Privacy Policy

Last updated: 2 August 2026

This notice explains what personal data Daum Ltd collects when you use the Brytebuild website and the Brytebuild application, why we collect it, and what rights you have over it. It is written to meet Articles 13 and 14 of the UK GDPR.

Who we are

Daum Ltd (“we”, “us”) is a company registered in England and Wales, based in London, and is the data controller for the personal data described in this notice. Brytebuild is our product.

We are not required to appoint a Data Protection Officer and have not appointed one. Privacy enquiries go to the address above.

Two different roles, and why the difference matters

We handle personal data in two distinct capacities, and your rights work differently in each.

We are the controller of data about you as a visitor, an enquirer, or the holder of a Brytebuild account: your name, email address, company, sign-in records and billing details. This notice covers that data.

We are a processor for the business data you put into Brytebuild — your customers, suppliers, staff records, orders and quality records. You remain the controller of that data. We only act on your instructions, we do not use it for our own purposes, and if it contains personal data about your customers or staff, they should be directed to your privacy notice, not this one. The terms governing that relationship are in our data processing terms, available on request.

What we collect, why, and on what lawful basis

Data Why we hold it Lawful basis
Name, work email, company name, phone number To create and administer your account, and to reply to enquiries and demo requests Performance of a contract; legitimate interests (responding to someone who contacted us)
Password (stored only as an Argon2id hash, never in readable form) To authenticate you Performance of a contract
Sign-in records, IP address, failed login attempts To detect and block brute-force attacks and to investigate suspicious access Legitimate interests (securing the service); legal obligation (Article 32 security duty)
Billing details and subscription history To take payment and meet tax and accounting duties. Card details are entered directly with Stripe and never reach our servers Performance of a contract; legal obligation (HMRC record-keeping)
Records of actions taken in the application (the audit log) To give your organisation an accurate audit trail, which quality standards such as ISO 9001 require Performance of a contract; legitimate interests (integrity of the record)
Support correspondence To resolve your issue and improve the product Legitimate interests (supporting our customers)
Website analytics and cookies To understand how the site is used Consent, given through the cookie banner and withdrawable at any time
Marketing emails to prospects To tell you about Brytebuild Consent, or the soft opt-in for existing customers under PECR. Every message carries an unsubscribe link

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you may object at any time using the contact details above.

Providing your name, email and company is necessary to hold a Brytebuild account. Without them we cannot create or run the account. Everything else is optional.

Who we share it with

We do not sell personal data and we do not share it for anyone else’s marketing. We use the following processors, each under a written contract that restricts them to our instructions:

  • Amazon Web Services — hosting, file storage and content delivery for the application.
  • Stripe Payments Europe — subscription payments and card processing.
  • Hostinger — hosting for this website.
  • Google — optional Google sign-in, and website analytics where you have consented.
  • Microsoft — optional Microsoft sign-in, where you choose to use it.
  • Our email provider — sending account, verification and notification emails.

If you connect Brytebuild to Xero, Sage or WooCommerce, data flows to that provider because you have instructed it to. Those providers are separate controllers for what they receive, under their own privacy notices, and you can disconnect an integration at any time in your settings.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

Where your data is held

Brytebuild is hosted in the United Kingdom, in London. Your business data does not leave the UK in the ordinary course of running the service. Some of our processors are based in, or have support operations in, the United States, so limited personal data such as billing details may be transferred there. Where personal data is transferred outside the UK, the transfer is protected by the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, or by UK adequacy regulations where they apply. A copy of the relevant safeguard is available on request.

How long we keep it

  • Account data: for as long as your account is open, then 12 months after closure so the account can be restored if the closure was a mistake.
  • Billing and tax records: six years from the end of the accounting period, as UK tax law requires.
  • Security and sign-in logs: 12 months.
  • Support correspondence: 24 months from the last message.
  • Marketing contact data: until you unsubscribe, or after 24 months with no engagement.
  • Business data you entered into the application: deleted or returned within 30 days of your account closing, unless you ask us to keep it for longer.

How we protect it

Passwords are never stored in a readable form. We hash them with Argon2id, the algorithm OWASP recommends for new systems. Traffic is encrypted in transit. Access to production systems is limited to staff who need it. Repeated failed sign-in attempts are locked out automatically, and passwords are checked against known breach databases so a compromised password cannot be reused here.

Your rights

Under the UK GDPR you have the right to:

  • be told how your data is used, which is what this notice does;
  • ask for a copy of the personal data we hold about you;
  • have inaccurate data corrected;
  • ask us to delete your data, where we have no overriding reason to keep it;
  • ask us to restrict how we use it while a dispute is resolved;
  • receive data you gave us in a portable, machine-readable format, and have it sent to another provider;
  • object to processing based on our legitimate interests, and to direct marketing at any time; and
  • withdraw consent at any time where we rely on it, without affecting anything done beforehand.

To exercise any of these, email privacy@brytebuild.co.uk. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

Account holders can also export their own data at any time from Settings, without needing to ask us.

Automated decision-making

We do not make decisions about you by automated means that produce legal effects or similarly significant effects. Brytebuild does generate forecasts and planning suggestions from your business data, but these are recommendations for a person to accept or reject, not automated decisions about individuals.

Cookies

We use cookies that are strictly necessary to run the site and keep you signed in, and — only with your consent — analytics cookies that tell us how the site is used. You can change or withdraw your choice at any time through the cookie settings link on the site, or by clearing cookies in your browser.

Children

Brytebuild is a business product. It is not intended for anyone under 18 and we do not knowingly collect data about children.

Changes to this notice

If we change how we use personal data we will update this page and change the date at the top. Where a change is significant we will tell account holders by email rather than relying on you to notice.

Complaints

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at any time:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint