Privacy policy

Who controls your data

The data controller is Jake Cottrell trading as The Progress Edit. The Progress Edit is a business name used by Jake Cottrell, a sole trader based in the United Kingdom. It is not a limited company, so there is no company number and no registered office. Correspondence address: 5 Portiswood Close, Tadley, RG26 3UQ, United Kingdom.

Data protection requests: sarahcottrell111@gmail.com, or use the contact form.

What we actually process

Orders. The email address you give at checkout, your billing country, the amount and currency paid, the payment and order references, the download token and how many times your secure link has been used, the status of your confirmation email, and a durable record of the two confirmations you ticked — the exact wording, the versions of the terms and licence, and the time you accepted them. Card details are entered directly with Stripe and are never seen or stored by us.

Enquiries. Your name, email address, enquiry type and message are stored in our website database, together with whether the notification email about your enquiry was sent. A copy of that notification, including your message, is delivered to our support mailbox.

Product notifications and marketing. Your email address, and optionally your first name and what brought you to the site, whether you consented to marketing email, and which page the signup came from.

Security data. Our enquiry form applies a short-lived, in-memory per-IP submission limit to prevent abuse. That IP data is held transiently in the running server process for that purpose and is not written to our database. Our hosting and payment providers keep their own request and security logs under their own notices.

Required fields: for an order, an email address and billing details are needed by our payment provider — without them the payment and the download cannot be completed. For an enquiry, a name, email address and message are needed, or we cannot reply. Marketing consent is always optional and never required to buy or to contact us.

Why we process it, and our lawful bases

Contract or steps before a contract: taking payment, delivering your download, restoring access, supporting your purchase, and recording the terms, licence and consent wording you accepted as part of that contract.

Legal obligation: keeping accounting and tax records, and handling statutory data-rights requests and data-protection complaints.

Legitimate interests: answering general enquiries, documenting transactions and the confirmations given at checkout, applying and evidencing our UK-only eligibility rule, preventing fraud and abuse (including the enquiry rate limit), enforcing the licence, and establishing or defending legal claims. Our interest is running a small business securely and being able to show what was agreed; we consider this does not override your rights, and you can object at any time (see below).

Consent: optional marketing email and product notifications only, which you can withdraw at any time.

Who receives your data

Stripe processes payments. Stripe acts as our processor for parts of the payment and as an independent controller for its own fraud prevention, regulatory and compliance purposes. See Stripe's privacy notice.

Lovable provides the application hosting and the managed database and file storage behind this site, and the managed transactional email service that delivers your confirmation and our enquiry notifications. These act as our processors.

Google (Gmail) currently provides the support mailbox at which we receive enquiry notifications and your replies. Google processes that mailbox content under its own terms and is not solely our processor.

We may also share data with our professional advisers, or with a regulator, tax authority or law-enforcement body where we are required or permitted to. We do not sell your details or share them with third parties for their own marketing.

International transfers

Stripe, Lovable and Google are international providers, and some processing takes place outside the UK — including in the United States and the European Economic Area. We do not claim that all data stays in the UK. Where data leaves the UK, the transfer relies on the safeguards set out in that provider's own terms: UK adequacy regulations where they apply, or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. We do not restate provider-specific details we cannot verify. You can ask us for further information about the safeguards in place.

Payments, fraud checks and automated decisions

Stripe applies automated fraud and risk checks to each transaction, and a payment can be declined automatically as a result. If you believe a decision was wrong, contact us and we will look into it with Stripe. We do not carry out any other automated decision-making or profiling.

Marketing email

We only send marketing email where you have ticked the consent box, which is always separate and never pre-ticked. Buying a product or sending an enquiry is not marketing consent. Every marketing email includes an unsubscribe link, and you can withdraw consent at any time through the contact form. Withdrawing consent does not affect purchase-related email, which we must send to perform the contract.

How long we keep it

There is no automated deletion job. We review what we hold manually every quarter, during January, April, July and October. At each review, records that are no longer needed are removed from every copy we control — the website database and our support Gmail mailbox, including archived and deleted or trash copies where those still exist — unless the record must be kept for an active enquiry, complaint, dispute, HMRC enquiry, legal claim or other legal obligation.

Order, consent, contract-snapshot and linked download and access records: kept for at least five years after the 31 January Self Assessment deadline for the relevant tax year, and longer only while an HMRC enquiry, dispute, legal claim or other legal obligation genuinely requires them.

Enquiry records and their Gmail notification copies: kept for up to two years after the matter is closed, then removed at the next quarterly review unless one of those exceptions applies.

Marketing and product-notification signups: kept until you unsubscribe or ask us to remove you, after which we keep only the minimal suppression record needed to avoid contacting you again.

The short-lived per-IP rate-limit data is held only in the running server process, is never written to our database, and so is not part of the quarterly deletion task.

Erasure and unsubscribe requests are handled when we receive them and do not wait for the next quarterly review, subject only to records we must lawfully keep for tax, legal-claim or evidential reasons.

Your rights

Under UK GDPR you have the right to be informed, to access a copy of your data, to rectification, to erasure, to restrict processing, to object to processing, to data portability, and to withdraw consent where we rely on it. These rights are not absolute — which ones apply depends on the lawful basis for the processing. For example, erasure and portability do not generally apply to records we must keep for tax or legal purposes.

You have a particular right to object to any processing we carry out on the basis of legitimate interests — including enquiry handling, security and rate limiting, and licence enforcement. Tell us and we will stop unless we can show compelling legitimate grounds that override your rights, or we need the data for legal claims.

We aim to respond within one month. That period can lawfully be extended by up to two further months for complex or numerous requests, and we may first need to take reasonable steps to verify your identity.

Complaints about how we handle your data

If you are unhappy with how we have handled your personal data, tell us at sarahcottrell111@gmail.com. We will acknowledge your complaint within 30 days, investigate it appropriately, keep you updated, and give you an outcome without undue delay.

You can complain to the Information Commissioner's Office at any time — you do not have to come to us first. The ICO can be reached at ico.org.uk/make-a-complaint or on 0303 123 1113.

Children and sensitive information

The person placing an order must be aged 18 or over, although the one intended user of a kit may be under 18. We do not ask for or knowingly collect a child's personal details, and anyone under 18 should ask a parent or guardian to use our contact or signup forms on their behalf.

Your CV and cover letter are completed locally on your own device — completed documents are never uploaded to or stored by us. Please do not send CVs, card details, health information or other sensitive personal data through the contact form.

Cookies and tracking

We have not installed any analytics, advertising or other non-essential tracking on this site. Cookies and similar storage strictly necessary for the site to function are used, and on the payment pages Stripe sets strictly necessary cookies for payment processing and fraud prevention under its own notice. If we ever add non-essential tracking, we will ask for your consent first.

Accessibility and help

If you have difficulty using this site, or would like this policy or any of our information in a different format, contact us and we will do our best to help. We have not carried out a formal accessibility audit, so we do not claim certified WCAG compliance.