Privacy notice

Last updated: 10 May 2026.

This notice explains how BorderKit handles personal data on the public website at borderkit.app. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who the controller is

The data controller is BorderKit, a UK-based product. Contact details for data protection requests:

Use this address for any privacy, data-rights, or controller contact request.

What data we process

The public website processes a deliberately small amount of personal data.

Waitlist email address (when collected). If you choose to sign up to the waitlist via the form on the home page, we collect your email address and nothing else. We do not collect your name, role, country, use case, or any marketing-preference data. The waitlist exists solely to send you a single launch announcement email when BorderKit's main product is available. There is no marketing drip, no newsletter cadence, and no profiling.

At the time of writing, the waitlist email-collection processor has not yet been finalised. The processor will be EU- or UK-hosted, will offer a UK GDPR Article 28 data processor agreement, and will not require third-party tracking cookies on this site. This notice will be updated with the processor's name as soon as the selection is made.

Server log data. When you visit this site, the hosting platform records standard server log data, including your IP address, the URL requested, the timestamp, the HTTP response code, the request size, and a user-agent string. This data is processed for security, abuse prevention, and fraud detection. It is retained for 30 days, after which it is deleted by the hosting platform's standard rotation.

Strictly-necessary runtime cookies. The site may set strictly-necessary cookies required to keep the site functional. It does not set advertising, analytics, or tracking cookies. See the cookies notice for the full list.

We do not use Google Analytics, the Facebook Pixel, the LinkedIn Insight tag, any marketing pixels, any tag manager, or any fingerprinting library. We do not write to localStorage, sessionStorage, IndexedDB, or any Service Worker storage for analytics or tracking purposes.

Legal bases for processing

Under Article 6 of the UK GDPR, we rely on the following legal bases.

Article 6(1)(a) — consent. Your waitlist email address is processed on the basis of your consent. You provide that consent by submitting the form. You can withdraw consent at any time by clicking the unsubscribe link in the launch email, or by contacting us at the address above. On withdrawal, your email address is removed from the waitlist processor.

Article 6(1)(f) — legitimate interests. Server log data is processed on the basis of our legitimate interest in keeping the site secure, preventing abuse, and investigating fraud. We have balanced this interest against your privacy rights and concluded that the limited retention period and the absence of profiling minimise the impact.

Your rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access (Article 15) — to obtain a copy of the personal data we hold about you.
• Right to rectification (Article 16) — to have inaccurate personal data corrected.
• Right to erasure (Article 17) — to have your personal data deleted in the circumstances set out in the Article.
• Right to restrict processing (Article 18) — to limit how we use your data in specific circumstances.
• Right to data portability (Article 20) — to receive your data in a structured, commonly-used, machine-readable format.
• Right to object (Article 21) — to object to processing based on legitimate interests.
• Rights related to automated decision-making and profiling (Article 22) — none apply here, as we do not carry out automated decision-making.

To exercise any of these rights, contact us at the address above. We will respond within one month of receiving your request, as required by Article 12(3) of the UK GDPR. In limited circumstances, we may extend this period by a further two months for complex or numerous requests; if we do, we will tell you within the first month and explain why.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection authority, at ico.org.uk.

Data processors

We use the following third-party processors. Each processor is bound by a UK GDPR Article 28 data processor agreement.

• Hosting provider: Google Cloud / Firebase App Hosting (Cloud Run, Cloud Build, Cloud CDN). Processes server log data on our behalf.
• Waitlist processor: none currently engaged. If waitlist email collection starts, this notice will be updated with the selected processor before that processor receives personal data.
• Analytics processor: none currently engaged. If a cookieless server-side analytics processor is selected, it will be added to this list before it receives personal data.

International data transfers

The hosting provider may process data in data centres outside the United Kingdom. Where transfers happen, they rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision under Article 45 of the UK GDPR.

Children's data

This site is not directed at users under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, please contact us so we can delete it.

Changes to this notice

If we make material changes to how we process personal data, we will update this notice and revise the "last updated" date at the top. Past versions are visible in the public Git history of this site's repository.

Contact

For any question about this notice, or to exercise any right described above, please use the contact details at the top of this page.