Privacy policy

This website

The site is static pages served by Cloudflare. It sets no cookies of its own and runs no analytics or advertising scripts. Cloudflare, as the host, sees the IP address of every request in order to serve the page and defend against abuse, and we see aggregate request counts in Cloudflare’s dashboard. We do not see individual visitors.

The only place the site collects anything is the request-a-look form. If you fill it in, we store your name, work email, association name, the member and staff ranges you pick, and whatever you type about your current systems. Alongside that we store the browser’s user agent string and the country Cloudflare attributes to your connection, so we can tell a real enquiry from a bot. These records live in a Cloudflare D1 database and a copy of the form is emailed to us through Resend.

We use that information to reply to you and, if you agree to a conversation, to prepare for it. The lawful basis is our legitimate interest in answering an enquiry you chose to make. We keep form submissions for 24 months after our last contact with you, and delete them sooner on request.

Emails we send to associations

We write to people whose roles at associations are listed publicly, for example on an association’s own website, a regulator’s register, or a professional profile. We hold their name, role, organisation and work email address. The lawful basis is legitimate interest: we have a product built for staffed associations, and the people we write to are the ones whose job it is to evaluate such things. Our emails go to work addresses at organisations, and every one carries a working unsubscribe link.

Our emails contain a tracking pixel and tracked links, served from link.brighthuddle.com. When one is loaded or clicked we record the time, the browser’s user agent string and the country Cloudflare attributes to the connection, against the message that was sent. We do this to know whether anyone is reading, and we discount events that look like automated scanners. We do not sell, rent or share these lists.

If you unsubscribe, we record that and do not write again. Unsubscribe requests take effect immediately at send time, which is sooner than the law requires. If you would also like the record of you removed entirely, email us and we will do it.

The Bright Huddle product

Associations that use Bright Huddle load their member records into it, and may connect it read-only to systems they already run, such as a learning platform, accounting package, email marketing tool or website. In that relationship the association is the controller of its members’ data and we are the processor. We act only on the association’s instructions, under a written data processing agreement that meets Article 28 of the UK GDPR.

Production data is hosted on Railway in its Amsterdam region, inside the EU, and does not leave the UK or EU. Access is restricted to named staff with multi-factor authentication, over encrypted connections, and no customer data is held on personal devices.

When an agreement ends we return the association’s data as a CSV or JSON export on request and delete our copy within 30 days, with written confirmation. Members of an association who want to exercise their rights over data held in Bright Huddle should contact the association, which is the controller. If they contact us instead we pass the request on and help the association answer it.

Who else handles the data

We use a small number of sub-processors. Each is bound by a written agreement and each is listed here. If we add one we update this page first and notify customers under their data processing agreement.

• Cloudflare, Inc. (United States). Serves this website and runs the form handler, the D1 database behind it and the email tracking service.
• Railway Corp. (United States). Hosts the Bright Huddle product and its database in its Amsterdam, Netherlands region.
• GitHub, Inc. (United States). Holds our source code. No customer data is stored in source control.
• Resend, Inc. (United States). Sends the notification email when someone submits the form on this site.

International transfers

Customer and member data in the product stays in the EU. Some of the providers above are US companies, and for the limited data that reaches US infrastructure, such as a form notification email, we rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep things

• Form submissions: 24 months after our last contact, or on request.
• Outreach records: until you unsubscribe or ask to be removed. Suppression records, which exist so we do not write to you again, are kept indefinitely because deleting them would defeat their purpose.
• Product data: for the life of the agreement and 30 days after, then deleted.
• Backups: encrypted, and rotated on a fixed schedule so that deleted data ages out of them.

Your rights

Under the UK GDPR you can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to our processing it, or ask us to restrict what we do with it. Email ${company.privacyEmail}. We answer within one month. There is no charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather hear from you first, so we can fix it.

Changes to this policy

We date every version. This one is dated 9 October 2026. If a change affects how customers’ data is handled we tell them directly, under the data processing agreement, before it takes effect.