Privacy Policy

This Privacy Policy explains how information is handled when you visit the Riffparcel website or web app, contact us, request a free sample, request the Short-Form Video Playbook, or use an authenticated client portal. It is written for people in the UK and describes the current website, web-app and service-request flows in plain English.

When you use the website, the hosting and application systems may receive ordinary technical, security and diagnostic information such as request details, browser or device information, approximate timing, error records and network information. This helps operate, protect and troubleshoot the site.

The consent-gated Meta Pixel is enabled only when the relevant analytics choice is made through the site controls. Separately, the framework visitor beacon may create a pseudonymous visitor identifier in browser storage and send a page-load measurement; its classification and control are reviewed separately from the app analytics choice. See the Cookie Policy for the browser technologies and choices currently described there.

The contact form accepts exactly your name, email address and message. We use these details to receive, review and respond to your enquiry.

The free-sample request form accepts exactly your name, work email, company, website, source content type, request details and source video URL. We use these details to review the request, create a request reference and operate the service-intake workflow. The source video URL is supplied by you, so only submit material you are authorised to share.

The playbook request form accepts exactly your name, work email, company and affirmative consent to store these details to review your request and provide access to the Short-Form Video Playbook. The consent wording and your affirmative choice are stored with the request.

A service request may also produce an internal reference, submitted form snapshot, status, status history and notification record. These records help us track the request and respond consistently; they are not a public directory.

If you are given an account or access to a client portal, the application handles authentication and session information so it can recognise your signed-in session, protect the workspace and show the information you are authorised to access. Stored client-workspace data may include account and session details, source links, brand assets, delivery and review records, performance reports, request status and history, and communications. These records may be associated with the relevant account and client work.

The purposes include operating and securing the website, preventing misuse, reviewing and managing service requests, creating request references, responding to enquiries, providing service communications, providing playbook access, maintaining workflow records, protecting authenticated workspaces and sending necessary owner or operational notifications.

Information is used only for the relevant service, security, operational or communication purpose. Where UK GDPR or PECR requires a particular lawful basis or consent choice, the applicable requirements and your choices apply.

Information may be shared with the categories of providers needed to run the site and deliver the requested service, including hosting and infrastructure, database and application operations, authentication, email and communications, security, analytics and visitor-technology providers. Access is limited to what is needed for the relevant purpose.

Some providers may process information outside the UK. Any such processing is subject to the safeguards and transfer requirements that apply under UK data-protection law.

We keep information only for as long as it is needed for the purpose for which it was collected, to manage an active request or service conversation, to maintain necessary operational or legal records, or to protect the website and its users. Retention is considered by record type, including technical and security records, form submissions, request history, communications, analytics information and backups.

When information is no longer needed, it is deleted, anonymised or securely de-identified where appropriate. Access controls, authenticated areas and ordinary technical and organisational security measures are used to protect information, although no online service can guarantee absolute security.

Subject to applicable law and exemptions, UK GDPR rights may include asking for access to your personal data, correction of inaccurate data, erasure, restriction of processing, data portability, or objecting to processing. You may also have rights relating to consent where consent is the basis for processing. We may need to verify your identity before completing a request.

For a privacy question or rights request, use the public /contact form. You can also complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

This policy may change when the website, service-request flows or applicable legal requirements change. The current version will be published on this page.