Privacy Policy

Who are we?

Creator Kit Lab ("we", "us") is an editorial website at creatorkitlab.co.uk operated from the United Kingdom by Rob Griffiths, who is the data controller for any personal data you provide while using the site.

You can contact the data controller, Rob Griffiths, at [email protected] or through the contact form, including with any question about this policy or your data.

What data do we collect?

Visiting the site does not require an account, email signup or any personal details. The information we do collect is limited to:

• Anonymous traffic measurement (page views, referrer, country, device class) via Google Analytics 4, only after you accept analytics in the cookie banner.
• Tag-management state via Google Tag Manager - the loader runs on every page, but downstream tags (analytics, advertising) fire only with the matching consent.
• Server logs retained by Cloudflare for security and abuse prevention (IP, request URL, timestamp, user agent) under Cloudflare's own privacy policy.

If you use our contact form or email us, we receive your name, email address and message, and use them only in connection with your message. We do not run a mailing list, e-commerce store or user-account system, so we collect no payment data and no profile information.

How do we use cookies?

The site operates under Google Consent Mode v2. On your first visit you'll see a cookie banner where you can:

• Accept all (essential + analytics)
• Reject non-essential (essential only)
• Customize (toggle analytics on/off)

Denied is the default for analytics, advertising, ad personalisation and personalisation storage until you give consent. Functionality and security cookies are always granted (they are strictly necessary for the site to work).

You can change your choice at any time via the "Cookie preferences" link in the footer.

If your browser sends Do Not Track (DNT), we respect it and do not load analytics regardless of the banner state.

Cookies and similar technologies we use

Each cookie or storage item the site uses, with its purpose, who sets it and how long it lasts:

• Your cookie choice (csg_consent_v1) - remembers whether you accepted or rejected analytics, so the banner does not ask again on every page. Set by us (creatorkitlab.co.uk) in your browser's local storage, not shared with any third party. Strictly necessary, so it does not need consent. It has no expiry date: it stays until you change your choice in "Cookie preferences" or clear your browser's site data.
• Google Analytics 4 (_ga and _ga_HNS0LCR8VF) - _ga tells one visitor apart from another and _ga_HNS0LCR8VF keeps track of your visit (session), so we can count page views and see which guides are read. Set on creatorkitlab.co.uk by Google's analytics tag, loaded through Google Tag Manager; the data goes to Google LLC. Only set after you accept analytics. Each lasts 2 years from your last visit, Google's default, and is removed sooner if you withdraw consent and clear your cookies.
• Cloudflare Turnstile (bot protection) - checks that the contact form is being sent by a person rather than a bot. Provided by Cloudflare, Inc., and only loaded on the contact page when you reach the form. It runs in a frame from challenges.cloudflare.com and reads technical signals from your browser to issue a one-time token sent with your message; it sets no cookie on creatorkitlab.co.uk. Cloudflare states these signals are strictly necessary for detecting and blocking bots, so they do not need consent. The token is used once, when you send the form.
• Amazon price data (r2-geo) - live Amazon prices are fetched from our own server when a page with an Amazon price loads, and no Amazon cookie is set by that. To show the right Amazon store, the site remembers your country code (for example "GB"), worked out by Cloudflare from your connection, in your browser's session storage. Set by us; the prices themselves come from Amazon (Amazon Associates product data), but your country code is not sent to Amazon. Strictly necessary to show the price you asked to see. It is deleted when you close the browser tab.
• Display preferences (r2-theme, and a dismissed comparison or notice bar) - remember your light/dark theme choice (local storage, until you clear it) and that you closed a bar (local storage, or session storage until you close the tab). Set by us, never shared, and strictly necessary to give you the display you asked for.

If you click an affiliate link to a retailer such as Amazon, that retailer may set its own cookies on its own website, under its own cookie policy; we do not set or read those.

How do affiliate links work?

Some outbound links to retailers are affiliate links - we may earn a commission when you click through and buy. The destination retailer may set cookies on their domain; we have no control over those. As an Amazon Associate we earn from qualifying purchases. See the affiliate disclosure for our editorial position on affiliate revenue.

We do not currently run programmatic display advertising on the site. If this changes, this policy will be updated and you'll be re-prompted for advertising consent.

How do we use your information?

Aggregate, anonymous traffic data is used solely to:

• Understand which guides are useful (and which need rewriting)
• Detect technical errors and broken pages
• Inform editorial priorities (which creator formats and gear categories are under-served)

We do not sell personal data, share it with brokers, or use it for any kind of advertising profile.

What is our lawful basis for using your data?

UK GDPR requires a lawful basis for each purpose we use personal data for. Ours are:

• Analytics (Google Analytics 4) - measuring which pages are read and how the site performs. Lawful basis: consent (Article 6(1)(a)), given in the cookie banner. You can withdraw it at any time via the "Cookie preferences" link in the footer, and analytics stops from that point.
• Security logs (Cloudflare) and bot protection (Cloudflare Turnstile) - keeping the site available and protecting it and its readers from attacks, spam and abuse. Lawful basis: legitimate interests (Article 6(1)(f)). Our legitimate interest is running a secure, working website, and the data used is limited to technical request details.
• Replying to contact-form messages and emails - reading and answering what you send us. Lawful basis: legitimate interests (Article 6(1)(f)). Our legitimate interest is responding to people who get in touch, and we use your name, email address and message only for that.

Your rights under UK GDPR

You have the right to:

• Be informed about how your data is used (this page)
• Access any personal data we hold about you
• Have inaccurate data corrected
• Have data erased ("right to be forgotten")
• Restrict how we process your data
• Withdraw consent at any time

Your right to object

You have the right to object, at any time, to our processing of your personal data where we rely on legitimate interests (Article 6(1)(f)) - that is, our security logs and bot protection, and our handling of contact-form messages and emails. When you object, we will stop that processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. We do not use your data for direct marketing; if we ever did, you could object to it at any time and we would always stop. To object, use the contact form or email [email protected].

Given we collect no directly identifying personal data, in practice most of these rights are satisfied by withdrawing analytics consent in the cookie banner.

How to make a complaint

If you are unhappy with how we have used your personal data, please complain to us first. Send your complaint through the contact form or email [email protected], telling us what happened and what you would like us to do. We will acknowledge your complaint within 30 days of receiving it, look into it, keep you informed of our progress, and tell you the outcome.

If you are not satisfied with our response, or you believe we have handled your data improperly, you also have the right to complain to the Information Commission, the UK's data protection regulator (it still operates under the name ICO, the Information Commission's Office). You can make a complaint at ico.org.uk/make-a-complaint.

Which third parties do we work with?

The site uses:

• Cloudflare - hosting, DNS and DDoS protection
• Google Analytics 4 - anonymous traffic measurement (with consent)
• Google Tag Manager - tag orchestration
• Google Search Console - indexability monitoring (server-side only, no user-side cookies)
• Amazon Associates - affiliate links to Amazon UK product listings; live price display uses Amazon's product data service
• Amazon Web Services (Amazon SES) - delivers messages sent through the contact form (AWS Europe (Ireland) region)
• Cloudflare Turnstile - bot protection on the contact form

Each third party has its own privacy policy linked from its respective site.

Is your data transferred outside the UK?

Some of the providers listed above are based in, or process data in, the United States, so using the site can involve transferring personal data from the UK to the US:

• Google LLC (Google Analytics 4, Google Tag Manager) - analytics data, only with your consent.
• Cloudflare, Inc. (hosting, security logs and Turnstile bot protection) - technical request details such as IP address and user agent.
• Amazon Web Services, Inc. (Amazon SES) - contact-form messages are processed in AWS's Europe (Ireland) region, but AWS is a US company and may access them from the US.

The safeguard for these transfers is the UK-US data bridge: each of these companies states that it is certified under the UK Extension to the EU-US Data Privacy Framework, which UK law recognises as giving adequate protection (the Data Protection (Adequacy) (United States of America) Regulations 2023). If a provider's certification lapsed, the transfer would need another UK safeguard, such as the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; Cloudflare states that it would rely on standard contractual clauses in that case. You can check a company's certification on the official Data Privacy Framework list at dataprivacyframework.gov, and contact us for more information about these safeguards.

How long do we keep your data?

• Analytics data (Google Analytics 4) - Google keeps user-level and event-level analytics data for no more than 14 months, the longest a standard Google Analytics property allows, and then deletes it automatically. After that, only aggregated reports remain, which do not identify you.
• Server logs (Cloudflare) - we do not store or export request logs ourselves. Cloudflare processes request details (IP address, request URL, timestamp, user agent) to deliver the site and protect it from attacks, and by default it does not retain HTTP request logs for our account. Any security data Cloudflare keeps on its own systems is kept only for as long as that security purpose and its legal obligations require, and then deleted, as its privacy policy sets out.
• Contact-form messages and emails - the site itself stores no copy of what you send through the contact form. Amazon SES delivers your message to our email inbox, where we keep it for up to 24 months after our last reply to you, so we can handle any follow-up, and then delete it.

How will we notify you about changes?

We may update this policy from time to time. Material changes will be flagged in the footer with the updated date. Continuing to use the site after an update constitutes acceptance of the revised terms.

How can you contact us?

For privacy questions, use the contact form or email [email protected].