Who is responsible
Jacob Orsborn-Smith, trading as Sitework, is the controller for the course information described here. Contact support@sitework.uk about your information or your data rights.
What we use and why
- Purchase details: your checkout email, order date, amount, payment status and Stripe reference. We use these to fulfil your order, grant access, handle refunds and keep financial records. The lawful bases are contract and, for accounting records, legal obligation.
- Account and course use: confirmed email, authentication data, optional profile details and lesson progress. We use these to sign you in, protect your account, deliver lessons and save your place. The lawful basis is contract.
- Support and security: messages you send and limited technical logs. We use these to help you and prevent misuse. The lawful bases are contract and our legitimate interest in running a secure service.
We do not receive or store your full card number. A password is handled by the authentication provider and is not visible to Sitework. Optional profile fields can be left blank. We do not add course buyers to a marketing list through this flow.
Who handles the information
Stripe processes payments and issues receipts. Supabase provides authentication and stores course account, purchase and progress records. Vercel hosts the site and runs the checkout, payment-webhook and course email functions. Resend delivers the course emails: your receipt, sign-in help and a small number of progress reminders about the course you bought. These are service messages, not marketing, and you can ask us to stop the reminders at any time. The account and classroom load the Supabase browser library from jsDelivr. These providers may process limited technical data needed to provide and secure their services. We may disclose information when legally required.
Lesson videos may be embedded from YouTube or Vimeo, which can receive technical information when you play them. Some providers may process data outside the UK. We rely on appropriate UK-recognised transfer safeguards where required. Contact us if you want details relevant to your data.
How long we keep it
Course account and progress data are kept while you use the course and then reviewed when the account is closed. Purchase and financial records are normally retained for up to six years after the relevant financial year where needed for tax or legal obligations. Support and technical records are kept only as long as needed for the purpose and then removed or anonymised.
Sign-in storage and your choices
Supabase uses browser storage and authentication tokens that are necessary to keep you signed in. Signing out ends the current session on this browser. The course does not require marketing consent to purchase or sign in. The main Sitework privacy policy explains its separate cookieless analytics.
You can correct your optional profile details and change your password in account settings. You can ask for access to, correction or deletion of your data, object to some uses, or request a copy where the law applies by emailing us. Some financial records may need to be retained even if your account is closed. We aim to respond within one month. You can also complain to the Information Commissioner's Office.
Changes
We will update this notice if the course or its providers change materially. The date above identifies this version.