LEGAL
Privacy Policy
Last updated: 11 October 2026
This policy explains what personal information CakeTop Studio collects, why, who we share it with and the choices you have. In short: we collect what we need to run your account, save your designs and take payment. We don’t sell your data, and we don’t use advertising or analytics trackers.
1. Who we are
CakeTop Studio at cookiehigh.com is run by Jack Kitterhing, trading as CookieHigh, a sole trader based in London, United Kingdom. We are the “controller” of your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For anything about your data, email hello@cookiehigh.com.
2. What we collect
| Type | What it includes | Where it comes from |
|---|---|---|
| Account details | Your name, email address and password (stored only as a secure one-way hash — we can’t see it). | You, when you sign up or update your settings |
| Subscription and billing | Your Stripe customer and subscription IDs, plan, status and renewal dates. Card details are entered on Stripe’s pages and never reach us. | You and Stripe |
| Course purchase | If you buy The Topper Method: your name, email, the course, the sale reference, purchase date and any refund. | Teachable, when you buy the course |
| Your content | Designs and their preview images, your editor workspace (autosaved), custom fonts and artwork you upload. | You, when you use the editor |
| Help requests | The subject, message and any screenshot you send, with your name and email. | You |
| Security and technical data | For each login session: your IP address, browser/device description and when it started and expires. Counts of failed login attempts. Standard server logs (IP address, pages requested, time). | Your browser, automatically |
| Admin records | A log of actions our admins take on your account (for example, granting access). | Us |
| Messages to us | Emails or WhatsApp messages you send us, and our replies. | You |
We don’t ask for special category data (such as health information). Please don’t include it in designs or help requests.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, saving your designs and fonts, providing the editor and tools | Contract — we need it to provide the service you signed up for |
| Taking payment, managing your subscription, handling cancellations and refunds | Contract |
| Adding the Studio Access included with your course purchase | Contract (your course purchase) and our legitimate interest in giving buyers what they paid for |
| Answering help requests and messages | Contract, or our legitimate interest in supporting users |
| Keeping accounts secure, preventing fraud and abuse, fixing faults | Legitimate interests — protecting you, us and the service |
| Keeping tax and accounting records | Legal obligation |
| Telling you about important changes to the service, prices or these policies | Contract and legitimate interests |
We don’t send marketing emails, and we don’t make decisions about you based solely on automated processing.
5. International transfers
Some of our providers, including Vercel and Neon, store or process data in the United States. When personal information leaves the UK, we rely on UK-approved safeguards — the UK–US data bridge where the provider is certified, or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses. Email us if you would like more details.
6. How long we keep it
- Account details, designs, fonts and workspace — while your account is open. When you ask us to close your account, we delete them within 30 days (backups roll over shortly after).
- Help requests — while your account is open, unless you ask us to delete them sooner.
- Billing, subscription and course purchase records — 6 years after the end of the tax year they relate to, as UK tax law requires.
- Login sessions — up to 30 days; they are removed when they expire or when you log out.
- Failed login counts — used over a 15-minute window to block password guessing.
- Server logs — kept by our hosting provider for a short period.
- Admin activity records — while your account is open, and then only as long as needed to resolve any dispute.
8. Security
The site is served only over encrypted HTTPS connections. Passwords are stored as one-way hashes, login cookies are protected from scripts and cross-site use, repeated failed logins are blocked, and each member can only reach their own designs and data. No system is perfectly secure; if we become aware of a breach that affects you, we will tell you and the regulator where the law requires.
9. Your rights
You have the right to:
- access the personal information we hold about you and get a copy;
- correct it if it’s wrong — you can change your name, email and password yourself in Settings;
- delete it, including closing your account;
- restrict or object to how we use it, including anything based on our legitimate interests;
- move it — receive the data you gave us in a common, machine-readable format.
To use any of these, email hello@cookiehigh.com from the address on your account. We will reply within one month and won’t charge you. We may need to confirm your identity first.
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
10. Children, changes and contact
Children. The Studio is for adults aged 18 and over. We don’t knowingly collect information from children; if you think a child has signed up, please contact us and we will delete the account.
Changes. We will update this policy if what we do with your data changes. If the change is significant, we will tell you by email or in your account before it takes effect. The date at the top shows the latest version.
Contact. hello@cookiehigh.com · Jack Kitterhing, trading as CookieHigh, London, United Kingdom. See also our Terms and Conditions.