Effective date: 24 October 2026
1. Who is responsible for your data
MASCOT LABS, represented by Developer. Mohamed Ali, is responsible for the personal information we process through our website, enquiries and direct customer support. The legal controller and contact details appear in Section 10.
A separate marketplace, merchant of record or payment provider may act as an independent controller of transaction and payment information under its own privacy notice. Its identity is displayed when a payment service is enabled and at checkout.
2. Personal information we may collect
Website enquiries: the email address, enquiry subject and message you submit; any additional information you voluntarily include; and our correspondence with you.
Orders and support where sales are enabled: contact and billing details, order references, purchased items or service arrangements, payment status, receipts, support history and download or account-entitlement information provided to us by the relevant seller or provider. We do not request full payment-card details through our website contact form.
Accounts, hosted services and courses where offered: credentials or account identifiers, subscription and usage records reasonably necessary to provide the relevant service and information supplied to us by the account holder. Product-specific notices may give further detail when such services launch.
Technical data: hosting and security providers may record IP addresses, browser details, request metadata and diagnostic or anti-abuse information for operating and protecting the site.
We do not intentionally deploy advertising pixels or non-essential analytics trackers in the current static website files. This may change only after the required privacy and consent arrangements have been implemented.
3. Why we process your data and legal bases
Enquiries and general support: responding to messages and maintaining secure, effective customer communications, under our legitimate interests in operating the business; where your request is a step towards a contract, processing may be necessary to take steps at your request before entering into that contract.
Orders, products, courses, accounts and agreed services: performing a contract or taking pre-contract steps, including delivering digital goods and managing customer requests.
Accounting, tax and legal compliance: complying with legal obligations, including applicable business record retention and responding to lawful requests.
Fraud prevention and security: legitimate interests in preventing misuse, securing the website and protecting transactions, balanced against your rights.
Marketing communications: consent or another lawful basis available under data-protection and electronic-marketing law, with appropriate choice and opt-out mechanisms. The current website does not contain a newsletter signup.
4. Who processes or receives information
We currently use Cloudflare Pages for website hosting and security, FormSubmit to forward website-form enquiries, and Google Gmail for business email and correspondence. These providers process data according to their roles and services. We may also share information with an expressly identified checkout or licensing service when it is activated, professional advisers, and public authorities where legally required.
We do not sell customer enquiry information or use it for third-party advertising. We do not disclose personal data beyond what is reasonably necessary for these purposes.
5. International processing
Cloudflare, Google, FormSubmit or later-selected technology providers may process information in countries outside the UK. Where UK data-protection law requires safeguards, the relevant provider or transfer arrangement must use an applicable adequacy decision or other recognised safeguard, such as UK international data transfer contractual terms. You may request further information from our privacy contact. We review the relevant service arrangements when appointing a provider.
6. How long we keep information
Enquiry and routine support messages: ordinarily up to 24 months after the last meaningful interaction, unless an ongoing dispute, legal duty or legitimate need requires longer.
Invoices, payments and tax records: for at least the period required for the relevant UK business-tax records, generally five years after the 31 January Self Assessment filing deadline for the tax year concerned, and longer where an investigation or other obligation requires.
Product access and licensing records: for the duration necessary to provide and evidence the licence or subscription, resolve support and contractual issues, and meet applicable legal obligations. Access records may be deleted or anonymised when no longer required.
Security logs: for the retention periods used by the hosting and security providers, based on the technical and security purpose of those logs.
Records are deleted, anonymised or securely archived at the end of the applicable period, subject to legal obligations and technical backups.
7. Your data-protection rights
Depending on the circumstances and legal exceptions, you may request access to your data, correction, erasure, restriction, portability or objection to processing. Where we rely on consent, you may withdraw it without affecting earlier lawful processing. To exercise your rights, use the contact details in Section 10. We may need reasonable information to verify your identity before responding. You may also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
8. Cookies and similar technologies
The current published website source does not include first-party analytics or advertising scripts. The hosting and security services may use strictly necessary technologies to operate and protect the site. Before adding non-essential cookies, analytics or advertising technologies, we will explain their purposes and obtain consent where the law requires. Browser settings may also allow you to control certain technologies.
9. Data security and external links
We use reasonable access controls and security measures appropriate to the information and services concerned. Internet transmission is never guaranteed to be risk-free. Avoid including passwords, bank details, identity documents or confidential customer records in an ordinary enquiry. Third-party websites linked from our pages have their own privacy practices.
10. Changes and contact
We will update this policy if our processing practices, services or legal obligations materially change. The effective date at the top identifies this version. Use the details below for privacy questions or rights requests. You can also read our Terms and Conditions and Refund Policy.