Draft — under legal review
Privacy policy
What personal data we store, why we store it, who helps us process it and how you can see or delete it.
Last updated: 12 October 2026
This is a draft for review by a lawyer. It is not legal advice, and it is not yet the final text.
1. Who is responsible
The data controller is 0EXP DIGITAL LTD, a private limited company registered in England and Wales.
- Company
- 0EXP DIGITAL LTD, a private limited company registered in England and Wales
- Company number
- 16456627
- Registered office
- PO Box 4385, 16456627 - Companies House Default Address, Cardiff, CF14 8LH
- contact@0exp.com
We process personal data under the UK GDPR and the Data Protection Act 2018. Where we offer goods or services to people in the European Union, the EU GDPR also applies. EU representative: [to be confirmed, if required].
2. What we store
- Email lists: your email address, the list you joined (newsletter or Superpowers Pack early access), that you agreed, and the date. For early access, also the kind of work you chose, if any.
- Orders: your email, whether you buy as a person or a business, the product, the price, the order number, the licence key, the consents you gave at checkout and, for businesses, the company name and VAT ID.
- Payments: Stripe collects your card details and any billing details it asks for. We get only the payment result and basic payment information.
- Help emails: what you write to us and our replies.
- Technical logs: the server keeps normal logs (such as IP address and pages requested) for security.
3. Why we use it, and our legal basis
- Email lists: to send the emails of the list you joined. Basis: your consent.
- Orders, delivery, licence keys and help: to perform our contract with you. Basis: contract.
- Tax and accounting records: Basis: legal obligation.
- Security logs and abuse prevention: Basis: our legitimate interest in a safe website.
4. Who processes data for us
- Hosting: [hosting provider — to be named].
- Payments: Stripe.
- Email sending: [email provider — to be named].
- Analytics, only with your consent: Google (Google Analytics 4).
We do not sell or share your data for marketing. Some providers may process data outside the UK. Where they do, we use safeguards that the law allows, such as adequacy regulations or standard contract clauses [details to be confirmed].
5. How long we keep it
- Early-access list: until the launch emails are sent, then deleted.
- Newsletter: until you unsubscribe.
- Orders and invoices: as long as tax law requires [period to be confirmed, typically 6 years in the UK].
- Technical logs: [period to be confirmed].
6. Your rights
You can ask to see, correct or delete your data, to restrict or object to its use, and to get a copy in a portable form. You can withdraw consent at any time, and every email we send has an unsubscribe link. Email contact@0exp.com.
You can complain to the UK Information Commissioner's Office (ico.org.uk). If you live in the EU, you can complain to the data protection authority in your country.
7. Cookies and analytics
One necessary cookie remembers your cookie choice. Google Analytics runs only if you accept analytics; Google then processes visit data for us. We never send your email, order number or licence key to Google. The full list and how to change your choice are in the cookie policy.
8. Changes
We update this policy when what we do changes. The date at the top shows the last update.