protected when you visit this site, join the waitlist, or purchase any product. This site is operated by Crystal Drury, trading as buildwithcrystal.com

This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are based in the EU, your data is handled in accordance with the EU GDPR as well.

If you have any questions about this policy, contact us at: support@buildwithcrystal.com

You also have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk. We would appreciate the opportunity to address your concern first.

2. What data we collect and why

We collect personal data through the following touchpoints:

Email opt-in and waitlist (via Kit)

When you sign up for the waitlist or a free resource, we collect your name and email address. This is used to send you the content you requested and related marketing communications, based on your consent.

Checkout and purchase (via ThriveCart)

When you make a purchase, ThriveCart collects your name, email address, billing address, and payment information. Payment data is processed securely by ThriveCart and its payment processors (including Stripe). We do not store or have direct access to your payment card details. We receive your name and email to fulfil your order and provide access to your purchase.

Contact form

If you contact us via a form on this site, we collect your name, email address, and any information you include in your message. This data is used solely to respond to your enquiry.

Instagram DMs

If you message us via Instagram, we receive your Instagram username and the content of your message. This is used to respond to you and, where relevant, to process a purchase. We do not store DM content beyond what is necessary to serve you.

Automatic data collection (cookies and tracking)

When you visit this site, we and our third-party tools may automatically collect technical data including your IP address, browser type, device type, pages visited, and time spent. This is collected via cookies and tracking technologies including the Facebook Pixel, which allows us to measure the effectiveness of our advertising and serve relevant ads on Meta platforms (Facebook and Instagram).

3. Legal basis for processing (UK GDPR)

We process your personal data on the following legal grounds:

• Consent — for email marketing and cookie-based tracking. You can withdraw consent at any time.

• Contract performance — to fulfil your purchase and provide access to your products.

• Legitimate interests — to respond to enquiries, prevent fraud, and improve our services, where this does not override your rights.

• Legal obligation — where we are required to retain data by law.

4. How we use your data

Your data may be used to:

• Deliver products and services you have purchased

• Send emails you have opted into, including marketing and launch communications

• Respond to enquiries and support requests

• Process and manage payments via ThriveCart

• Measure and optimise advertising performance via Facebook Pixel

• Build lookalike audiences on Meta platforms for advertising purposes

• Improve this site and our products based on usage data

• Comply with legal obligations

5. Cookies and tracking

This site uses cookies and similar technologies. These include:

• Essential cookies — necessary for the site to function

• Analytics cookies — to understand how visitors use the site

• Marketing cookies — including the Facebook Pixel, to track conversions and serve relevant ads

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of this site. Where required by law, we will request your consent before placing non-essential cookies.

6. Third-party platforms and data sharing

We do not sell your personal data. We share data only with trusted third-party platforms necessary to operate our business, including:

Kit (formerly ConvertKit) — email marketing and waitlist management

• ThriveCart — checkout and payment processing

• Stripe — payment processing (via ThriveCart)

• Meta (Facebook/Instagram) — advertising and pixel tracking

• Framer — website hosting

Each of these platforms operates under its own privacy policy and data processing agreements. We only use platforms we reasonably believe handle data responsibly and in compliance with applicable law.

We may also disclose your data where required by law, or to protect our legal rights.

7. International data transfers

Some of our third-party platforms are based outside the UK and EEA (including the United States). Where your data is transferred internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions, in line with UK GDPR requirements.

8. How long we keep your data

We retain your personal data only for as long as necessary for the purposes it was collected:

• Email list data is retained until you unsubscribe or request deletion

• Purchase records are retained for up to 6 years for legal and accounting purposes

• Enquiry and contact data is retained for up to 12 months

9. Your rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you

• Rectification — request correction of inaccurate or incomplete data

• Erasure — request deletion of your data where there is no lawful reason to retain it

• Restriction — request that we limit how we use your data

• Portability — request your data in a portable format

• Object — object to processing based on legitimate interests or for direct marketing

• Withdraw consent — at any time, where processing is based on consent

To exercise any of these rights, contact us at support@buildwithcrystal.com. We will respond within 30 days.

To unsubscribe from marketing emails, click the unsubscribe link in any email we send you.

10. Data security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse. However, no method of internet transmission is completely secure. If you become aware of any security concern, please contact us immediately at support@buildwithcrystal.com.

11. Children

This site and its products are intended for individuals aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.

12. Third-party links

This site may contain links to external websites. We are not responsible for the privacy practices of third-party sites and encourage you to review their privacy policies independently.

13. Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be published on this page with the date it was last updated. Continued use of this site after any update constitutes acceptance of the revised policy. Where changes are material, we will notify you by email where possible.

14. Contact

For any questions, data requests, or concerns relating to this Privacy Policy:

Email: support@buildwithcrystal.com

We aim to respond to all requests within 30 days.