LaunchKit is committed to protecting the personal data of its customers, subscribers, and visitors. This policy explains what data we collect, why we collect it, how we use it, and what your rights are under UK data protection law.
1. Who we are
LaunchKit is a trading name of Kevin McCulloch, sole trader, based in the United Kingdom.
hello@yourlaunchkit.co.uk
Kevin McCulloch (trading as LaunchKit) is the data controller for personal data collected through this website and our Shopify storefront. A geographic service address can be provided on request via the email above.
For data protection enquiries: hello@yourlaunchkit.co.uk.
2. What we collect
We collect only the personal data reasonably needed to operate the website, fulfil purchases, and provide support:
- Identification and contact data — name, email address, billing address, country
- Order and transaction data — products purchased, order references, payment provider references
- Communications — support messages, newsletter subscriptions, marketing preferences
- LaunchKit Studio — if you use Studio: the business details you save, the client records you add (names, contact details, notes and quotes saved to a client's file), your saved chats, and photos you add to a chat
- Technical data — IP address, browser type, security logs, basic device data
We do not collect or store full payment card details. Payments are processed securely by Shopify Payments and PayPal, who handle card data under PCI DSS compliance.
3. Why we use your data and our lawful bases
- Processing orders, sending download links, providing support — contract performance
- Accounting, tax, and statutory record-keeping — legal obligation
- Fraud prevention, website security, abuse logging — legitimate interests
- Marketing emails and newsletter subscriptions — consent (you can withdraw at any time)
- Emails after a purchase that help you start using what you bought — contract performance
- Providing LaunchKit Studio — keeping your business details, client records and chats, and writing replies — contract performance
- Improving the website and product range — legitimate interests
- Finding and fixing errors on the website — legitimate interests
- Product analytics with Amplitude — consent (you can withdraw at any time in Cookie settings)
- Ad measurement with Meta (Facebook) and Pinterest, to see which of our adverts work — only if you say yes to ad cookies (you can change this at any time in Cookie settings)
Where we rely on legitimate interests, those interests are: preventing fraud, securing the website, understanding how customers use the site, and improving our products and service.
4. Who we share your data with
We share personal data only with the service providers needed to operate the business:
- Payment processors — Shopify Payments, PayPal
- Email delivery — transactional and marketing email providers, including Customer.io (see below)
- Hosting and infrastructure — Vercel, Shopify, Cloudflare
- Error reporting — Sentry (see below)
- Website usage measurement — Vercel Web Analytics
- Product analytics, only if you agree to analytics cookies — Amplitude, Inc. (USA). See sections 5 and 8.
- Ad measurement, only if you agree to ad cookies — Meta (Facebook) and Pinterest. See section 8.
- Customer support tooling
- AI processing for LaunchKit Studio — what you type in a Studio chat, any photo you add to that message, recent messages from that chat and your confirmed business details (including your prices) are sent to xAI to write the reply, or to Anthropic when you choose a Detailed reply. On the Quote page, xAI reads a customer message you paste only when you ask it to. Studio answers some questions itself, such as what it stores or your saved hourly rate, without sending them to an AI provider.
These providers receive only what they need to perform their function. They are bound by their own data protection commitments and process data on our instructions.
Ad measurement is different: Meta (Facebook) and Pinterest also use what they receive under their own privacy policies (see section 8).
Customer.io. Customer.io (Peaberry Software, Inc., trading as Customer.io) sends our marketing emails and the emails that follow a purchase. It is our processor: it handles your data only on our instructions, under a data processing agreement. When you sign up for LaunchKit emails, or pay for an order, our servers send Customer.io your email address and, where we have them, your first name, the trade you picked, what you bought, and whether you agreed to marketing emails at checkout. Customer.io also keeps a record of your email choices (including any unsubscribe), the emails we send you, and which links in them you click. If you only asked for a single email, such as a printable copy of a guide, we do not pass your details to Customer.io.
Sentry. Sentry (Functional Software, Inc., trading as Sentry) tells us when something goes wrong on this website, so we can fix it. It is our processor: it handles data only on our instructions, under a data processing agreement. When a page or one of our servers hits an error, a report of that error may go to Sentry. The report says what went wrong and where in our code, gives the address of the page (with anything after a question mark removed, and private download and order links blanked out), and lists the steps on the page just before the error, such as which page was opened or which button was pressed. We send Sentry error reports only. They leave out your name, IP address, cookies, login details and anything you send us in a form, and any email address in an error message is blanked out. Sentry does not record your visits, the pages you look at or your screen.
Separately, our Shopify checkout loads Pinterest's tag. See section 8.
We do not sell your personal data to third parties.
5. International transfers
Some of our service providers (e.g. Shopify, Vercel) operate globally. Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or adequacy regulations.
Customer.io is based in the United States, so your data may be transferred to and processed in the US. Customer.io is certified under the UK Extension to the EU-U.S. Data Privacy Framework, and UK adequacy regulations (the Data Protection (Adequacy) (United States of America) Regulations 2023) recognise certified organisations as giving adequate protection. Customer.io's data processing agreement also includes the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
Sentry keeps the error reports from this website in the European Union, in Frankfurt, Germany, and our website sends them only to Sentry's German service (de.sentry.io). UK adequacy regulations recognise the EU as giving adequate protection. Sentry is based in the United States and uses other companies to help run its service, so some of this data may be seen from the US or other countries. Sentry is certified under the UK Extension to the EU-U.S. Data Privacy Framework, and its data processing agreement also includes the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
LaunchKit Studio's AI providers are based in the United States: xAI writes chat replies (and reads a customer message on the Quote page when you ask it to), and Anthropic writes Detailed replies. What Studio sends them is processed in the US. For these transfers we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or, where the provider is certified under it, the UK-US data bridge (the UK Extension to the EU-U.S. Data Privacy Framework).
Amplitude keeps the analytics data we send it in its United States data region. Amplitude, Inc. is certified under the UK Extension to the EU-U.S. Data Privacy Framework, which UK law treats as giving adequate protection (the UK-US “data bridge”). Amplitude's data processing terms also include the EU Standard Contractual Clauses with the UK International Data Transfer Addendum as a fallback.
6. Data retention
We keep personal data only as long as needed for the purpose it was collected:
- Order and accounting records — retained for as long as required by UK tax and accounting law
- Support messages — retained as long as needed to assist and for a reasonable follow-up period
- Marketing data — retained until you unsubscribe or otherwise withdraw consent. After that we keep a record that you unsubscribed, so we do not email you again
- Security and fraud logs — retained for a limited period proportionate to the purpose
- Error reports — deleted automatically by Sentry within 90 days
- LaunchKit Studio client records — kept with your account while you use Studio. If your Studio access ends, you can still read and export them for 90 days; then Studio deletes them
- LaunchKit Studio chats — kept with your account until you delete them. You can delete any chat, or clear them all, in Studio
- Photos you add to a Studio chat — kept privately with your account. To have them deleted, contact us (see section 7)
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request erasure of your data (“right to be forgotten”)
- Restrict or object to certain types of processing
- Receive a copy of your data in a portable format
- Withdraw consent at any time (where processing is based on consent)
- Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint
You have the absolute right to object to direct marketing at any time.
To exercise any of these rights, contact hello@yourlaunchkit.co.uk. We will respond within one month of receiving a verifiable request.
8. Cookies and measurement
We use essential browser storage needed to operate the website and process orders (for example cart and checkout state). We measure page views and steps such as product clicks to understand and improve the website.
We use Vercel Web Analytics for website usage statistics. Before a page URL is sent to this service, our website removes its query string and fragment and redacts the delivery token in Studio completion URLs.
Vercel says its analytics uses no third-party cookies and distinguishes visitors using a hash derived from incoming requests. Vercel states that visitor sessions are discarded after 24 hours. That session limit does not describe how long all analytics data is kept. See Vercel's analytics privacy documentation.
For this website's own measurement, we do not use Google Analytics 4 (GA4). Advertising tags from Meta (Facebook) and Pinterest load only if you say yes to ad cookies (see below).
If you agree to analytics cookies, we also use Amplitude, Inc. (201 Third Street, Suite 200, San Francisco, CA 94103, USA) as our processor, to see which pages, trades and products are useful and where people stop on the way to buying. Nothing is sent to Amplitude, and its code is not loaded, until you say yes. You can change your mind at any time in Cookie settings: we then stop sending data and delete these cookies from your browser.
When you first visit, a cookie banner asks whether you agree to analytics cookies and to ad cookies. Accept and Reject are equally easy and nothing is ticked in advance, and Cookie settings lets you accept one without the other; if you press Reject or ignore the banner, both stay off. We keep your answer, including a refusal, in an essential first-party cookie, lk_consent, for six months, and then ask again. You can change or withdraw your choice at any time with Cookie settings at the bottom of every page.
With your yes, we send Amplitude the pages you view (the address without anything after a “?”), the trade and product you look at, when you choose a tier, press Add to cart or Buy now, or go to checkout, and the campaign tags in the link you arrived from (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and, if you came from a Facebook or Instagram link, the click identifier Meta adds to it (fbclid). We also keep the first campaign that brought this browser to us, and the page it landed on, so later visits and purchases can be credited to it. From our own server we also tell it when you sign up for a free pack or for Studio, make your first Studio document, or pay for an order (the order value and products only). We never send your name, email address, order number or what you write in Studio, and Amplitude is set not to record your IP address, so it does not work out where you are.
Cookies set only after you say yes: lk_analytics_id, a random ID so visits from this browser can be counted together, and Amplitude's AMP_… cookie, holding the same random ID and your current visit. Both last up to six months. Also only after a yes, your browser's own storage keeps the campaign tags of this visit (lk_utm, until you close the tab) and of your first visit with campaign tags (lk_first_touch, up to six months). If you withdraw, all of these are deleted from your browser. We keep analytics data only while it helps us improve the website, and you can ask us to delete yours at any time (see section 7).
If you agree to ad cookies, our pages also load Meta’s pixel (Facebook) and Pinterest’s tag, which we use for ad measurement: to see whether people who see or click our adverts on Facebook, Instagram or Pinterest go on to visit our site. Nothing loads, and nothing is sent to Meta (Facebook) or Pinterest, until you say yes. You can change your mind at any time in Cookie settings: we then stop sending anything to Meta (Facebook) or Pinterest and delete their cookies from our site.
With your yes, Meta (Facebook) and Pinterest receive the address of each page you view here and of the page you came from, the click code in the link if you came from one of their adverts (fbclid or epik, even if you say yes a page or two later), and basic details of your browser and device; like any website, they also see your IP address. They are also told when you look at a product, press Add to cart or Buy now, or go on to checkout: which product (our product code), its price and how many. We only send this from addresses that carry nothing but campaign tags, so order numbers, search words and sign-in details in an address are never passed on. We don't send them your name, email address, phone number or order number. Meta (Facebook) and Pinterest also use what they receive under their own privacy policies, and can link it to your account if you have one with them.
Cookies set only after you say yes: Meta's _fbp and _fbc (up to three months) and Pinterest's _pin_unauth, _epik and _derived_epik (up to a year), which let them recognise this browser and link a visit to an advert.
Customer.io does not set cookies or run any script on this website. The details listed in section 4 go to Customer.io from our own servers, not from your browser.
Sentry does not set cookies. Its code runs on this website only to send a report when something on the page goes wrong.
Separately, our Shopify checkout, where you pay, loads Pinterest's tag. Pinterest's own privacy policy explains what its tag collects.
9. Children
Our products and website are intended for business owners and adults. We do not knowingly collect personal data from children under 16.
10. Changes to this policy
We may update this policy from time to time. The “Last updated” date below shows when it was most recently revised. The version in effect at the time of your purchase or interaction governs how your data is handled at that time.
Last updated: October 2026