Privacy policy

This policy explains how we handle your personal data when you visit our website, sign up to our newsletter, contact us, or buy from our store. We process personal data in line with the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

Airlift is a trading name operated by Bonsai Brands Ltd, which is the data controller responsible for your personal data.

• Registered address: 124 City Road, London, EC1V 2NX
• Contact for privacy matters: support@airliftbreathing.co.uk

2. The personal data we collect

• Newsletter sign-up: your email address, where you have given consent to receive marketing emails.
• Breathing quiz: your answers to the five questions, your email address, and your mobile number if you choose to give one. The mobile number is optional and the quiz completes the same way without it.
• Text messages after signing up: once you have joined our email list, through the welcome pop-up or the newsletter form, we offer text messages too. If you give us your mobile number and press Text me, we keep that number with your email address. It is optional, and choosing No thanks changes nothing about your email sign-up or your free prep pads.
• Warranty registration: when you register your clip, your email address, your first name if you give it, where you bought it, and your mobile number.
• Orders and account data: when you buy from us, your purchase is processed through our Shopify store. This may include your name, billing and delivery address, email address, phone number and order history. Payment card details are handled by the payment provider, not by us.
• Enquiries: if you contact us through the contact form or by email, we receive the details you provide, such as your name, email address and the content of your message.
• Content you send us: if you send us a photograph, a video or a link to a social media post, we receive the file or the link, the email address you use to send it, and your social media handle if you choose to give one. Sending us content is voluntary. See the section on content you send us below.
• Cookies and analytics data: information about how you use the site, collected through cookies and similar technologies. See the cookies section below.

3. How we use your data and our lawful bases

Under UK GDPR we must have a lawful basis for processing your personal data. We rely on the following:

• Consent: for sending marketing emails to people who sign up to the newsletter or complete the breathing quiz, for sending marketing text messages to people who give us a mobile number on the quiz, press Text me after signing up, or tick the box at checkout, and for setting non-essential cookies. You can withdraw consent at any time.
• Consent, for content you send us: for using a photograph, a video or a social media post you send us in our marketing, given by ticking the permission box on the form. This is a separate permission from the two above and from the soft opt-in below, and you can withdraw it at any time.
• Soft opt-in (PECR regulation 22): for sending marketing emails and text messages to customers who have bought from us, where we obtained the contact details during that sale, the marketing is about similar products, and you were given the chance to decline both when we asked and in every message since. This is the basis for messages to people who register a clip.
• Contract: to process and deliver your orders, handle returns, and provide customer support relating to a purchase.
• Legitimate interests: to operate, secure and improve our website, respond to enquiries, and prevent fraud, where these interests are not overridden by your rights.
• Legal obligation: to keep records we are required to keep, such as for tax and accounting.

4. Cookies and analytics

We use cookies and similar technologies to make the site work and to understand how it is used. Cookies that are strictly necessary for the site to function do not require your consent. Non-essential cookies, including analytics and any marketing cookies, are only set where you have given consent, which you can change or withdraw at any time through our cookie settings.

Storage in your browser. As well as cookies, the site saves a small amount of information in your browser's own storage (local storage and session storage). This is used to remember your cookie choices, whether you have already seen or closed our sign-up offer and other notices, your quiz answers and result so a quiz in progress is not lost, and whether you have earned the free prep pads. It never contains your email address, your phone number or payment details, it stays on your device and is not sent to us, and you can clear it at any time through your browser settings. Session storage clears itself when you close the tab.

Our analytics provider is Google Analytics 4, supplied by Google. It sets cookies that measure how visitors use the site so we can improve it, such as which pages are viewed and how people move through the site. These analytics cookies are only loaded after you accept analytics cookies, and you can withdraw that consent at any time through our cookie settings. Google processes this data on our behalf and may process it outside the UK (see International transfers below).

Where you have also accepted marketing cookies, we use Google Analytics Advertising Features, including Google Signals. This lets Google combine our analytics data with information from your Google Account (if you are signed in and have ads personalisation turned on) to give us aggregated demographic and interest reports, cross-device reporting, and audiences for remarketing on Google's advertising services. We never see data that identifies you personally in these reports. You can opt out through our cookie settings, by turning off ads personalisation in your Google Account, or by installing Google's Analytics opt-out browser add-on.

Where you have accepted marketing cookies, we also load a script from Klaviyo, our email and text message platform. It sets cookies that recognise your browser when you come back, and it records which pages and products you view on this website. Once you have given us your email address, for example by joining our list, taking the quiz or registering a clip, that activity is linked to your Klaviyo profile. We use it to make our emails more relevant to you, for instance by following up on a system you looked at. The script is never loaded unless you accept marketing cookies, and you can withdraw that consent at any time through our cookie settings.

Meta. Where you have accepted marketing cookies, we also load the Meta Pixel, a script from Meta Platforms Ireland Limited, which runs Facebook and Instagram. It sets cookies that recognise your browser and tells Meta which pages you visit on this website, which of our systems you choose to look at in the shop, when you join our email list or finish the quiz, and when you leave the shop for our checkout. The last three are also sent to Meta directly from our own server (the Conversions API), together with your IP address, your browser type and the identifiers in Meta's cookies, so that they are still counted if a browser extension blocks the script. That copy is only sent while you have accepted marketing cookies, and it names only the page, never anything added to the end of its web address. It does not send Meta your email address, your quiz answers or your result, and it is not used on the page where you register a clip. We use it to measure whether our adverts on Facebook and Instagram lead to visits and sign-ups, and to show those adverts to people who are more likely to be interested in them.

Our checkout, which Shopify hosts, also shares information with Meta where you have accepted marketing cookies, both from your browser and directly from Shopify's servers (Meta calls this the Conversions API). It tells Meta when you start a checkout, add payment details or place an order, with the items and the order value. So that Meta can match an order to an advert you saw, it also sends your name, email address, phone number and delivery address, converted into a one-way code (hashed) before they leave Shopify. Meta uses this information to measure and deliver our adverts, and also under its own privacy policy. You can withdraw consent at any time through our cookie settings, and you can manage how Meta uses activity from other websites in your Facebook or Instagram settings.

5. Who we share your data with

We share personal data with service providers who help us run our business. They only process your data on our instructions. These include:

• Shopify, our e-commerce platform, which hosts the store and processes orders and account data.
• Payment processors, to take payment securely.
• Recharge, our subscription billing platform, which works inside our Shopify store to manage subscription plans. It processes your name, email address, delivery address, the plan you chose and its renewal dates, and the payment method stored for your renewals (card details are held by the payment provider, not by Recharge or by us).
• Vercel, which hosts this website. Like any web host, it processes technical information about each visit, such as your IP address, browser type and the pages requested, in order to serve the site and keep it secure. It also runs the service that passes the details you enter when you register a clip or finish the quiz on to Klaviyo.
• Upstash, which stores the IP address of anyone who submits the registration or quiz form, for 15 minutes, on servers in London. We use it only to limit repeated submissions from the same connection and so prevent abuse. The record deletes itself when the 15 minutes are up.
• Shipping carriers, to deliver your order.
• Klaviyo, our email and text message marketing platform, which stores your email address, mobile number and marketing preferences when you sign up to our list and, where you have accepted marketing cookies, the pages and products you view on this website.
• Web3Forms, which delivers messages sent through our contact form to our support inbox.
• Tally, which hosts the form used to send us photographs, videos and links to social media posts, and stores those submissions on servers in the European Union.
• Advertising platforms, including Meta and Google, where content you have given us permission to use is included in a paid advertisement.
• Google, which provides Google Analytics 4 to measure how the site is used, where you have consented to analytics cookies, and Google Analytics Advertising Features where you have also consented to marketing cookies.
• Meta (Meta Platforms Ireland Limited), which runs Facebook and Instagram, where you have consented to marketing cookies. It receives the visit, sign-up and order information described in section 4, to measure and deliver our adverts.

We may also disclose personal data where required by law.

The above excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties.

6. Mobile messaging

We collect a mobile number for marketing in four places, and never without one of them: when you register your clip at /register, where your mobile number is required and registering subscribes it to our text messages; at the end of the breathing quiz at /quiz, where the number is an optional extra alongside your email address and leaving it blank costs you nothing; straight after you join our email list through the welcome pop-up or the newsletter form, where we ask if you would like texts too and only add your number if you type it and press Text me; and at checkout, where you can tick a box to ask for text messages. The checkout box is never ticked for you. You can stop text messages at any time, as described below, and stopping them never affects your warranty.

We use the number to send you text messages about Airlift: fitting help, reminders before your prep pads run out, delivery updates, cart reminders, product news and offers.

Cart reminders. Our checkout is hosted by Shopify, not on this website, and Shopify's checkout uses cookies to keep track of the items in your basket. If you start a checkout and do not finish it, Shopify records that and passes it to Klaviyo, and that is how we determine a basket has been abandoned. We use it to send you a reminder by email, or by text message if you have given us your number. We do not run any basket tracking on airliftbreathing.co.uk itself.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties. We use Klaviyo and its network carriers to deliver the messages, and they may only act on our instructions.

You can stop text messages at any time by replying STOP or using the unsubscribe link that every message carries, or by emailing support@airliftbreathing.co.uk. Our mobile messaging terms set out what we send, how often and what it costs.

7. Content you send us

We invite customers to send us a photograph, a video, or a link to a social media post, using a form we link to from our emails and from the page you see after registering your clip. Sending us something is entirely voluntary, and nothing about your order, your delivery or your warranty depends on it.

• What we collect: the photograph or video you upload, or the link to your post; the email address you give, which is how we match your submission to your order and reply to you; and your social media handle if you choose to give one. The handle is optional.
• Why we use it: to review what you have sent, to send you the item we offered in return, and, where you have given permission, to use the content in our marketing. That includes this website, our own social media channels, and paid advertising.
• Our lawful basis is your consent, given by ticking the permission box on the form. It is a separate permission from the email and text messaging bases in section 3, and you do not have to give it.
• Who receives it: Tally, which hosts the form and stores submissions on servers in the European Union. If we publish the content, it is also processed by the platform we publish it on, and by the advertising platforms named in section 5 where it appears in a paid advertisement.
• How long we keep it: we delete a submission once we have sent the item we offered, unless we are using the content, in which case we keep it alongside the record of your permission for as long as we use it.

You can withdraw your permission at any time by emailing support@airliftbreathing.co.uk. We will stop using the content and remove it from the places we control. Please be aware that we cannot always recall an advertisement that has already been published, or something another person has shared, although we will stop using it from that point on.

Please only send us content that is yours, and only content showing people who have agreed to it. Please do not send us content showing children.

8. International transfers

Some of our service providers may process personal data outside the UK. Where this happens, we take steps to ensure your data is protected by an appropriate safeguard recognised under UK data protection law, such as an adequacy decision or standard contractual clauses.

9. How long we keep your data

We keep personal data only for as long as we need it for the purposes set out in this policy, or for as long as we are required to keep it by law. Order and transaction records are kept for the period required for tax and accounting. Newsletter data is kept until you unsubscribe. Enquiry data is kept for as long as needed to deal with your enquiry and a reasonable period afterwards. Content you send us is kept as described in section 7.

10. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data erased in certain circumstances;
• object to processing, including direct marketing;
• request that your data be transferred to you or another provider (portability);
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, contact us at support@airliftbreathing.co.uk.

11. Complaints

If you have a concern about how we handle your personal data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

12. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of this page. Please check back occasionally to stay informed.