StakeBrick homePrivacy notice.
This notice describes the current public website and invited preview, including the client and management workspaces. Use fictional portfolio data and test documents only.
Notice version 2026-10-24.1. Website and client management are online. Investment examples are simulated. No live investments or bank payments.
BRICK MATTERS LIMITED
Registered in England and Wales. Company number 10142128.
Registered office: 68c High Street Bassingbourn, Royston, Herts, United Kingdom, SG8 5LF
Company registration is not financial-services authorisation. No FCA authorisation or FSCS protection is claimed.
1. Who is responsible
The operator identified in the business disclosure panel below is responsible for personal information processed by this preview. Its registered office is a postal contact for privacy requests. Public email contacts appear once the owner confirms monitored mailboxes. If those contacts are incomplete, public investment onboarding and the public enquiry form remain unavailable. Invited reviewers can also contact the administrator who provided access or use private Help & support.
2. Information processed
The site processes account email, name, role and profile details entered by authorised users; salted password hashes; session records; simulated portfolio and ledger activity; client relationship notes, tasks and support messages; and uploaded test files. Public enquiries, when enabled, contain the email, optional name, category and message you provide, a reference, notice version and timestamps. Do not include identity numbers, bank details or sensitive documents in an enquiry.
3. Technical information
The hosting service receives your IP address, browser request information, page address and time of access to serve the website and keep security logs. Login throttling uses a hashed IP or email identifier in time-limited attempt records. Avoid placing private information in page URLs, since request URLs can appear in server logs.
4. Why information is used
Account data and records operate the invited preview and its support functions. Session data authenticates users; technical records protect service integrity and investigate misuse. Enquiries are used to respond to the request, handle complaints or exercise privacy rights. Data is not used by this website for automated advertising profiles, public customer rankings or real investment eligibility decisions.
5. Legal basis
The preview uses legitimate interests in providing and securing invited product access, maintaining operational records and answering requested enquiries. Its interests are limited by your rights and reasonable expectations; do not submit real investment or identity information. Handling a statutory privacy request may also be necessary to comply with a legal obligation. Optional browser preference storage relies on your choice and may be withdrawn through Privacy choices. No consent to marketing is inferred from a support request or from using the site. A live service would need its own documented assessment of purposes and legal bases before customer onboarding.
6. Who can access records
Clients can access their own workspace. Sales managers can access assigned client records under their role. Administrators can review business operations and records needed for support and security. Hosting and backup infrastructure process data to deliver the site. Public pages never intentionally expose account files or private client records. No Meta Pixel, Google Ads tag, Google Analytics, advertising audience upload or conversion API is installed in this release.
7. Sale, sharing and advertising
This release does not sell personal information or share it for cross-context behavioural advertising, and it does not send account balances, identity files, support content or contact submissions to advertising platforms. No targeted-advertising cookies are enabled, including when a privacy preference is saved. Global Privacy Control does not enable tracking. A configured internal lead notification to Telegram is separate from advertising measurement. Any future advertising integration needs a new assessment, vendor disclosures and applicable consent before activation.
8. Location and international access
Data is processed on the service's server and backups. Daily recovery copies of the database and referenced private test files are encrypted before upload to a private Backblaze B2 bucket. Backblaze is an additional infrastructure provider for this purpose. The owner must confirm hosting and backup locations, processor arrangements and any necessary international transfer safeguards; an IP address alone is not reliable evidence of a legal processing location. Authorised staff may access the preview remotely. Do not submit real identity or financial documents to the preview.
9. Retention
Management sessions last at most four hours and expire after 15 minutes without qualifying activity; client sessions last at most eight hours and expire after 30 minutes without qualifying activity. Signing out revokes the active session. Login-attempt buckets expire after 15 minutes and expired rows are cleaned during subsequent activity. New encrypted local backups have a 30-day cleanup policy after successful backup runs. Older local database backups are retained for recovery review. Backblaze copies do not yet have an automatic deletion period; the operator must set and document their retention. Account, audit, support and test-file records also require an approved deletion schedule. Public enquiries, if enabled, are removed from the active database by the daily retention job after 90 days; they can remain in retained backups until those copies are removed. Restored records must be reviewed for earlier deletion requests. These are preview settings, not statutory investment-record retention periods.
10. Your choices and rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing, withdraw optional consent, or complain to your local data-protection authority. Use the privacy-rights page for the current channels. Reasonable verification may be needed to protect another person's data. Do not send an ID document through the public form. There is no charge for making an ordinary request; applicable exceptions and response deadlines depend on the governing law.
11. Security and limits
HTTPS protects transport, session cookies are HttpOnly and secure on HTTPS, and private workspace actions use role controls. Recovery copies uploaded to Backblaze are encrypted before transfer, and each backup run includes an isolated recovery check. Encryption keys need protected recovery arrangements separate from the server. These measures reduce risk but cannot guarantee security. Email replies and shared demo credentials are not suitable channels for sensitive documents. The owner must establish incident handling, processor contracts and live customer safeguards before public financial operations.
12. Advertising enquiries and internal lead notifications
If you submit an enquiry through a connected advertising lead form, the configured Google Sheets source may supply your name, email, phone and WhatsApp numbers, questionnaire answers, submission time and ad, campaign and form identifiers. These original fields are stored in the private CRM to handle the enquiry and maintain its source record. The configured Telegram bot can send an internal notification containing those submitted fields to the operator's designated management chat; it does not message the lead. Google Sheets and Telegram are therefore additional services used in this flow, and processing may involve countries outside the UK. No identity files, banking records, account passwords or investment balances are included in the notification. Contact details or an imported source status do not by themselves establish permission for additional marketing. The operator must confirm the original form notice, lawful basis, contact permissions and any required processor or transfer arrangements. Ask the operator through the published contact channels about this processing.
13. Lead record retention
Advertising lead records retain the original source fields separately from sales notes, pipeline stages and assignments. The sync does not delete CRM records when a sheet row disappears, and there is not yet an automatic marketing-lead deletion schedule. Administrators must review retention against the purpose and applicable law and handle rights requests through the published contact channels. Lead delivery references and statuses are kept to prevent repeated imports and help investigate notifications. This is separate from the 90-day retention for public website enquiries.
14. Website preview registrations
The standalone /start page can accept a name, email and phone number, with an optional destination preference when the operator has confirmed monitored public contact channels. Registration asks for an adult confirmation, acknowledgement of this notice and a requested reply about the preview. It records a private CRM enquiry, not an investment account or a general marketing subscription. The submitted fields, request time, notice version, contact request and any supplied campaign UTM labels are retained with the original CRM record. An internal Telegram notification can include your name, email, phone and destination; it does not message you or send your details to Meta. No advertising pixel, conversion API or persistent advertising identifier is used on this page. Short-lived, daily-scoped hashes of an IP address and email help limit abusive requests; the raw address is not stored in the enquiry record. CRM and backup retention limits described above also apply. Use the published support/privacy channels or registered-office postal address for a rights request or to withdraw your request for a reply.
15. Publisher enquiries
An authorised news publisher can send your name, email, international phone number, campaign label and evidence of your request for contact from StakeBrick through our authenticated publisher API. We store the publisher identity, original lead reference, contact permission time and the privacy notice URL the publisher supplied. This is used to handle your enquiry in our private CRM. An internal notification containing your name, email, phone and publisher/campaign can be sent to the designated Telegram management group. It does not message you or create an investment account. A publisher must explain this transfer when collecting your details; an API submission is not permission for unrelated marketing. The CRM lead retention, processor and rights-request information above applies to this source too. Website enquiry forms also collect a phone number so the team can reply. Do not submit identity documents or banking information in these contact fields.
16. Children and changes
The invited preview is for adults aged 18 and over. It is not directed at children. Contact the operator if a child has submitted information. The date and version on this page identify this notice. Material changes to purposes or advertising tools require updated disclosures and new consent where required.
Contact options