DK LABS
Effective 27 July 2026v2026-07-27

Privacy Policy

The short version: we collect what's needed to run accounts, sell licences, host federations and publish a blog - nothing more. No analytics trackers, no advertising, no marketing lists, and card numbers never touch our servers.The long version follows.

1. Who's responsible

DK Labs Ltd (company number 17232826), York, UK, is the controller for the personal data described here. Contact for anything privacy-related: contact@davidkel.ly.

2. What we collect, and why

  • Account data - email address, optional display name, and a password (stored by Google Firebase Authentication as a hash; we never see it). Used to sign you in and to contact you about your purchases and services. Lawful basis: contract.
  • Purchase and licence data - what you bought, licence keys, and activation records including the URLs and Moodle versions of sites a key is activated on. Used to deliver licences, enforce activation limits, and provide updates and support. Lawful basis: contract; retention of transaction records: legal obligation.
  • Payment data - handled entirely by Stripe. We receive confirmation of payment, the amount, and the last part of the card number for your receipts - never the full card details.
  • Blog comments - what you write, shown with your account name. Lawful basis: contract (you asked us to publish it).
  • Messages - contact-form submissions and emails you send us, retained so we can answer and keep context. Lawful basis: legitimate interest.
  • Nucleus account data - your federation configuration, tier, and billing status. Lawful basis: contract.
  • Logs - standard, short-lived server and request logs (IP address, user agent, timestamps) for security and debugging. Lawful basis: legitimate interest.

3. Content on Nucleus federations

Course content, enrolled users and files on a Nucleus federation belong to the customer who runs it. For that content the customer is the controller and DK Labs is a processor: we host and process it only to provide the service, on the customer's instructions, and we don't use it for anything else. Federation data is hosted in London (DigitalOcean), with encrypted backups in DigitalOcean Spaces. Customers who need a signed data processing agreement can request one at contact@davidkel.ly.

4. Cookies

One cookie: __session, set when you sign in, used to keep you signed in across dklabs.co.uk for up to five days. It's strictly necessary for the service, so no consent banner is required - and there's nothing else to consent to: no analytics cookies, no advertising cookies, no fingerprinting. (The sign-in library also keeps its state in your browser's local storage, which stays on your device.)

5. Who processes data for us

  • Google Cloud / Firebase - authentication, database, and site hosting, in European regions (London and the Netherlands).
  • Stripe - payment processing and subscription billing.
  • Resend - transactional email delivery (receipts, licence keys, notifications).
  • DigitalOcean - Nucleus and demo-site infrastructure (London) and backup storage.
  • Cloudflare - DNS and traffic routing for our domains.

Where a processor is outside the UK (Stripe and Resend operate partly in the US), transfers are protected by the UK Extension to the EU-US Data Privacy Framework or by the standard contractual safeguards recognised under UK GDPR. We don't sell personal data to anyone, and we only disclose it beyond these processors if the law requires it.

6. How long we keep things

  • Account data - while your account exists; deleted on request (see rights below).
  • Purchase records - six years, as UK tax law requires.
  • Licence activation records - for the life of the licence.
  • Comments - until you delete them or your account is deleted.
  • Nucleus federation data - 30 days after termination, backups aging out on the tier's retention schedule (30 or 90 days).
  • Logs - rotated on short schedules, typically days to a few weeks.

7. Your rights

Under UK GDPR you can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interests. Email contact@davidkel.ly and we'll respond within a month. If you're unhappy with how we've handled something, you can complain to the Information Commissioner's Office at ico.org.uk - though we'd appreciate the chance to fix it first.

8. Children

Our own services - the site, shop, and accounts - are aimed at adults and organisations, not children. Where a Nucleus customer's Moodle sites include data about minors (schools do), that data is the customer's responsibility as controller, processed by us only as described in section 3.

9. Changes

If this policy changes materially we'll note it here with a new effective date and tell account holders by email. The version and effective date are always shown at the top of this page.

Questions? contact@davidkel.ly · See also the terms of service.

IN SHORT