How we collect, use, and protect your personal data when you use Brick Freedom.
Last updated: 23 November 2025
Brick Freedom Limited ("Brick Freedom", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you access or use the Brick Freedom platform located at https://brickfreedom.com and all related services, applications, and features (collectively, the "Service").
Brick Freedom Limited is the data controller responsible for your personal data. We are registered in the United Kingdom.
This Privacy Policy should be read in conjunction with our Terms of Service. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices as described herein, you should not use the Service.
We collect personal data that you voluntarily provide when you register for, access, or use the Service, including:
Your name, email address, and password (stored in hashed form).
Business name, account type (individual or company), country, timezone, and VAT identification number (where applicable).
Billing address, payment method details, and transaction history. Payment card details are collected and processed directly by our payment processor, Stripe — we do not store, process, or have access to your full card numbers.
API keys, tokens, and authentication credentials for third-party platforms you choose to connect (such as BrickLink, Brick Owl, and eBay).
Product listings, stock levels, pricing, condition, descriptions, and order details that you create within the Service or that are synchronised from connected platforms.
Messages, attachments, and related information you submit when contacting us for support.
Posts, comments, and other content you submit to community features of the Service.
Files you upload to the Service, including BSX import files, expense receipts, and team logos.
When you access or use the Service, we automatically collect certain information, including:
Pages visited, features used, actions taken, timestamps, and frequency of use.
Browser type and version, operating system, device type, screen resolution, and language preferences.
IP address, internet service provider, and approximate geographic location derived from your IP address.
The URL of the website that referred you to the Service.
Page load times, errors, and diagnostic information.
When you connect third-party marketplace accounts to the Service, we receive data from those platforms on your behalf, including:
This data is collected solely to provide the inventory synchronisation and order management features of the Service.
We use the personal data we collect for the following purposes:
To create and manage your account, provide the Service, synchronise inventory and orders across connected platforms, and process transactions.
To calculate commissions, generate invoices, process payments through Stripe, and send billing-related communications.
To send essential service notifications, security alerts, account verification emails, and respond to your support enquiries.
To analyse usage patterns, diagnose technical issues, and improve the functionality, performance, and reliability of the Service.
To detect, prevent, and address fraud, abuse, security incidents, and technical issues.
To comply with applicable laws, regulations, and legal processes, including tax reporting and financial record-keeping obligations.
To send promotional communications about the Service, where you have provided your consent. You may opt out of marketing communications at any time.
Under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR), we must have a lawful basis for processing your personal data. We rely on the following legal bases:
Processing is necessary to perform our contract with you, including providing the Service, managing your account, synchronising your inventory, processing orders, and handling billing.
Processing is necessary for our legitimate interests, provided these are not overridden by your rights. This includes improving the Service, ensuring security, preventing fraud, and conducting internal analytics. You have the right to object to processing based on legitimate interests.
Where you have given clear consent for us to process your personal data for specific purposes, such as receiving marketing communications. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
Processing is necessary to comply with a legal obligation to which we are subject, including tax, accounting, and financial reporting requirements under United Kingdom law.
Your personal data is primarily stored and processed in the United Kingdom. However, some of our service providers may process data in other jurisdictions. Where personal data is transferred outside the United Kingdom or the European Economic Area, we ensure that appropriate safeguards are in place, including:
You may request further information about the safeguards we have in place by contacting us at the details set out in Section 14.
We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, tax, accounting, or reporting requirements.
We retain your personal data for as long as your account remains active and you continue to use the Service.
Following account closure, we provide a thirty (30) day period during which you may export your data. After this period, we will delete or anonymise your User Content.
We retain billing, transaction, and invoicing data for up to seven (7) years following account closure to comply with our legal obligations under United Kingdom tax and accounting regulations, including the requirements of HM Revenue & Customs.
We retain support correspondence for up to two (2) years after your last interaction to assist with any follow-up enquiries.
Anonymised or aggregated usage data may be retained indefinitely for analytical and service improvement purposes.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:
While we take reasonable precautions to protect your data, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your personal data.
If you are located in the United Kingdom or the European Economic Area, you have the following rights with respect to your personal data:
Right of access
Request a copy of the personal data we hold about you.
Right to rectification
Request that we correct any inaccurate or incomplete personal data.
Right to erasure
Request that we delete your personal data, subject to certain exceptions.
Right to restriction
Request that we restrict the processing of your personal data in certain circumstances.
Right to data portability
Receive your data in a structured, machine-readable format.
Right to object
Object to processing based on legitimate interests.
Right to withdraw consent
Withdraw consent at any time without affecting prior processing.
Right to lodge a complaint
Contact the ICO or your local supervisory authority.
If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:
Right to know
Request information about the personal data we have collected about you and how it is used.
Right to delete
Request deletion of your personal information, subject to certain exceptions.
Right to correct
Request correction of inaccurate personal information.
Right to opt out
We do not sell or share your personal information as defined under the CCPA/CPRA.
Right to non-discrimination
We will not discriminate against you for exercising any of your privacy rights.
To exercise any of the rights described above, please contact us at steve@brickfreedom.com. We will respond to your request within one (1) month, or within the timeframe required by applicable law. We may need to verify your identity before processing your request.
Where your request is manifestly unfounded or excessive, or where we receive repetitive requests, we may charge a reasonable fee or refuse to act on the request, in accordance with applicable law.
The Service is not intended for use by individuals under the age of eighteen (18). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that data as soon as reasonably practicable. If you believe that a child has provided us with personal data, please contact us immediately at steve@brickfreedom.com.
The Service may contain links to third-party websites, services, or resources that are not operated or controlled by us. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party websites you visit. We are not responsible for the content, privacy practices, or data handling of any third-party websites or services.
We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or operational needs. If we make material changes, we will notify you by email or by posting a prominent notice within the Service at least fourteen (14) days before the changes take effect.
The "Last updated" date at the top of this Privacy Policy will be revised to reflect the date of the most recent changes. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
For complaints regarding our handling of your personal data, you have the right to contact the Information Commissioner's Office (ICO) at https://ico.org.uk, although we would appreciate the opportunity to address your concerns directly before you do so.
