Shop privacy notice
Last updated: November 2026 · This adds to our main privacy notice.
Who is responsible
Crux Education is the controller for information collected through this shop. Contact: hello@not-broken.co.uk.
What we collect
- From Stripe when you pay: your email address, name, billing country/postcode, what you bought, the amount, and Stripe’s payment reference. We never receive your card details.
- Your consent record: the time you ticked the immediate-access box, so we can show you agreed to it.
- Download records: how many times each download link has been used.
- Security records: a scrambled (hashed) form of your IP address or email, kept for up to 24 hours to stop misuse of the checkout, “Lost your download?” and admin login forms.
Why we use it (lawful basis)
- To take payment, deliver your download and resend links — performing our contract with you.
- To keep financial records — legal obligation (HMRC rules).
- To protect the shop from abuse — legitimate interests.
We don’t use shop information for marketing, and we don’t sell or share it with anyone except as below.
Who else is involved
- Stripe processes your payment. Stripe also acts as a controller for some payment and fraud-prevention data; see Stripe’s privacy policy.
- Our web host (Namecheap) stores the shop database and sends our emails.
How long we keep it
Order records are kept for 6 years after the end of the financial year they relate to, as required for tax purposes. Security records are deleted after 24 hours.
Cookies
The shop sets one strictly necessary cookie, crux_shop, which keeps your session working (for example, protecting forms and showing your download page). It is deleted when you close your browser. We don’t use analytics or advertising cookies in the shop. Stripe’s checkout page sets its own cookies for fraud prevention.
Your rights
You can ask for a copy of your information, ask us to correct it, or ask us to delete it where we’re not required to keep it. Email hello@not-broken.co.uk. If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office: ico.org.uk.