Last updated: 3 November 2026
1. Who we are
Secordit Intelligence Ltd ("Secordit", "we") runs this website. We're registered in England and Wales, company no. 17050740. Under UK data protection law (the UK GDPR and the Data Protection Act 2018), we're the controller of the personal information described here. To contact us about your information, email [email protected].
2. Buying a kit
We sell digital kits. Each one is a one-off download, and nothing is posted. When checkout is open, we collect your name, email address, billing details and what you bought. We use them to take payment, show your download link on the thank-you page, help with access problems and keep the records the law requires.
You need to give your name, email address and billing details to place an order.
Our lawful bases are performing our contract with you and meeting our legal obligations, such as keeping accounting records.
Payments are handled by Stripe. Your card details go to Stripe, not to us. Stripe's privacy notice is at stripe.com/privacy. We don't send order emails yet. After payment, your download link appears on the thank-you page. Stripe emails you a payment receipt.
3. Emailing us
If you email [email protected], we use what you send to reply and keep a record of the conversation. Our lawful basis is our legitimate interest in answering questions and running the business, or performing our contract with you if it's about an order.
4. News Pulse emails
If you sign up to News Pulse, we use your email address to send you News Pulse emails. We rely on the consent you give when you sign up. Every marketing email from us has an unsubscribe link, and you can use it whenever you like.
We use Klaviyo, provided by Klaviyo, Inc. in the United States, to send our emails and manage our mailing lists. When you sign up, Klaviyo receives your email address and which form or page you used. When we send you an email, Klaviyo records whether you open it and which links you click.
5. Website chat (Ordit)
Our website has an automated chat assistant called Ordit. We use it to answer your questions about our kits. If you use it, the messages you type are sent to a small web service we run on Cloudflare. That service uses Cloudflare Workers AI to write Ordit's replies, so Cloudflare processes your messages on our behalf, as our processor. Please don't enter passwords, card details or other personal information in the chat. Our lawful basis is our legitimate interest in answering questions about our kits.
Our web service, a Cloudflare worker, doesn't save your chat messages to any database, and its code doesn't write them to its logs. To limit misuse, it counts how many messages come from each IP address. That count is held only in the service's memory and isn't saved. Ordit, our chat assistant, runs on Cloudflare Workers AI (Cloudflare is our hosting provider). Your messages are sent to Cloudflare to generate a reply and are not stored by us. Our code doesn't store your messages or write your IP address to its logs. Don't put personal or sensitive details into the chat.
Cloudflare says that, for requests like these, it doesn't keep your messages or Ordit's replies once they're no longer needed to send the reply, except where it must keep them to meet its legal obligations. It may keep technical details, such as timestamps and message sizes, which don't include what you typed. Cloudflare says it doesn't use this content to train AI models. You can read Cloudflare's terms at https://developers.cloudflare.com/workers-ai/platform/data-usage/.
6. Password and email domain checks
Our checks page runs in your browser. The password check turns the password into a scrambled code (a hash). It sends only the first 5 characters of that code to the Pwned Passwords service from Have I Been Pwned. The password itself never leaves your device.
The domain check sends the domain name you type, and related lookup names, to Cloudflare's public DNS service. Your browser sends these lookups straight to those services, and nothing is sent to Secordit. We don't store what you check or the results. As with any website, those services can see your IP address and browser details when your browser contacts them.
7. Hosting and images
This website is hosted by Cloudflare. When you visit, Cloudflare processes technical information, such as your IP address and browser details, to deliver pages and protect the site. Kit images load from Shopify's content delivery network (cdn.shopify.com), so Shopify receives the same kind of technical information when your browser loads them. Our lawful basis is our legitimate interest in running a working, secure website.
8. Cookies and similar technologies
This website doesn't use analytics or advertising cookies, and our own code doesn't set any cookies. One small item, named sd-ping, is kept in your browser's session storage so the logo animation plays only once per visit. Your browser deletes it when you close the tab, and it doesn't identify you.
9. Who we share information with
We share personal information only with the services that help us run Secordit. They are Cloudflare (website hosting and Ordit chat), Shopify (kit images) and Klaviyo (News Pulse emails). They also include the payment and email services named in section 2. We may also disclose information if the law requires it.
10. International transfers
Klaviyo is based in the United States. Klaviyo states that it takes part in the EU-U.S. Data Privacy Framework, including its UK Extension. Where the Framework can't be relied on, it uses Standard Contractual Clauses with a UK Addendum. Klaviyo sets this out in its Data Processing Agreement at https://www.klaviyo.com/legal/dpa.
Cloudflare may process chat messages, and the technical information from your visits, outside the UK. Cloudflare states that it takes part in the EU-U.S. Data Privacy Framework, including its UK extension. For other transfers, its Data Processing Addendum uses Standard Contractual Clauses with the UK Addendum issued by the ICO. Cloudflare sets this out in its Data Processing Addendum at https://www.cloudflare.com/cloudflare-customer-dpa/ and in its privacy policy at https://www.cloudflare.com/privacypolicy/.
Shopify may process the technical information from loading kit images outside the UK, including in Canada and the United States. Shopify's privacy policy says that UK data it sends to other Shopify companies is protected by Standard Contractual Clauses. Shopify sets this out at https://www.shopify.com/legal/privacy (opens in a new tab).
11. How long we keep information
- Order and accounting records: 6 years, to meet UK company record rules.
- Emails you send us: 2 years.
- News Pulse: Klaviyo keeps your sign-up details and email activity until you ask us to delete them. If you unsubscribe, we keep a record of that so we don't email you again.
- Ordit chat messages and the password and domain checks: we don't store them.
12. Your rights
Under UK data protection law you can ask for a copy of your information. You can also ask us to correct it, delete it, restrict or object to how we use it, or move it to another organisation. Where we rely on your consent, you can withdraw it at any time. These rights don't apply in every case. To use them, email [email protected]. We'll reply within one month, and we may ask you to confirm your identity first.
If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commission (known as the ICO) at ico.org.uk/make-a-complaint (opens in a new tab).
13. Automated decisions
We don't make decisions about you by automated means.
14. Children
Our kits and emails are for adults and businesses. We don't knowingly collect information about children.
15. Security
We take reasonable steps to protect personal information, but no website or email system is completely secure. Please don't send passwords or card details by email or in the chat.
16. Changes
We may update this policy. We'll post the new version here and change the "Last updated" date.