Privacy notice
This notice explains what personal data MC Bridge collects, why, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who is responsible for your data
The data controller is Thomas Setchell, trading as MC Bridge, a sole trader based in St Ives, Cambridgeshire, United Kingdom. Contact: hello@mc-bridge.com. [ICO registration number, if required, to be added.]
2. What we collect
- Account details: username, name, email address, password (stored only as a secure one-way hash), plan status and plan dates.
- Uploaded design files and job data: the files you upload, the files we build, and the choices you make (machine family, coordinate system). These files are mainly technical, but they can contain personal data, such as names in file titles or site and client details.
- Logs: login times, failed login attempts and IP addresses (used for security and rate limiting), plus standard web server and error logs.
- Billing details (future): when paid plans start, our payment provider will collect your payment details. We will receive only limited information, such as a customer reference, subscription status and the last four card digits. We will never receive full card numbers.
We do not use analytics, tracking, advertising or social media cookies, and we do not sell your data.
If you create an account yourself
When you sign up on the website we keep: your name and email address (to identify you and log you in); your password, only as a secure one-way hash, so we can never read it; the time you accepted the Terms and this notice; your flip usage (how many free flips you have and have used); and any promo codes you redeem, with the date, so each code is used fairly. Your account works straight away; we do not send a confirmation email.
Free-flip limits. Free flips are offered once per device and, within limits, per internet connection. To do this we set a device cookie (mcb_dev, a random ID with no personal details) and, each time a free flip is used, we record a scrambled (hashed) version of that device ID and of your IP address against your account. We cannot turn these back into your IP address. We use them only to stop the free allowance being claimed again with new accounts (legitimate interests: preventing misuse of a free offer), and we delete these records after 90 days. The cookie expires 90 days after your last visit. Sign-up attempts and IP addresses are kept for up to a day for rate limiting.
Robot check. The sign-up form uses Cloudflare Turnstile to check you are not an automated bot. Cloudflare processes information about your browser and connection for this check under its own privacy policy.
Account details are kept while your account is open and deleted within 90 days of closing it. To have your account and this data deleted, email hello@mc-bridge.com from the address you signed up with.
3. Why we use it and our lawful bases
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Creating and running your account, logging you in, and converting your files | Contract: needed to provide the service you asked for |
| Managing plans and, later, subscriptions and payments | Contract, plus legal obligation for tax and accounting records |
| Security: rate limiting, preventing misuse, and fixing faults through logs | Legitimate interests: keeping the service and users' files safe |
| Service emails (such as trial ending, receipts and important changes) | Contract and legitimate interests |
| Responding to your messages and legal claims | Legitimate interests, and legal obligation where applicable |
We will not send marketing emails unless you opt in, and you can opt out at any time.
4. Where it is stored and who processes it
- Hosting: MC Bridge runs on our own server (a Synology NAS) located in the United Kingdom. Your account data and files are stored there.
- Cloudflare: all traffic passes through Cloudflare, Inc., which acts as our content delivery network, security proxy and secure tunnel. This means Cloudflare processes request data, such as IP addresses, and the data in transit, possibly outside the UK. These transfers are protected by appropriate safeguards, such as the UK International Data Transfer Addendum or the UK–US data bridge.
- Stripe (future): when paid plans start, Stripe Payments Europe, Ltd. or its affiliates will process payments as a separate controller under its own privacy notice.
- Email: messages you send to hello@mc-bridge.com are received through Cloudflare Email Routing (Cloudflare, Inc.) and forwarded to our mailbox. [Outgoing email provider, if any, to be added.]
- We may share data if the law requires it, or to protect our rights.
5. How long we keep it
- Uploaded files, built packs and job folders: deleted automatically about 1 day (24 hours) after upload or build. Download your converted files promptly and keep your own copies.
- Account details: kept while your account is open, and deleted within 90 days of closure. Some records may be kept longer if the law requires it.
- Security logs and login attempts: failed login records are cleared after 15 minutes. Other logs are kept for up to 90 days.
- Billing records (future): kept for 6 years after the end of the tax year they relate to, as HMRC requires.
6. Your rights
You have the right to:
- access your personal data;
- have it corrected;
- have it erased;
- restrict how we use it;
- object to processing based on legitimate interests;
- receive your data in a portable format.
To use any of these rights, email hello@mc-bridge.com. We will reply within one month. Usually there is no charge.
7. Complaints
Please contact us first so we can try to help. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113.
8. Cookies
MC Bridge sets two cookies. mcbridge is a session cookie that keeps you logged in and protects forms against forgery; it expires when you close your browser or after 12 hours of inactivity. mcb_dev is a random device ID used only to apply the free-flip limit (see section 2); it expires 90 days after your last visit. Both are needed for the service you ask for, so they do not need consent under the Privacy and Electronic Communications Regulations (PECR). They are marked HttpOnly and Secure and are not used for tracking or advertising. Cloudflare may set strictly necessary security cookies (such as __cf_bm) to protect the site from bots. We do not use analytics or advertising cookies.
9. Security
We protect your data in several ways:
- encrypted connections (HTTPS);
- hashed passwords;
- login rate limiting;
- keeping each user's files separate.
No system is completely secure. We will tell you, and the ICO where required, about any breach that is likely to put you at risk.
10. Changes
We may update this notice. The date at the top shows the latest version. We will tell you about important changes.
See also: Terms of use.