Privacy Policy

Version 1.0. Last updated 25 August 2026. Effective 25 August 2026.

This policy explains what personal data Bespoke Dashboard collects, why we collect it, who else sees it, how long we keep it, and what you can do about it. It covers the marketing site at bespokedashboard.com and the dashboard application at bespokedashboard.com/app/.

Who we are

Bespoke Dashboard is operated by VANQUISH DIGITAL LIMITED, a company registered in England and Wales (company number 11783885), registered office 2 Drinkwater Road, Harrow, England, HA2 0FX. VANQUISH DIGITAL LIMITED is the data controller for the personal data described in this policy.

For any privacy question or to exercise your rights, contact support@bespokedashboard.com.

The short version

You can use the free tier without giving us anything beyond an email address, a display name and a password.
Everything you track is yours. We do not sell it, and we do not use it to build advertising profiles.
Health information and progress photographs are special category data. We only process them because you explicitly ask us to, and you can withdraw that at any time.
Some features are deliberately social. If you post a plugin comment or add a Habit Grower friend, specific things become visible to other people. The Visible to other users section lists exactly what.
You can download everything we hold, or delete your account outright, from your profile at any time. No support ticket, no waiting period.
Analytics cookies are off until you turn them on. See the Cookie Policy.

What we collect

Almost all of it is data you type in yourself. We do not connect to your bank, your health records, or any other outside account, and we do not buy data about you.

Category	What it includes	Where it comes from
Account	Email address, display name, password (stored only as a salted hash), account creation date, sign-in history. If you use Google sign-in, the basic profile Google shares with us: name, email address and the Google account identifier.	You, or Google if you choose Google sign-in
Daily tracking	Body weight and your chosen unit, water intake, free text notes, and exercise entries (name, body part, duration, weight label).	You
Progress photographs	Face and physique photographs you upload, the date and the angle each was taken at. Also an optional dashboard header background image.	You
Skincare	Routine periods and notes, the products in each routine, and which products you ticked off on which day.	You
To-do list	Tasks, their dates and completion state, and recurring task rules.	You
Finances	Account names you choose, balance snapshots by date, and free text finance notes. Entered manually. We have no access to any bank or brokerage.	You
Spending	Transactions in and out (date, name, merchant, amount, category, description, tags), recurring payment rules, and monthly budgets.	You
Subscription and billing	Your subscription status, plan and interval, renewal date, cancellation flag, and the Stripe customer and subscription identifiers. Card details go directly to Stripe and never reach our servers.	Stripe, following your checkout
Plugins	Which plugins you have installed. If you post a comment: its text, the date, and a display name. If you submit a plugin: the listing you wrote and your display name as author.	You
Habit Grower	Coins earned and spent, plants unlocked and planted, daily claim streak, which to-dos have already paid out, your shareable friend code, a display name, and your friend connections.	You
Settings and appearance	Dashboard layout and widget preferences, dark mode, custom colour themes and saved presets.	You
Technical and security	Server logs generated by our hosting and database providers when your browser makes a request, including IP address, browser user agent, timestamps and the account identifier involved. Records of friend requests sent, used to enforce anti-spam limits.	Automatically, when you use the service
Analytics	Only if you consent: page views and general usage of the marketing site through Google Analytics. Never used on your signed-in dashboard.	Automatically, with your consent

Health data and progress photographs

Body weight, water intake, exercise records, skincare routines and adherence, health related notes, and photographs of your face and body are special category data under Article 9 of the UK GDPR. The law treats these as needing stronger protection than ordinary personal data, and so do we.

Our condition for processing them is your explicit consent under Article 9(2)(a). We ask for that separately from our Terms of Service, before you first enter health information or upload a photograph, and we record when you gave it.

You can withdraw that consent at any time by deleting the data in question or by deleting your account. Withdrawal does not affect anything we lawfully did before you withdrew. Withdrawing means we can no longer provide the health tracking features, but the rest of the dashboard keeps working.

Progress photographs are held in a private storage area, in a folder tied to your account. They are never public, and they are served to your browser only through links that expire after one hour.

Why we process it, and our lawful basis

Purpose	Lawful basis
Creating and running your account, and providing the tracking features you use	Article 6(1)(b), performance of our contract with you
Storing and displaying health information and progress photographs	Article 6(1)(a) consent, together with Article 9(2)(a) explicit consent
Taking payment, managing your subscription, and handling refunds	Article 6(1)(b), performance of our contract with you
Keeping accounting and tax records of payments	Article 6(1)(c), compliance with a legal obligation
Keeping the service secure, preventing abuse and spam, and investigating incidents	Article 6(1)(f), our legitimate interest in a service that is not abused. We limit this to what security genuinely needs.
Optional social features: friend connections, the leaderboard, plugin comments	Article 6(1)(a) consent, given by choosing to use the feature
Understanding how the marketing site is used	Article 6(1)(a) consent, given through the cookie banner
Responding to your support messages and rights requests	Article 6(1)(b) and Article 6(1)(c)

Visible to other users

Your tracking data is private to your account. Some features are social by design, though, and we would rather be precise than reassuring. This is the complete list of what other people can see, and each of these only happens if you choose to use the feature.

Plugin comments. A comment you post on a plugin is readable by every signed-in Bespoke Dashboard user, together with the display name shown against it and the date. If you have not set a display name, the name shown is derived from the part of your email address before the @ sign. Please bear that in mind before commenting.
Plugin submissions. If you submit a plugin and we publish it, the listing and the author name on it are visible to anyone, including people who are not signed in.
Habit Grower friend codes. Anyone who has your friend code can use it to send you a friend request, and will see the display name on your Habit Grower profile. Only share your code with people you want to connect with. You can decline any request.
Habit Grower friends. Once you accept a friend request, that person can see your Habit Grower display name, your garden, your coin totals and your position on the leaderboard. They cannot see anything else in your account: no weight, no photographs, no finances, no to-do text.
Incoming friend requests. If you send someone a request, they see your display name and friend code so they can decide whether to accept.

Nothing in Daily Tracking, Health, Finances, Spending or your To-do list is ever visible to another user. We do not have a public profile feature, and we do not publish anything about you that is not listed above.

We do not sell your personal data and we do not share it for anyone else's marketing. We do rely on a small number of service providers to run the product. They act on our instructions under contract, and may only use the data to provide their service to us.

Provider	What they do	What they receive
Supabase	Database, authentication and file storage	Everything in your account, including photographs
Vercel	Website and application hosting	Request data such as IP address and user agent
Stripe	Payment processing and subscription billing	Your email address, your account identifier, and your payment details, which you give to Stripe directly
Google (Sign in with Google)	Optional sign-in method	Only used if you choose it. Google tells us your name, email and account identifier.
Resend	Sending service emails, such as the notice before an inactive account is deleted	Your email address and the contents of that message
Google Analytics	Marketing site usage statistics	Only with your consent. Page views, approximate location and device information. Not used on your dashboard.

We may also disclose personal data where the law requires it, for example in response to a valid court order, or where we need to establish or defend a legal claim.

Where your data is held

Your account, everything you track, and your progress photographs are stored in Frankfurt, Germany, inside the European Economic Area. The United Kingdom recognises the EEA as providing an adequate level of data protection, so this involves no additional transfer safeguards.

Some of our providers are US companies whose staff may access data from outside the UK and EEA in order to support the service, and Stripe and Google process some data in the United States. Where that happens we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with an assessment of the transfer.

You can ask us for details of the safeguards in place for any particular transfer by emailing support@bespokedashboard.com.

Cookies and analytics

We use a small number of strictly necessary cookies and browser storage entries to sign you in and keep the service working. These do not need your consent. Analytics cookies are optional, off by default, and only set if you accept them. You can change or withdraw your choice at any time using the "Cookie settings" link in the footer of any page.

The Cookie Policy lists every cookie and storage key by name, with its purpose and how long it lasts.

How long we keep it

Data	Retention
Everything in your account, including photographs	Until you delete it, or until you delete your account. We do not expire your tracking history.
Account record	Until you delete your account.
Payment and invoice records	Six years after the end of the relevant accounting period, as UK tax law requires. Held by Stripe and in our accounting records, and kept even if you delete your account.
Consent records	For as long as we rely on the consent, and then for a further year so that we can show it was validly given.
Server and security logs	For the retention period set by our hosting providers, which is short. Server logs are kept only for the short period our hosting and database providers set, and are then deleted automatically. We do not export them, extend those periods, or keep copies of our own.
Database backups	Deleted data persists in backups until they roll off. Data you delete can persist in encrypted backups until those backups rotate out on the provider schedule. We do not restore a backup in order to recover a deleted account, and we keep no separate copies of our own.
Inactive accounts	If an account is not signed in to for 24 months, we email the address on it and delete the account and its contents if there is no sign-in within the next 60 days. Signing in at any point before that date cancels the deletion, and no further action is needed from you.

Deleting your account

You can delete your account yourself, at any time, from your profile. There is no support ticket and no waiting period. When you confirm, we cancel any active subscription with Stripe, delete your stored photographs, and delete your database records.

Because we would rather be accurate than absolute, here is what does not vanish at that moment:

Payment and invoice records held by Stripe and in our accounting records, which we are required by law to keep. Your subscription is cancelled, so no further payment is taken.
Data in encrypted database backups, until those backups roll off on their normal schedule.
Server logs held by our hosting providers, for their retention period.
Any link to one of your photographs that was already issued stays usable for up to one hour before it expires. The files themselves are deleted immediately.
If we cannot reach Stripe to cancel your subscription, we stop and report an error rather than deleting your account while leaving billing running. If that happens, contact us and we will resolve it.

Comments you posted on plugins and any plugin you submitted are removed or anonymised as part of the deletion, so your name does not remain attached to them.

Your rights

Under UK data protection law you have the following rights, free of charge.

Right	How to use it
Access a copy of your data	Use "Export all data" in your profile, which produces a zip containing every table plus your original photographs. Or email us.
Portability, in a machine-readable form	The same export. Data is provided as JSON with the photographs as image files.
Rectification of anything inaccurate	Edit any entry directly in the dashboard. Change your name, email address or password in your profile. Email us if something cannot be corrected in the app.
Erasure	Delete individual entries in the app, or delete your whole account from your profile.
Withdraw consent	For analytics, use "Cookie settings" in the footer. For health data, delete the data or your account. Withdrawal does not affect processing already carried out.
Restriction of processing	Email support@bespokedashboard.com.
Object to processing based on legitimate interests	Email support@bespokedashboard.com.
Complain to the regulator	See below.

Email support@bespokedashboard.com to exercise any of these. We respond within one month. If a request is complex we may need up to two further months, and we will tell you inside the first month if so. We may ask you to confirm your identity before we act on a request.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first at support@bespokedashboard.com so we have a chance to put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at any time.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk/make-a-complaint

How we protect your data

All traffic is encrypted in transit with HTTPS, and enforced by HTTP Strict Transport Security.
Every database table enforces row-level security in the database itself, so access rules are applied by the server and not merely by the app you are using.
Progress photographs are held in a private bucket scoped to your account and reached only through links that expire after one hour.
Passwords are stored only as salted hashes by our authentication provider. We never see them.
Card details are handled entirely by Stripe on Stripe's own pages and never reach our servers.
The site sets a strict content security policy and related security headers.
We carry out security reviews of the codebase and fix what they find.

No service can promise perfect security. If a breach occurs that puts your rights at risk, we will notify the Information Commissioner's Office within 72 hours where required, and tell you directly where the risk to you is high.

Children

Bespoke Dashboard is not intended for children. You must be at least 16 years old to create an account, and we ask you to confirm this when you sign up. If you believe a child has created an account, email support@bespokedashboard.com and we will delete it.

Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. Some features suggest things to save you typing, such as proposing a spending category or summarising your own numbers back to you. These are conveniences you can always override, and they do not decide anything about you.

Changes to this policy

We update this policy when the product changes. The version number and date at the top always tell you which version you are reading. If we make a material change, we will email registered users at least 14 days before it takes effect, and where the change requires your consent we will ask for it rather than assume it.

Contact

VANQUISH DIGITAL LIMITED
2 Drinkwater Road, Harrow, England, HA2 0FX
Company number 11783885
support@bespokedashboard.com