Privacy Policy

Last updated: 18 August 2026

This Privacy Policy explains how Soda Creative Studios Ltd ("we", "us", "our") collects, uses, and protects your personal data when you use BioGain at biogain.uk ("Service").

We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

Soda Creative Studios Ltd is the data controller for personal data processed through this Service.

Contact: max@sodastudios.com

2. What Data We Collect

Data	When	Why
Email address	Account registration	Authentication, communications
Password (hashed)	Account registration	Authentication — stored as a non-plaintext hash
Site boundary coordinates	Drawing on map	Generating BNG assessment reports
Saved projects & assessments	Using the Service	Providing project history and continuity
Usage data	Browsing the site	Cloudflare analytics (no personal identifiers)

3. Legal Basis for Processing

Contract: Processing your data to provide the Service you signed up for (account, projects, reports)
Legitimate interest: Site analytics, security, and service improvement
Consent: Marketing communications (if you opt in)

4. How We Use Your Data

To provide and maintain the Service
To authenticate your account
To generate and store your BNG assessment reports
To communicate important service updates
To improve the Service based on usage patterns

We do not sell your personal data. Ever.

5. Data Storage and Security

Account and project data is stored using Cloudflare infrastructure
Passwords are stored as non-plaintext hashes
All data in transit is encrypted via TLS/SSL
The site is served through Cloudflare's CDN with DDoS protection

6. Third-Party Services

Service	Purpose	Data shared
Cloudflare	Hosting, CDN, security	IP address, usage data
Mapbox	Map rendering	Map interactions (anonymised)
Natural England, EA, BGS, NBN Atlas	Environmental data queries	Geographic coordinates only (no personal data)

7. Data Sharing

We share data with third parties only as described above. We do not:

Sell personal data to advertisers or data brokers
Share your site assessments with other users (unless you create a shareable link)
Use your data for AI training

8. Data Retention

Account data: Retained while your account is active, deleted within 30 days of account closure
Project data: Retained while your account is active
Shared reports: Public share links remain accessible until deleted by you or account closure

9. Your Rights (UK GDPR)

You have the right to:

Access — Request a copy of your personal data
Rectification — Correct inaccurate data
Erasure — Request deletion of your data ("right to be forgotten")
Portability — Receive your data in a structured, machine-readable format
Object — Object to processing based on legitimate interest
Restrict processing — Request limitation of processing

To exercise any of these rights, email max@sodastudios.com. We will respond within 30 days.

10. Cookies

We use minimal cookies and localStorage. See our Cookie Policy for details.

11. Children

The Service is not intended for users under 16. We do not knowingly collect data from children.

12. International Transfers

Some third-party services, including Mapbox, may process data outside the UK under appropriate safeguards such as Standard Contractual Clauses.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or notice on the website.

14. Complaints

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO):

ico.org.uk/make-a-complaint

15. Contact

Soda Creative Studios Ltd
Email: max@sodastudios.com