Privacy Policy
Last updated: 21 August 2026
This policy explains what personal data we collect when you use breathe-plus.com (the "Site"), why we collect it, who we share it with, and the rights you have. The data controller is Algoclick Ltd, 14 Devonshire Square, London, EC2M 4YT, United Kingdom ("we", "us"). Contact us about privacy at hello@breathe-plus.com.
1. What we collect
- Order details — name, email address, phone number, shipping and billing address, the products you ordered, the amount paid and your Stripe payment reference. Card details are entered on Stripe's secure checkout page and are never stored by us.
- Newsletter signup — your email address and, if you chose one, the product you were interested in.
- Technical data — IP address, approximate country (derived from your IP, used only to show the correct cookie notice), browser type, pages requested and timestamps, kept in server logs for security and troubleshooting.
- Cookie and analytics data — only if you allow it (see section 3): anonymous usage statistics from Google Analytics and advertising measurement data from Google Ads.
- Cart data — your shopping cart is stored in your own browser (local storage), not on our servers, until you check out.
2. Why we use it and our legal basis
- To process, ship and support your order and send order confirmations (performance of a contract).
- To send you the emails you subscribed to (consent; unsubscribe at any time via the link in any email or by contacting us).
- To measure how the Site is used and whether our advertising works (consent where required by law; otherwise our legitimate interest in running and promoting the shop).
- To keep the Site secure, prevent fraud and keep accounting and tax records (legitimate interests and legal obligations).
- To handle product safety reports required by medical-device regulations (legal obligation).
3. Cookies, consent and advertising
We group cookies and similar technologies into three categories. Necessary ones are always on; Analytics and Advertising depend on your choice. You can change your choice at any time via Cookie Settings in the footer of every page.
| Name | Set by | Category | Purpose | Duration |
|---|---|---|---|---|
| bp_consent | breathe-plus.com | Necessary | Remembers your cookie choices | 6 months |
| breatheplus-cart-v1 | breathe-plus.com (local storage) | Necessary | Your shopping cart | Until cleared |
| __stripe_mid, __stripe_sid | Stripe | Necessary | Fraud prevention during checkout | 1 year / 30 min |
| _ga, _ga_* | Google Analytics | Analytics | Distinguishes visitors and sessions for anonymous statistics | Up to 2 years |
| _gcl_au, _gcl_aw | Google Ads | Advertising | Measures whether a Google ad led to a purchase | 90 days |
| IDE, test_cookie | Google (doubleclick.net) | Advertising | Ad personalisation and measurement | Up to 13 months |
How consent works where you live. We detect your approximate country from your IP address to apply the right rules:
- EEA, United Kingdom, Switzerland, Brazil, Canada and South Korea: analytics and advertising cookies are off until you click "Accept all" or choose them in "Manage settings". Rejecting has no effect on your ability to use the Site or buy from us.
- United States: analytics and advertising measurement are on by default. You can opt out of the "sale" or "sharing" of your personal information for targeted advertising (as defined in the California Consumer Privacy Act and similar state laws) at any time using the Do Not Sell or Share My Personal Information link. We also honour the Global Privacy Control browser signal as a valid opt-out.
- Everywhere else: analytics and advertising measurement are on by default with a notice; you can switch them off in Cookie Settings.
Google Consent Mode. We use Google's Consent Mode so that, until you consent, Google tags do not store cookies or identifiers. Google may still receive cookieless, aggregated pings to model conversions. Google's use of data is described at policies.google.com/technologies/partner-sites. You can also opt out of Google Analytics with the browser add-on and manage ad personalisation at adssettings.google.com.
4. Who we share data with
- Stripe Payments Europe Ltd / Stripe, Inc. — payment processing, fraud prevention and collection of your address on its checkout page, under Stripe's privacy policy.
- Google LLC / Google Ireland Ltd — Google Analytics, Google Ads and Google Shopping (only with your consent where required), and Google Fonts, which serves the Site's typeface and may log your IP address.
- Delivery carriers — name, address and phone number so they can deliver your order.
- Amazon Web Services — hosting of the Site and the database that stores orders and subscribers.
- Professional advisers and authorities — where required by law, for accounting, or to report product-safety incidents to regulators such as the MHRA (UK) or HPRA (Ireland).
Apart from the advertising "sharing" described in section 3, we do not sell personal data.
5. International transfers
We are based in the United Kingdom. Our hosting and some providers (Stripe, Google, Amazon Web Services) process data in the United States and elsewhere. For transfers from the UK and EEA we rely on the UK International Data Transfer Agreement / EU Standard Contractual Clauses, the EU–US and UK–US Data Privacy Frameworks where the provider is certified, and the providers' own safeguards.
6. How long we keep data
- Order and payment records: 6 years after the order (tax and consumer-law obligations).
- Newsletter email addresses: until you unsubscribe or ask us to delete them.
- Server logs: up to 90 days. Cookie choices: 6 months. Google Analytics data: 14 months.
7. Your rights
Depending on where you live, you may have the right to: access the personal data we hold about you; have it corrected or deleted; restrict or object to processing; receive a copy in a portable format; withdraw consent at any time; and not be discriminated against for exercising these rights. To make a request email hello@breathe-plus.com. We will verify your identity (normally by replying to the email address on your order) and respond within one month (45 days for US residents).
United Kingdom and EEA (UK GDPR / GDPR). You may complain to the UK Information Commissioner's Office (ico.org.uk) or to the supervisory authority in your EU country.
California and other US states (CCPA/CPRA, Virginia, Colorado, Connecticut, Texas and others). In the last 12 months we collected the categories listed in section 1 (identifiers, commercial information, internet activity, and approximate geolocation). We "share" internet-activity data with Google for cross-context behavioural advertising only with your settings as described in section 3; we do not sell personal information for money and do not knowingly sell or share data of anyone under 16. You may opt out via the "Do Not Sell or Share" link, by the Global Privacy Control signal, or by email. You may designate an authorised agent to act for you. We do not use or disclose sensitive personal information for purposes requiring a right to limit.
Canada (PIPEDA and Quebec Law 25). You may withdraw consent and request access or correction by email. Our Privacy Officer can be reached at the address above. You may complain to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.
Brazil (LGPD). You have the rights listed in Article 18 of the LGPD, including confirmation of processing, anonymisation and information about sharing. Complaints may be made to the ANPD.
Australia. We handle data in line with the Australian Privacy Principles. Complaints may be made to the OAIC.
Israel. Under the Protection of Privacy Law you may request to review and correct information held about you in our database. Requests may be sent by email.
South Korea (PIPA). You may withdraw consent and request access, correction or deletion by email; we will respond within the statutory period.
8. Security
The Site is served over HTTPS. Order data is stored on access-controlled servers with encrypted backups, and payments are handled by Stripe, a PCI-DSS Level 1 certified provider. Only staff who need it to fulfil orders can see your details.
9. Children
The Site is not directed at children and we do not knowingly collect data from anyone under 16. The product is not suitable for children under 5.
10. Changes to this policy
We may update this policy from time to time. The latest version, with its date, is always available at breathe-plus.com/privacy/. If a change is significant we will show a notice on the Site.
11. Contact
Algoclick Ltd, 14 Devonshire Square, London, EC2M 4YT, United Kingdom
Email: hello@breathe-plus.com