Privacy Policy

1. Introduction

This Privacy Policy explains how Excite Foundry Ltd ("we", "us", "our") collects, uses, stores, and protects your personal data when you use the Supercharge Me platform ("the Platform") and visit our website at superchargeme.com ("the Site").

We are committed to protecting your privacy and handling your data in an open and transparent manner. This policy complies with the UK General Data Protection Regulation (UK GDPR) as retained under the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

By using our Site or Platform, you acknowledge that you have read and understood this Privacy Policy.

2. Who We Are

Supercharge Me is operated by Excite Foundry Ltd, a company registered in England and Wales.

For the purposes of the UK GDPR, Excite Foundry Ltd is the data controller for personal data collected through the Site and Platform, except where we process data on your behalf as a data processor (see Section 5).

3. What Data We Collect

We collect and process the following categories of personal data:

3.1 Information you provide directly

• Email address — when you submit a request access form on our Site
• Name and business details — when you communicate with us via email
• Account credentials — when you create an account on the Platform

3.2 Information collected automatically

• Usage data — pages visited, features used, actions taken within the Platform at app.superchargeme.com
• Device and browser information — browser type, operating system, screen resolution
• IP address — used for security, fraud prevention, and approximate geographic location
• Cookies and similar technologies — see Section 6 for details

3.3 Data from connected platforms

When you connect third-party platforms to Supercharge Me (such as Shopify, Amazon, Google Ads, Meta, Klaviyo, and others), we access and process data from those platforms on your behalf. See Section 5 for how we handle this data.

4. How We Use Your Data

We only process your personal data where we have a lawful basis to do so under Article 6 of the UK GDPR:

We will never sell your personal data to third parties.

5. Data We Process on Your Behalf

When you connect third-party platforms to Supercharge Me, we act as a data processor on your behalf. This means:

• You remain the data controller for all data from your connected platforms (Shopify store data, Amazon product and sales data, Google Ads performance data, Meta advertising data, Klaviyo email marketing data, and similar)
• We process this data solely to provide you with the Platform's services — AI-powered analytics, automated operations, and reporting
• We do not use your platform data for our own purposes, share it with other customers, or sell it to third parties
• We access only the data necessary to deliver the specific features you use
• You may revoke platform connections at any time through your account settings, which will stop further data collection from that platform

6. Cookies

Our Site and Platform use cookies and similar technologies. In accordance with PECR, we provide the following information:

6.1 Strictly necessary cookies

These cookies are essential for the operation of our Platform, such as keeping you logged in and maintaining your session. They cannot be disabled.

6.2 Analytics cookies

We use analytics cookies to understand how visitors use our Site and Platform. This helps us improve our services. Analytics data is aggregated and does not identify you personally.

6.3 Advertising cookies

We do not currently use any advertising or tracking cookies.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Platform.

7. Data Sharing

We share personal data only with the following categories of third parties, and only to the extent necessary to operate our services:

We do not sell, rent, or trade your personal data with any third party for their own marketing purposes.

We may also disclose personal data if required by law, regulation, legal process, or enforceable governmental request.

8. International Transfers

Your data may be processed outside the United Kingdom, including in the United States and the European Economic Area, through our cloud infrastructure providers.

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

• UK adequacy decisions — transfers to countries the UK has deemed to provide adequate data protection (including the EEA)
• International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses — for transfers to the United States and other countries without an adequacy decision
• Supplementary measures — encryption in transit and at rest, access controls, and data processing agreements with all sub-processors

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data — retained for the duration of your account and for up to 12 months after account closure
• Request access submissions — retained for up to 24 months, or until you ask us to delete your data
• Connected platform data — retained for the duration of your active connection. When you disconnect a platform or close your account, we delete the associated data within 30 days
• Usage and analytics data — retained in aggregated, anonymised form for up to 24 months
• Communication records — retained for up to 24 months for customer support and legal purposes

When data is no longer needed, it is securely deleted or anonymised.

10. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access — you can request a copy of the personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate or incomplete data
• Right to erasure — you can ask us to delete your personal data, subject to legal obligations
• Right to restriction — you can ask us to limit how we process your data in certain circumstances
• Right to data portability — you can request your data in a structured, commonly used, machine-readable format
• Right to object — you can object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, as required by law.

11. How to Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

12. Your Right to Complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

We would appreciate the opportunity to address your concern before you approach the ICO. Please contact us first and we will do our best to resolve the matter.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page.

We encourage you to review this page periodically for the latest information on our privacy practices.