Privacy Policy

This policy explains what personal data we collect through this site and our email addresses, why we collect it, who receives it, and what your rights are. It describes only what the site actually does today.

Bitcoin Studios is a trading name of Northbound Digital Ltd, a company registered in Scotland (company number SC581326). Northbound Digital Ltd is the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy also covers email sent to any address we operate, including addresses on other domains controlled by Northbound Digital Ltd.

Northbound Digital Ltd (trading as Bitcoin Studios)
Company number SC581326
Office 2/3, 2nd Floor
48 West George Street
Glasgow, Scotland G2 1BP
United Kingdom
Email: hello@bitcoinstudios.xyz

What we collect, why, and our lawful basis

• Founder applications. When you apply we collect your name, email address, company or project name (optional), your description of the idea or workflow, why you are placed to build it (optional), your stage, and any links you provide (optional). Only your name, email address and idea are required. We use this to assess and respond to your application. Lawful bases: taking steps at your request before entering into a contract (Article 6(1)(b) UK GDPR) and our legitimate interest in evaluating ventures (Article 6(1)(f)).
• Newsletter. We collect your email address to send you the newsletter you asked for. Lawful basis: your consent (Article 6(1)(a)). Every newsletter includes an unsubscribe link and you can withdraw consent at any time.
• Cawder. If you submit an idea to our Cawder research service by email, we process your email address, your idea, your replies to profiling questions (such as background, capital, risk appetite, jurisdiction and team), and records of your Lightning payment. An automated check decides whether an idea fits the service before any invoice is issued. We use this data to deliver the service you asked for. Lawful bases: performance of a contract (Article 6(1)(b)), our legitimate interest in improving the service (Article 6(1)(f)), and legal obligation (Article 6(1)(c)) for retaining payment records.
• Correspondence. If you email us at any of our addresses we receive your address and the contents of your message, and we keep a record of the exchange. Lawful basis: our legitimate interest in responding and keeping a record of our dealings (Article 6(1)(f)).
• Technical and security data. Our hosting provider processes limited technical information (IP address, browser type, request logs) to deliver and secure the site, and we use cookieless, aggregate analytics that does not identify you or track you across sites. Lawful basis: our legitimate interest in running a secure website (Article 6(1)(f)).

We do not sell personal data and we do not use it for targeted advertising. We make no automated decisions about you that have legal or similarly significant effects.

Who receives it

We share personal data only with the providers that run the relevant service for us:

• Cloudflare, Inc. (United States). Website hosting, content delivery, security, and cookieless web analytics.
• Google LLC (United States). Founder applications are stored in a Google Sheet via Google Apps Script. Google Workspace also provides our email mailboxes.
• Forward Email LLC (United States). Mail to our addresses is received by Forward Email, which routes it and holds it in an encrypted mailbox.
• 37signals, LLC (United States). Mail to our addresses, including mail to Cawder's address, is read and answered in HEY, 37signals' email service.
• Anthropic PBC (United States). Cawder submissions and profiling replies are analysed using Anthropic's Claude. Cawder otherwise runs on systems we control, with our own Bitcoin node and Lightning infrastructure.
• Gamma Tech, Inc. (United States). Cawder briefs are produced as documents using Gamma.
• EmailOctopus (a service of Three Hearts Digital Ltd, a UK company, no. 09897211). Newsletter subscriptions. Subscriber data is stored on Amazon Web Services servers in Ireland, in the EEA.

We may also disclose information where the law requires it (legal obligation, Article 6(1)(c)), or as part of a business transfer if the company is merged or acquired (legitimate interests, Article 6(1)(f)).

International transfers

Where personal data leaves the UK, we use a lawful transfer mechanism for each recipient. Transfers to Google LLC are made under Google's data processing terms, which incorporate the UK International Data Transfer Addendum to the EU standard contractual clauses; Google is also certified under the UK Extension to the EU–US Data Privacy Framework. Cloudflare, Inc. is certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US Data Bridge), and relies on it for UK transfers. Cawder runs on a consumer Anthropic subscription rather than a commercial account, so transfers to Anthropic PBC are not covered by its commercial data processing terms. Transfers to Gamma Tech, Inc. are made under its data processing addendum, which incorporates the UK International Data Transfer Addendum. Transfers to Forward Email LLC are made under its data processing agreement, which incorporates the UK International Data Transfer Addendum. Transfers to 37signals, LLC are made under its data processing addendum, which our use of its services incorporates. EmailOctopus stores subscriber data in the EEA; transfers from the UK to the EEA are covered by the UK adequacy regulations.

How long we keep it

• Applications we do not take forward: deleted within 12 months of our decision or our last contact with you.
• Applications that lead to working together: kept for the engagement and 6 years afterwards for legal and accounting purposes.
• Cawder submissions, profiling replies and the reports we produce: deleted within 12 months of delivery.
• Payment records: kept for 6 years after the end of the financial year of the payment, as tax and accounting law requires.
• Newsletter data: until you unsubscribe. We then keep a minimal suppression record so we do not email you again (legitimate interest in honouring your opt-out).
• Other correspondence: 2 years from our last exchange, or longer where it relates to a contract or a legal matter.

Technical logs are held by our hosting provider for a short rolling period and we do not keep copies. Aggregated information that identifies nobody may be kept indefinitely.

Your rights

Under the UK GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to our processing of it, to receive a copy in a portable format, and to withdraw consent at any time where consent is the basis. To exercise any of these, email hello@bitcoinstudios.xyz. We will respond within one month; for complex or numerous requests we may extend this by up to two further months, and if so we will tell you within the first month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), though we would welcome the chance to resolve any concern first.

Security

We use appropriate technical and organisational measures to protect personal data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

The site is intended for business users and is not directed at children.

Cookies

This site currently sets none. See our Cookie Policy.

Changes

If we change this policy we will update the date above. If we ever want to use your data for a materially different purpose, we will ask first.

Contact us

Email hello@bitcoinstudios.xyz, or write to Northbound Digital Ltd at the registered office above.