Privacy Policy

1. Who we are

The controller is CAPTAIN LEGAL LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA. You can contact us via our contact form.

We are established in the United States. The UK GDPR applies to our processing because we offer our products to people in the United Kingdom.

2. Data we collect

• When you order: the email address you enter, the file you choose, the amount, the order date and the payment references sent by PayPal (transaction ID, payer ID and payer email).
• When you contact us: your name, your email address, your company name if you give it, and the content of your message.
• Payment: you pay on PayPal's site, with your PayPal account or a payment card. We never receive your card numbers.
• When you browse: server logs (IP address, date and time, page requested, browser) and, if you accept them, Google Analytics audience measurement data.

3. Purposes and lawful bases

• Processing your order: delivering the file, sending the confirmation email and the invoice, answering questions about your order. Lawful basis: performance of a contract (Article 6(1)(b) UK GDPR).
• Keeping orders and invoices. Lawful basis: our accounting and tax obligations (Article 6(1)(c)).
• Sending a single reminder if you entered your email address but did not complete payment. Lawful basis: our legitimate interest in reminding you of a purchase you started (Article 6(1)(f)). You can object at any time via our contact form.
• Answering your messages. Lawful basis: steps taken at your request before a contract (Article 6(1)(b)) or our legitimate interest in replying to you (Article 6(1)(f)).
• Handling requests to exercise your rights. Lawful basis: our legal obligations (Article 6(1)(c)).
• Keeping the site secure and preventing fraud (server logs). Lawful basis: our legitimate interest (Article 6(1)(f)).
• Measuring audience with Google Analytics. Lawful basis: your consent (Article 6(1)(a) UK GDPR and regulation 6 of PECR). Without your consent, no analytics cookie is set.
• Cookieless visit statistics with Cloudflare Web Analytics. Lawful basis: our legitimate interest in knowing how the site is used (Article 6(1)(f)).

We do not sell our customers' data and we do not pass it to anyone for their own marketing.

4. Who we share data with

Only the people who handle orders and support can access your data. Our service providers access it only for their task:

• PayPal: payment. PayPal processes your payment data for its own purposes, under its own privacy policy.
• Mailjet (Sinch group, France): sending order emails (confirmation, download link, invoice, reminder).
• Google (United States): Google Analytics, only with your consent.
• Cloudflare (United States): delivering the site, protection against attacks and cookieless visit statistics.
• OVH (France): hosting the site.

We may also disclose data to a public authority that requests it under the law.

5. International transfers

Some providers process data outside the UK: in the European Economic Area (Mailjet, OVH), which benefits from UK adequacy regulations, and in the United States (Google, Cloudflare). Transfers to the United States rely on the UK Extension to the EU-US Data Privacy Framework for certified companies, or on the International Data Transfer Addendum to the European Commission's standard contractual clauses. PayPal manages its own transfers under its privacy policy.

6. How long we keep data

• Orders and invoices: 10 years from the order.
• Messages: 3 years from our last exchange.
• Server logs: 90 days.
• Analytics cookies: 13 months at most.
• Cookie storing your choice on the cookie banner: 6 months.

7. Cookies

• Strictly necessary cookies: order and download session (deleted when you close your browser) and the cookie that stores your choice on the banner (6 months). They do not require consent.
• Google Analytics cookies: set only if you click "Accept" on the banner. Lifetime: 13 months at most.

You can change your choice at any time with the "Cookies" link at the bottom of every page. Refusing analytics cookies does not prevent you from browsing or buying.

8. If you are listed in one of our files

Our files contain business contact details, which may include a business or contact name, email address, phone numbers, city, country, activity keywords and website. They are sold to businesses for their marketing or market research. Each buyer agrees in our terms to comply with the UK GDPR and PECR, to tell you where they obtained your data at the latest when they first contact you, and to act on your objections.

You can ask us what we hold about you and where it comes from, object to the use of your data for marketing, or ask for its erasure, via our contact form. We will tell you the source of your data on request. If a business contacted you using one of our files, you can also exercise your rights directly with that business.

9. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing and to receive it in a portable format. You can object to processing based on our legitimate interest, in particular to marketing, and withdraw your consent to analytics at any time.

To exercise these rights, contact us via our contact form. We reply within one month. This period can be extended by two months for complex requests; we will tell you if so. If we have reasonable doubts about your identity, we may ask you for proof.

10. Complaints

If you are not satisfied with how we handle your data, you can complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, helpline 0303 123 1113, ico.org.uk.

Last updated: 18 October 2026. We may update this policy, for example if we change provider; the date above shows the latest version.