This policy covers sochra.com: our marketing website, the public demo and the early-access form. It is run by SOCHRA LIMITED, a company registered in England and Wales (company number 17511908), registered office 122 Elvaston Road, North Wingfield, Chesterfield, England, S42 5GA ("sochra", "we", "us"). We are the controller for the personal data described here. ICO registration number: ZC273152.
sochra.com does not offer accounts, sign-in, a paid service or billing. Nothing on the site connects to your store.
1. Early-access form
If you request early access on sochra.com, we store what you enter (your work email, your store's website, where you sell, your order band, what you'd like help with, your optional note, your business name if you give one, and the country your business is registered in) in a private database on our hosting provider. We also record whether the email address is a personal webmail address, how many times you have sent the form, when you sent it, the status of your request (for example new or replied), and a consent record: the version and time of the privacy notice you agreed to and, if you allowed advertising cookies, your advertising choice, when you made it and which partners you allowed.
When you send the form, we email an alert to our support inbox (support@sochra.com) so our team knows to look. The alert holds only the request's reference number, which site it came from (live or test) and a link for our team to look it up. It contains no personal details.
After a new request, we send one plain confirmation email to the address you entered, from a sochra.com address, to say we've received it. To send it, we pass your email address to our hosting provider, Cloudflare (Cloudflare Email Sending). We send only one confirmation per email address, even if you send the form again, and we record the time it was sent with your request. To make sure each address only gets one confirmation email, we also keep a simplified form of your email address (lower-case, without any +tag or, for Gmail, dots), deleted with your request. We use your email address to send that confirmation and to reply to you about your request.
If you've accepted advertising cookies, then when you request access our server also sends the advertising partners you allowed the following, only so they can tell us you came from one of our ads:
- a scrambled (hashed) copy of your email address;
- your IP address and your browser's user agent (sent to every partner except Google);
- the address of the page you sent the form from (every partner except Google);
- the ad click ID from the link you followed, if there is one (for example Google's gclid);
- the partner's own cookie IDs, if your browser has them (for example Meta's _fbp and _fbc);
- an event ID and the time of the request.
A scrambled email is still personal data. Partners can match it to an account they already have for that address, but they never receive the email address itself. We never send any of this if you chose Reject, and you can change your choice at any time in Cookie settings.
To stop abuse of the form, we count requests from each connection for each hour. We keep only a scrambled (hashed) form of the IP address for this, not the address itself.
Server and security logs
Like any website, sochra.com runs on servers that see your IP address and browser user agent when you visit. Our hosting provider, Cloudflare, uses them to deliver the site and protect it from attacks, and keeps short-lived request and security logs under its own retention periods. We don't use these logs to identify visitors.
1a. Visit counts
We use Cloudflare Web Analytics, provided by Cloudflare, to count page views and measure how fast our pages load. It uses no cookies and stores nothing on your device. Lawful basis: legitimate interests. Turn it off with the Visit counts switch in Cookie settings (we then keep only a note of that choice in your browser's local storage), and if your browser sends a Global Privacy Control signal, we don't load it at all.
2. Public demo
The public demo shows a made-up store with example data only. It uses no real store or customer data, and you don't need to sign up or enter any personal details to use it.
3. Why we use it (lawful bases, UK GDPR Art. 6)
| Purpose | Basis |
|---|---|
| Storing your early-access request, alerting our team, sending your confirmation email and replying to you | legitimate interests |
| Keeping a record of the consent you gave on the form | legitimate interests (showing we have your consent) |
| Protecting the form and the site from abuse (scrambled IP counts, Cloudflare security logs) | legitimate interests |
| Advertising measurement on sochra.com (partner tags, and a scrambled email when you request access), only for partners you allow | consent (UK GDPR Art 6(1)(a); PECR reg 6) |
| Answering emails you send us | legitimate interests |
We do not sell personal data. We do not collect special category data, and the site is not intended for children.
4. Who we share it with
- Our hosting provider, Cloudflare, which runs the site, stores the form entries and sends the alert and confirmation emails.
- Google Workspace, which we use for our support email.
- Advertising partners, only if you allow them (see below).
- Professional advisers, and authorities where the law requires.
- A buyer of our business, under equivalent protections.
The full list is on the sub-processors page.
5. International transfers
We store early-access requests in Western Europe, on Cloudflare. Some providers process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Addendum / IDTA.
We use Google Workspace for support email. It is provided to us by Google Cloud EMEA Limited in Ireland. Where Google transfers that email to Google LLC in the USA, it relies on the UK Extension to the EU-US Data Privacy Framework (UK adequacy regulations), in which Google LLC is an active participant, with the EU Standard Contractual Clauses and the ICO's UK Addendum as a fallback, under Google's Cloud Data Processing Addendum.
6. How long we keep it
| Data | Retention |
|---|---|
| Early-access requests (including the consent record) | Deleted 6 months after you send the request |
| Confirmation email (the time it was sent, and the simplified form of your email address, kept with your request) | Deleted with your request, 6 months after you send it. |
| Scrambled IP counts for abuse protection | Up to 2 days |
| Cloudflare request and security logs | Cloudflare's own short retention periods |
| Emails you send us | As long as needed to deal with your message |
7. Security
Data is encrypted in transit (TLS 1.2+) and at rest, and only our team can read form entries. See sochra.com/security.
8. Your rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Email privacy@sochra.com. We respond within one month. You can complain to the ICO (ico.org.uk).
9. Cookies
On sochra.com we store your cookie choice (sochra_consent) and, only for the partners you allow, advertising cookies from those partners. We don't use advertising cookies for visitors in the EEA (the EU, Iceland, Liechtenstein and Norway), or when we can't tell which country you're in. See the cookie notice.
10. Changes
We will post updates on this page and change the date at the top.
11. Contact
SOCHRA LIMITED (company number 17511908), 122 Elvaston Road, North Wingfield, Chesterfield, England, S42 5GA. Privacy: privacy@sochra.com. Support: support@sochra.com. Security: security@sochra.com.