Privacy Policy

This policy explains what personal data we collect when you use breathe-plus.com (the "Site"), why we collect it, who we share it with, and the rights you have. The data controller is Algoclick Ltd, C/O Tax Advisory Partnership, 14 Devonshire Square, London, EC2M 4YT, United Kingdom ("we", "us"). Contact us about privacy at hello@breathe-plus.com.

1. What we collect

• Order details — name, email address, phone number, shipping and billing address, the products you ordered, the amount paid and your Stripe payment reference. Card details are entered on Stripe's secure checkout page and are never stored by us.
• Newsletter and welcome-offer signup — your email address, when and how you signed up (the wording you agreed to), and, if you chose one, the product you were interested in. We send you a link to confirm your address; marketing emails and basket reminders only start once you have confirmed it, and a sign-up that is never confirmed is deleted after 30 days. If you signed up, we also note what was in your basket when you started a checkout, so we can send you one reminder if you don't finish.
• Technical data — IP address, approximate country (derived from your IP, used only to show the correct cookie notice), browser type, pages requested and timestamps, kept in server logs for security and troubleshooting.
• Cookie and analytics data — only if you allow it (see section 3): anonymous usage statistics from Google Analytics and advertising measurement data from Google Ads.
• Cart data — your shopping cart is stored in your own browser (local storage), not on our servers, until you check out.
• Visit records — for each visit: a random visitor reference (not linked to your name), the pages you view, the website and campaign that brought you (including any ad click identifier added by Google, Microsoft or another ad network, and any referral partner's click and placement references), your device type, browser and approximate country. Referral-partner click records and first add-to-basket records also hold a one-way scrambled form of your IP address, used only to spot fraud. If you then add something to your basket for the first time or place an order, we record that against the visit.
• Where your visit came from: what is stored on your device. If you have accepted advertising cookies, or you are outside the UK, EEA and similar opt-in regions, your browser remembers the source of your visit for up to 90 days so a later order can be credited to it. If you have not accepted, nothing about where you came from is stored on your device: we keep it on our server against a short-lived, signed visit reference that is added only to links between our own pages when you use them, and that stops working 3 hours after your last page view. The ad and campaign codes are removed from the address bar.
• Affiliate accounts — if you join our affiliate programme: your name, email address, password (stored only as a secure hash), website, how you plan to promote us, your payout method and payout details (stored encrypted), and your commission and payment history.

2. Why we use it and our legal basis

• To process, ship and support your order and send order confirmations (performance of a contract).
• To send you the emails you subscribed to — your welcome discount, offers, and a reminder if you leave a checkout unfinished (consent; unsubscribe at any time via the link in any email or by contacting us). We never send basket reminders to anyone who has already placed an order.
• To measure how the Site is used and whether our advertising works (consent where required by law; otherwise our legitimate interest in running and promoting the shop).
• To credit and pay our referral partners for orders they sent us, and to reconcile those orders with them (our legitimate interest in running a referral programme).
• To measure which advertising and partners lead to visits and sales, and to produce sales reports with our advertising and affiliate-network partner (our legitimate interest in measuring and paying for our advertising, which we have balanced against your privacy — you can object at any time, see section 7).
• To tell Google Ads and Microsoft Advertising (Bing) which ads led to a purchase. If you allowed advertising cookies (see "How consent works where you live" in section 3), we report your purchase from our server with the ad click identifier and your contact details in scrambled (hashed) form so the ad network can match it — to Google: email address, phone number, name and address ("enhanced conversions"); to Microsoft: email address and phone number — and we tell them if the order is later refunded. Legal basis: in the UK, EEA and the other opt-in regions listed below, your consent — only clicking "Accept all", or switching advertising on in "Manage settings", counts; in other regions, our legitimate interest in measuring our advertising, unless you opt out. Either way we never report you if your browser sends a Global Privacy Control signal. If you did not allow it, we send nothing about your purchase from our server to Google or Microsoft (one exception: if a purchase that we reported to Google before 31 October 2026 is refunded within 90 days, we tell Google so it can correct its figures, marked as not consented). The order confirmation page may then send Google only an anonymous signal without cookies, containing our short order reference and the order value, which Google uses for statistical modelling (Google Consent Mode). Purchases are reported to Google Analytics only if you accepted analytics cookies. Storing information on your device for this needs your consent where the law requires it; see section 3.
• To run our affiliate programme for affiliates who join it: their account, commission and payments (performance of a contract) and fraud checks (legitimate interests).
• To keep the Site secure, prevent fraud and keep accounting and tax records (legitimate interests and legal obligations).
• To handle product safety reports required by medical-device regulations (legal obligation).

3. Cookies, consent and advertising

We group cookies and similar technologies into three categories. Necessary ones are always on; Analytics and Advertising depend on your choice (the visit reference below is not stored on your device at all). You can change your choice at any time via Cookie Settings in the footer of every page.

Name	Set by	Category	Purpose	Duration
bp_consent	breathe-plus.com	Necessary	Remembers your cookie choices	6 months
breatheplus-cart-v1	breathe-plus.com (local storage)	Necessary	Your shopping cart	Until cleared
bp_sub	breathe-plus.com	Necessary	Only if you sign up for the welcome offer: lets checkout apply your discount on this device	1 year
bp_pop, bp_buyer	breathe-plus.com (local storage)	Necessary	Remembers that the welcome offer was already shown, or that this device has placed an order, so we don't show it again	Until cleared
bp_lead_v1	breathe-plus.com (local storage)	Advertising	Only if advertising is accepted (or outside opt-in regions): remembers that this browser has already added something to a basket, so a first add-to-cart is reported only once	Until cleared
bp_ord	breathe-plus.com	Necessary	Set when you start a checkout so that only your browser can show your order on the confirmation page	2 days
bp_aff	breathe-plus.com	Necessary	Only for signed-in affiliates: keeps you signed in to the affiliate dashboard	30 days
bp_attr_v1, bp_sess_v1	breathe-plus.com (local / session storage)	Advertising	Only if advertising is accepted (or outside opt-in regions): remembers which link, ad or referral partner brought you to the Site, so an order can be credited to it. Sent to us only with your page visits, your first add-to-basket and your checkout. Removed if you later reject advertising	Up to 90 days / browser session
lid, sig (visit reference)	breathe-plus.com — in the address of our own links, not stored on your device	—	If you have not accepted advertising: a signed, random reference added to a link between our pages when you use it, so a purchase in the same visit can be credited. Removed from the address bar on arrival	Stops working 3 hours after your last page
__stripe_mid, __stripe_sid	Stripe	Necessary	Fraud prevention during checkout	1 year / 30 min
_ga, _ga_*	Google Analytics	Analytics	Distinguishes visitors and sessions for anonymous statistics	Up to 2 years
_gcl_ls	Google Ads (local storage)	Advertising	Only if advertising is accepted: Google's record of the ad click that brought you	90 days
_gcl_au, _gcl_aw	Google Ads	Advertising	Measures whether a Google ad led to a purchase	90 days
IDE, test_cookie	Google (doubleclick.net)	Advertising	Ad personalisation and measurement	Up to 13 months

How consent works where you live. We detect your approximate country from your IP address to apply the right rules:

• EEA, United Kingdom (including Jersey, Guernsey, the Isle of Man and Gibraltar), Switzerland, Brazil, Canada, South Korea, Turkey, South Africa and China: analytics and advertising cookies are off until you click "Accept all" or choose them in "Manage settings". Rejecting has no effect on your ability to use the Site or buy from us.
• United States: analytics and advertising measurement are on by default. You can opt out of the "sale" or "sharing" of your personal information for targeted advertising (as defined in the California Consumer Privacy Act and similar state laws) at any time using the Do Not Sell or Share My Personal Information link. We also honour the Global Privacy Control browser signal as a valid opt-out.
• Everywhere else: analytics and advertising measurement are on by default with a notice; you can switch them off in Cookie Settings.

Google Consent Mode. We use Google's Consent Mode so that, until you consent, Google tags do not store cookies or identifiers. Google may still receive cookieless, aggregated pings to model conversions. Google's use of data is described at policies.google.com/technologies/partner-sites. You can also opt out of Google Analytics with the browser add-on and manage ad personalisation at adssettings.google.com.

4. Who we share data with

• Stripe Payments Europe Ltd / Stripe, Inc. — payment processing, fraud prevention and collection of your address on its checkout page, under Stripe's privacy policy.
• Google LLC / Google Ireland Ltd — Google Analytics, Google Ads and Google Shopping (only with your consent where required), and Google Fonts, which serves the Site's typeface and may log your IP address. With your advertising consent this includes your purchase and hashed contact details for conversion measurement (see section 2).
• Referral (affiliate) partners — when you arrived through a partner's link, we tell that partner their own click and placement references, our click reference, when you first add something to your basket (with a basket reference), and, if you order, our order reference, the order value excluding VAT, their commission, and later whether the order was refunded, along with whether you accepted advertising cookies. A partner that runs advertising for us under a separate agreement may also receive, for the visits and orders it brought, the details listed for our advertising partner below. We never give partners your name, email, phone number, address, what you bought or your payment details.
• Our advertising and affiliate-network partner, acting for us — receives details of every visit, basket and order: the time, the pages you landed on and came from, the campaign and the ad click identifier that brought you, your device type, browser, approximate country and delivery country, the order value and the profit we made on it, whether it was refunded, your advertising cookie choice, and our random visitor reference. It uses them only to produce our sales reports. It never receives your name, contact details, address, what you bought or your payment details.
• Microsoft Corporation / Microsoft Ireland Operations Ltd — Microsoft Advertising (Bing): only with your advertising consent, your purchase, its refund status and hashed email and phone number for conversion measurement (see section 2).
• Banks, PayPal and Wise — only for affiliates: to pay commission to the account an affiliate gives us.
• Delivery carriers — name, address and phone number so they can deliver your order.
• Amazon Web Services — hosting of the Site and the database that stores orders and subscribers.
• Professional advisers and authorities — where required by law, for accounting, or to report product-safety incidents to regulators such as the MHRA (UK) or HPRA (Ireland).

Apart from the advertising "sharing" described in section 3, we do not sell personal data.

5. International transfers

We are based in the United Kingdom. Our hosting and some providers (Stripe, Google, Amazon Web Services) process data in the United States and elsewhere. For transfers from the UK and EEA we rely on the UK International Data Transfer Agreement / EU Standard Contractual Clauses, the EU–US and UK–US Data Privacy Frameworks where the provider is certified, and the providers' own safeguards.

6. How long we keep data

• Order and payment records: 6 years after the order (tax and consumer-law obligations).
• Newsletter email addresses: until you unsubscribe or ask us to delete them (unconfirmed sign-ups: 30 days).
• Server logs: up to 90 days. Cookie choices: 6 months. Google Analytics data: 14 months.
• Visit records and first add-to-basket records: 14 months. Server-side visit references (for visitors who have not accepted advertising): 7 days. Referral-partner click records: 13 months.
• Affiliate accounts, commission and payout records: while the account is open and 6 years after it closes (accounting obligations). Records of what we reported to partners are kept as long as needed to avoid reporting an order twice.

7. Your rights

Depending on where you live, you may have the right to: access the personal data we hold about you; have it corrected or deleted; restrict processing; object at any time to processing based on our legitimate interests (including measuring our advertising and reporting to our partners); receive a copy in a portable format; withdraw consent at any time; and not be discriminated against for exercising these rights. To make a request email hello@breathe-plus.com. We will verify your identity (normally by replying to the email address on your order) and respond within one month (45 days for US residents).

United Kingdom and EEA (UK GDPR / GDPR). You may complain to the UK Information Commissioner's Office (ico.org.uk) or to the supervisory authority in your EU country.

California and other US states (CCPA/CPRA, Virginia, Colorado, Connecticut, Texas and others). In the last 12 months we collected the categories listed in section 1 (identifiers, commercial information, internet activity, and approximate geolocation). We "share" internet-activity data with Google for cross-context behavioural advertising only with your settings as described in section 3; we do not sell personal information for money and do not knowingly sell or share data of anyone under 16. You may opt out via the "Do Not Sell or Share" link, by the Global Privacy Control signal, or by email. You may designate an authorised agent to act for you. We do not use or disclose sensitive personal information for purposes requiring a right to limit.

Canada (PIPEDA and Quebec Law 25). You may withdraw consent and request access or correction by email. Our Privacy Officer can be reached at the address above. You may complain to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.

Brazil (LGPD). You have the rights listed in Article 18 of the LGPD, including confirmation of processing, anonymisation and information about sharing. Complaints may be made to the ANPD.

Australia. We handle data in line with the Australian Privacy Principles. Complaints may be made to the OAIC.

Israel. Under the Protection of Privacy Law you may request to review and correct information held about you in our database. Requests may be sent by email.

South Korea (PIPA). You may withdraw consent and request access, correction or deletion by email; we will respond within the statutory period.

8. Security

The Site is served over HTTPS. Order data is stored on access-controlled servers with encrypted backups, and payments are handled by Stripe, a PCI-DSS Level 1 certified provider. Only staff who need it to fulfil orders can see your details.

9. Children

The Site is not directed at children and we do not knowingly collect data from anyone under 16. The product is not suitable for children under 5.

10. Changes to this policy

We may update this policy from time to time. The latest version, with its date, is always available at breathe-plus.com/privacy/. If a change is significant we will show a notice on the Site.

11. Contact

Email: hello@breathe-plus.com
Company details: breathe-plus.com/about