Legal

Privacy Policy

Last updated: July 2026

1. Who We Are

TonOfBricks is a LEGO set rental subscription service operated by Stuart Bye, based in Basingstoke, Hampshire, United Kingdom. We can be contacted at info@tonofbricks.co.uk.

For the purposes of UK GDPR and the Data Protection Act 2018, we are the data controller for the personal information we collect about you.

2. What Information We Collect

We collect the following personal information:

  • Account information: your name, email address, phone number and home address when you create an account
  • Payment information: we use Stripe to process payments. We store your Stripe customer ID but never store your full card details — these are held securely by Stripe
  • Rental history: records of sets you have rented, returned, and any notes related to your rentals
  • Delivery information: your chosen InPost locker or shop address, or your home address if you use our local delivery service
  • Communications: emails we send you about your account, rentals and subscription
  • Analytics data: anonymised usage data collected via Google Analytics and PostHog to help us understand how people use our site
  • Registration interest: if you registered interest before we launched, we stored your email address and postcode

3. How We Use Your Information

We use your personal information to:

  • Create and manage your TonOfBricks account
  • Process your subscription payments via Stripe
  • Arrange delivery and collection of LEGO sets
  • Send you transactional emails about your rentals and subscription (via Resend)
  • Contact you about missing pieces, charges or account queries
  • Improve our website and service using anonymised analytics
  • Comply with our legal obligations

Our legal basis for processing your data is:

  • Contract: processing necessary to fulfil your subscription and rental agreement
  • Legitimate interests: analytics and service improvement
  • Legal obligation: where required by law

4. Who We Share Your Information With

We share your data only with trusted third-party service providers who help us operate our service:

  • Supabase (database and authentication) — hosted in the EU (Stockholm, Sweden)
  • Stripe (payment processing) — PCI DSS Level 1 certified, processes payments securely
  • Resend (transactional email) — used to send account and rental emails
  • InPost (delivery) — your name and delivery address are shared when arranging delivery
  • Google Analytics (website analytics) — anonymised usage data
  • PostHog (product analytics) — hosted in the EU, anonymised usage data

We do not sell your personal data to any third party.

5. How Long We Keep Your Data

  • Active account data: kept for as long as your account is active
  • Rental history: kept for 7 years after your last rental for legal and accounting purposes
  • Payment records: kept for 7 years in line with HMRC requirements
  • Interest registrations: kept for 12 months from the date of registration, then deleted
  • Analytics data: Google Analytics data is retained for 14 months; PostHog data for 12 months

6. Your Rights

Under UK GDPR you have the following rights:

  • Right of access: you can request a copy of the personal data we hold about you
  • Right to rectification: you can ask us to correct inaccurate data
  • Right to erasure: you can ask us to delete your personal data (subject to legal obligations)
  • Right to restrict processing: you can ask us to limit how we use your data
  • Right to data portability: you can ask for your data in a portable format
  • Right to object: you can object to processing based on legitimate interests

To exercise any of these rights, please contact us at info@tonofbricks.co.uk. We will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

7. Cookies

Our website uses cookies to improve your experience and help us understand how people use our site. We use:

  • Essential cookies: required for the site to function (authentication, session management)
  • Analytics cookies: Google Analytics uses cookies to collect anonymised usage data. You can opt out using Google's opt-out browser add-on

We will ask for your consent before placing non-essential cookies on your device.

8. Data Security

We take the security of your data seriously. We use:

  • Encrypted connections (HTTPS) across our entire website
  • Supabase Row Level Security to protect your data at the database level
  • Secure authentication via Supabase Auth
  • We never store payment card details — all payments are handled by Stripe

9. Children's Privacy

Our service is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have collected data from a minor, please contact us at info@tonofbricks.co.uk and we will delete it promptly.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or by posting a notice on our website. The date at the top of this page shows when the policy was last updated.

11. Contact Us

If you have any questions about this privacy policy or how we handle your data, please contact us at: info@tonofbricks.co.uk