Privacy Policy

1. Who we are

The RainMakers operates the platform at app.therainmakers.uk and this website at therainmakers.uk. We are the data controller for the personal data described in this policy.

For anything in this policy, or to exercise any of the rights described in it, write to privacy@therainmakers.uk.

This policy covers data we hold about you — as a visitor to this website or as a customer. It does not cover data you collect about other people using the platform; you are the controller of that, and the Data Processing Agreement governs it.

2. What we collect

When you visit this website, we collect anonymous, aggregated usage statistics through Vercel Analytics — pages viewed, referring site, country, and general device type. This is measured without cookies and without any identifier that would let us recognise you across visits or across other sites. We cannot identify you from it.

When you contact us, we receive whatever you put in your message. The contact form on this site opens your own email application rather than sending through us, so what reaches us is an ordinary email: your name, your email address, your phone number if you supplied one, and what you wrote.

When you create an account, we collect your name, email address and account credentials. Passwords are stored hashed, never in plain text.

When you subscribe to a paid plan, payment is taken by Stripe. Stripe handles your card details directly and we never see or store them. We receive a record that a payment succeeded or failed, the amount, and your billing country for tax purposes.

When you use the platform, we log technical information needed to run it — timestamps, IP address, actions taken, and errors encountered.

3. Why we hold it, and our lawful basis

Data-protection law requires us to have a specific lawful basis for each purpose. Ours are:

• To provide the platform and your account — performance of our contract with you
• To take payment and keep financial records — performance of our contract, and our legal obligation to retain accounting records
• To answer your enquiries — our legitimate interest in responding to people who contact us
• To keep the platform secure, prevent abuse and investigate breaches of the Acceptable Use Policy — our legitimate interest in protecting the service and third parties
• To measure aggregate site usage — our legitimate interest in understanding what is useful, pursued in a way that does not identify anyone
• To send you service messages about your account, billing or security — performance of our contract

We do not sell your personal data, and we do not share it for anyone else's marketing.

4. Marketing

We will only send you marketing email if you have asked for it. Every marketing message carries a one-click unsubscribe, and we act on it immediately.

Service messages are different: while you have an account we will email you about billing, security and material changes to the service, and you cannot opt out of those while remaining a customer.

5. Cookies and tracking

This website sets no advertising or tracking cookies, and no third-party marketing pixels. Our analytics are cookieless. That is why you are not being asked to accept a cookie banner.

The application at app.therainmakers.uk sets a small number of strictly necessary cookies to keep you signed in and to keep your session secure. These are exempt from the consent requirement because the service cannot work without them.

If we ever introduce non-essential cookies or tracking, we will ask for your consent first, and this policy will say so before it happens.

6. Who we share it with

We use a small number of suppliers to run the service, and they process data on our instructions under contract. Our current sub-processors are listed on the Sub-processors page, which names each supplier, what it does and where it processes data.

We will also disclose data where the law requires it — a court order, or a proper request from a regulator or law enforcement. Where we are permitted to tell you about such a request, we will.

If the business is sold or merged, data may transfer to the buyer. You will be told before that happens and it will remain subject to protections no weaker than these.

7. Where your data is held

We host in the United Kingdom and the European Economic Area where we can. Some of our suppliers process data in the United States.

Where data leaves the UK, we rely on either an adequacy decision by the UK government, or the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, together with an assessment of the destination country's protections. The Sub-processors page identifies which applies to each supplier.

8. How long we keep it

• Account data — for as long as your account is open, then 90 days after closure so the account can be restored if you change your mind
• Billing and tax records — six years from the end of the relevant financial year, as UK tax law requires
• Support correspondence — two years from the last message in the thread
• Security and access logs — 12 months
• Aggregate analytics — indefinitely, as it identifies nobody

After these periods we delete or irreversibly anonymise the data.

9. Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you
• have inaccurate data corrected
• have data erased, where we have no continuing basis to keep it
• restrict how we use your data while a dispute about it is resolved
• receive data you gave us in a portable, machine-readable format
• object to processing we carry out on the basis of legitimate interests
• withdraw consent at any time, where consent is the basis we rely on

To exercise any of these, write to privacy@therainmakers.uk. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can try to put it right.

10. Security

We encrypt data in transit and at rest, restrict internal access to those who need it, and keep audit logs of administrative actions.

No system is perfectly secure, and we do not claim otherwise. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and tell you directly where the risk is high.

11. Changes

We will post any change here and update the date at the top. Where a change materially affects your rights we will email you before it takes effect. This policy was last updated on 10 September 2026.