The 90-Night Airlift Test. Not for you? One email, fullFull refund, keep the clip. How it works

Privacy policy

How we collect, use and protect your personal data, and the rights you have under UK data protection law.

Last updated: 10 September 2026 · Back to home

This policy explains how we handle your personal data when you visit our website, sign up to our newsletter, contact us, or buy from our store. We process personal data in line with the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

Airlift is a trading name operated by Bonsai Brands Ltd, which is the data controller responsible for your personal data.

2. The personal data we collect

  • Newsletter sign-up: your email address, where you have given consent to receive marketing emails.
  • Warranty registration: when you register your clip, your email address, your first name if you give it, where you bought it, and your mobile number if you choose to give one. The mobile number is optional.
  • Orders and account data: when you buy from us, your purchase is processed through our Shopify store. This may include your name, billing and delivery address, email address, phone number and order history. Payment card details are handled by the payment provider, not by us.
  • Enquiries: if you contact us through the contact form or by email, we receive the details you provide, such as your name, email address and the content of your message.
  • Cookies and analytics data: information about how you use the site, collected through cookies and similar technologies. See the cookies section below.

3. How we use your data and our lawful bases

Under UK GDPR we must have a lawful basis for processing your personal data. We rely on the following:

  • Consent: for sending marketing emails to people who sign up to the newsletter, and for setting non-essential cookies. You can withdraw consent at any time.
  • Soft opt-in (PECR regulation 22): for sending marketing emails and text messages to customers who have bought from us, where we obtained the contact details during that sale, the marketing is about similar products, and you were given the chance to decline both when we asked and in every message since. This is the basis for messages to people who register a clip.
  • Contract: to process and deliver your orders, handle returns, and provide customer support relating to a purchase.
  • Legitimate interests: to operate, secure and improve our website, respond to enquiries, and prevent fraud, where these interests are not overridden by your rights.
  • Legal obligation: to keep records we are required to keep, such as for tax and accounting.

4. Cookies and analytics

We use cookies and similar technologies to make the site work and to understand how it is used. Cookies that are strictly necessary for the site to function do not require your consent. Non-essential cookies, including analytics and any marketing cookies, are only set where you have given consent, which you can change or withdraw at any time through our cookie settings.

Our analytics provider is Google Analytics 4, supplied by Google. It sets cookies that measure how visitors use the site so we can improve it, such as which pages are viewed and how people move through the site. These analytics cookies are only loaded after you accept analytics cookies, and you can withdraw that consent at any time through our cookie settings. Google processes this data on our behalf and may process it outside the UK (see International transfers below).

Where you have also accepted marketing cookies, we use Google Analytics Advertising Features, including Google Signals. This lets Google combine our analytics data with information from your Google Account (if you are signed in and have ads personalisation turned on) to give us aggregated demographic and interest reports, cross-device reporting, and audiences for remarketing on Google's advertising services. We never see data that identifies you personally in these reports. You can opt out through our cookie settings, by turning off ads personalisation in your Google Account, or by installing Google's Analytics opt-out browser add-on.

5. Who we share your data with

We share personal data with service providers who help us run our business. They only process your data on our instructions. These include:

  • Shopify, our e-commerce platform, which hosts the store and processes orders and account data.
  • Payment processors, to take payment securely.
  • Shipping carriers, to deliver your order.
  • Klaviyo, our email and text message marketing platform, which stores your email address, mobile number and marketing preferences when you sign up to our list.
  • Web3Forms, which delivers messages sent through our contact form to our support inbox.
  • Google, which provides Google Analytics 4 to measure how the site is used, where you have consented to analytics cookies, and Google Analytics Advertising Features where you have also consented to marketing cookies.

We may also disclose personal data where required by law.

The above excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties.

6. Mobile messaging

We collect a mobile number for marketing in two places, and never without one of them: when you register your clip at /register, where giving us the number is itself the choice and leaving the field blank is how you decline; and at checkout, where you can tick a box to ask for text messages. The checkout box is never ticked for you.

We use the number to send you text messages about Airlift: fitting help, reminders before your prep pads run out, delivery updates, cart reminders, product news and offers.

Cart reminders. Our checkout is hosted by Shopify, not on this website, and Shopify's checkout uses cookies to keep track of the items in your basket. If you start a checkout and do not finish it, Shopify records that and passes it to Klaviyo, and that is how we determine a basket has been abandoned. We use it to send you a reminder by email, or by text message if you have given us your number. We do not run any basket tracking on airliftbreathing.co.uk itself.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties. We use Klaviyo and its network carriers to deliver the messages, and they may only act on our instructions.

You can stop text messages at any time by replying STOP or using the unsubscribe link that every message carries, or by emailing support@airliftbreathing.co.uk. Our mobile messaging terms set out what we send, how often and what it costs.

7. International transfers

Some of our service providers may process personal data outside the UK. Where this happens, we take steps to ensure your data is protected by an appropriate safeguard recognised under UK data protection law, such as an adequacy decision or standard contractual clauses.

8. How long we keep your data

We keep personal data only for as long as we need it for the purposes set out in this policy, or for as long as we are required to keep it by law. Order and transaction records are kept for the period required for tax and accounting. Newsletter data is kept until you unsubscribe. Enquiry data is kept for as long as needed to deal with your enquiry and a reasonable period afterwards.

9. Your rights

Under UK GDPR you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected (rectification);
  • have your data erased in certain circumstances;
  • object to processing, including direct marketing;
  • request that your data be transferred to you or another provider (portability);
  • withdraw consent at any time, where we rely on consent.

To exercise any of these rights, contact us at support@airliftbreathing.co.uk.

10. Complaints

If you have a concern about how we handle your personal data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

11. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of this page. Please check back occasionally to stay informed.