Privacy Policy
Last updated: 12 August 2026
Who we are
FRACTA (“we”, “us”) operates fracta.uk. For the purposes of UK GDPR we are the data controller.
Controller: [LEGAL NAME OR TRADING NAME]
Address: [POSTAL ADDRESS]
Contact: admin@fracta.uk
What we collect, and why
If you join the waitlist
- Email address, and optionally whether you're an artist, fan or label.
Lawful basis: consent. You can withdraw it at any time by emailing us.
If you create an account
- Name and email address.
- Password, stored only as a bcrypt hash. We cannot read it, and neither can anyone who obtains the database.
- Username, if you reserve one.
- Two-factor secret and backup codes, if you switch two-factor on. Backup codes are hashed.
- Sign-in activity — failed attempt counts and last sign-in time, used to lock accounts under attack.
Lawful basis: performance of a contract (providing the account) and legitimate interests (keeping it secure).
If you buy a Founding Membership
- The record of your purchase — tier, amount, date, founding number.
- Card details are never sent to us. Payment is handled entirely by Stripe; we receive only a confirmation and a reference.
Lawful basis: contract, and legal obligation for keeping financial records.
Automatically
- A session cookie so you stay signed in. Strictly necessary — the site cannot work without it, so it needs no consent banner.
- IP address, used transiently for rate limiting and recorded against security events.
We do not use analytics, advertising or tracking cookies. Stripe sets its own cookies for fraud prevention, but only once you open the payment window — not on ordinary browsing.
Who else sees your data
We use three processors, each under their own agreement:
- Stripe — payments. Stripe is the controller for card data.
- Resend — sends confirmation and password-reset emails.
- [HOSTING PROVIDER] — runs the servers the site sits on.
We do not sell your data, and we never will.
How long we keep it
- Accounts — until you delete them.
- Unconfirmed accounts — deleted automatically after 30 days.
- Abandoned checkouts — deleted after 30 days.
- Sign-in links and reset tokens — deleted within 7 days of expiry.
- Waitlist — until you ask to come off it, or FRACTA closes.
- Purchase records — six years, as UK tax law requires. When you delete your account these are anonymised rather than erased, so the transaction remains but is no longer linked to you.
- Security logs — two years.
Your rights
Under UK GDPR you can:
- See your data. Sign in and use Download my data on your account page — it's immediate, no request needed.
- Delete your account. Also on your account page. Permanent and immediate.
- Correct it, restrict or object to how it's used, or ask for it in a portable format.
- Withdraw consent for marketing email at any time.
Email admin@fracta.uk for anything the account page doesn't cover. We'll respond within one month.
If you think we've handled your data badly you can complain to the Information Commissioner's Office at ico.org.uk. We'd rather you told us first so we can put it right.
Security
Passwords are hashed with bcrypt. Two-factor authentication is available. Sessions are HTTP-only and same-site. Sign-in is rate limited and accounts lock after repeated failures. Data is encrypted in transit over HTTPS.
No system is perfectly secure. If you find a vulnerability, please tell us at admin@fracta.uk before disclosing it publicly — we'll credit you.
Children
FRACTA isn't intended for under-16s. If you believe a child has given us personal data, email us and we'll delete it.
Changes
We'll update the date at the top when this changes, and email account holders about anything significant.