Privacy Policy

The company that operates Cuffkeep is the controller of the personal data described here. Its registered particulars are published on the Legal Information page, and privacy enquiries go to support@ismallk.com.

This policy is written to the UK GDPR and the Data Protection Act 2018. Where the EU GDPR applies to you it is applied on the same terms. Residents of California have the additional rights set out further down.

Account data. Your email address, an encrypted password or a third-party sign-in identifier, and the plan you are on.

Uploads. Photographs of composition labels and of sock cuffs. The service declines photographs of socks being worn and does not ask for, or want, photographs containing people.

Readings. The inputs you enter — storage duration and the method you currently use — and the estimate produced from them.

Billing data. Where you subscribe, our payment provider processes your payment details and returns to us only a customer reference, the plan, the status and the last four digits of the card. We do not receive or store full card numbers.

Technical data. IP address, browser and device type, and error logs, kept for security and for keeping the service working.

To provide the service and produce your readings — performance of our contract with you.

To take payment, prevent fraud, keep the service secure and answer support enquiries — our legitimate interests in running the service, balanced against your rights.

To meet accounting, tax and consumer-law obligations — compliance with a legal obligation.

To set optional analytics cookies — your consent, which you give or withhold on the cookie bar and can change at any time. Nothing optional is set before you choose. See the Cookie Policy.

Photographs you upload are used to produce your reading and for nothing else. They are not used to train, fine-tune or evaluate machine learning models — not ours and not any third party’s — and they are not sold, shared or licensed.

A photograph is sent to our model provider only for the purpose of reading the elastic percentage and the rib structure in it, under a contract that prohibits the provider from retaining it for its own purposes or using it for training. It is not used to improve any model.

Uploads: 30 days from upload, then deleted automatically. You can delete an upload sooner from the reading it belongs to.

Readings: kept while your account is open, so that you can come back to them. Deleting a reading deletes it and its uploads.

Account data: kept while your account is open. Deleting your account deletes your account data, your readings and your uploads within 30 days, including from backups as those backups age out on their normal cycle.

Billing records: kept for six years after the end of the relevant financial year, because tax law requires it. This is the one category that survives account deletion, and it is limited to the transaction record.

Technical logs: 90 days.

Deletion means the underlying files are removed, not merely hidden from your view.

Our hosting and database providers, our email provider, our payment provider and our model provider, each acting on our instructions under a written contract.

Nobody else. Your data is not sold, is not shared for cross-context behavioural advertising, and is not passed to data brokers.

Some of the providers above process data outside the UK. Where they do, the transfer is made under UK adequacy regulations where they cover the destination, and otherwise under the International Data Transfer Agreement (IDTA), or the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the Information Commissioner, together with a transfer risk assessment.

You can ask us which mechanism applies to a particular provider and we will tell you.

You have the right to be told what we hold and to a copy of it; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to portability; and to withdraw consent where processing rests on consent, without that affecting what was done beforehand.

Most of these are available directly from your account page. For anything else, write to support@ismallk.com and we will respond within one month.

There is no automated decision-making producing legal or similarly significant effects. A reading is an estimate about a garment, not a decision about you.

You have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority for data protection.

The ICO can be reached at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You may complain to the ICO at any time; you do not have to raise it with us first, although we would rather you did so that we can put it right.

You have the right to know what personal information is collected and for what purpose, to request deletion, to request correction, and not to be discriminated against for exercising those rights.

We do not sell personal information and we do not share it for cross-context behavioural advertising. Requests go to the same address as everything else and are answered within 45 days.

The service is for people aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, tell us and we will close it and delete the data.