Privacy policy

Last updated: 31 October 2026

The short version

This policy covers our online store, lukebond.store: your account, your orders, our emails, and the cookies and measurement tools on the site.

We use your details to sell you products, deliver them and look after you afterwards. We send marketing emails only to people who agreed to receive them, or who bought from us or started a checkout or trial and have not opted out. Analytics and advertising cookies run only if you allow them in our cookie banner. We do not sell your data.

If you use HYPERCRATE, its own privacy notice explains what the app does: you can read it in the app, on first launch and at any time under Settings, Privacy.

Who is responsible

LAB Innovation Limited, trading as Luke Bond Store, is the data controller. We are a company registered in England and Wales (number 17013971), with our registered office at 128 City Road, London, EC1V 2NX, United Kingdom.

Our representative in the European Union is Prighter EU Rep GmbH, Schellinggasse 3, 1010 Vienna, Austria.

Questions, or any request about your data: info@lukebond.store.

What we collect and why

Your account and orders. When you create an account or buy from us, we collect your name, email address, billing address, phone number if you give it, what you bought, what you paid, and the IP address and browser your order came from. We use these to take your order, deliver your downloads and course access, send your receipt, handle refunds and support, prevent fraud, and keep the tax records the law requires. Our store runs on Shopify, which stores this information for us.

Payments. Card and other payment details go straight to the payment provider you choose at checkout, such as Shopify's own payment service or PayPal. We never see or store your full card details. Each provider processes your payment under its own privacy notice.

Courses. If you buy a course, your name and email address are used to give you access to our members area, which is run for us by Tevello.

Free packs and newsletter sign-ups. When you sign up for a free pack or our newsletter, we collect your email address and, if you give them, your name. Our server also records your IP address and the approximate location it indicates (country, region, city, postcode and time zone). We use these to send you the download link and our newsletter.

Reviews. If you leave a product review, your review and the name you give are published on our site. Reviews are collected and shown for us by Judge.me.

Support. If you write to us, we keep your message and our reply so we can help you and deal with any follow-up.

HYPERCRATE. Signing in to HYPERCRATE or starting a free trial uses your store account, and creates one if you do not have one yet. What happens after that is described in the HYPERCRATE privacy notice.

Our emails

Service emails. We email you about your orders (receipts, download links, refunds) and, if you start a HYPERCRATE trial, about the trial itself, such as that it has started or ends soon. These emails are part of the service you asked for, so they go to everyone.

Marketing emails. Newsletters, offers and product news go to people who agreed to receive them, for example when signing up for a free pack or the newsletter, or by ticking the box at checkout. If you buy from us, start a checkout or start a free trial, we may also email you about that order or trial and about similar products of ours, unless you have told us not to. You can opt out of these at any time.

Every marketing email has an unsubscribe link, and you can also ask us to stop at info@lukebond.store. Unsubscribing does not affect your orders, your account or your licence.

Our emails are sent by Klaviyo. To leave existing customers out of adverts for products they already own, we may give Meta a list of customer email addresses, turned into one-way codes (hashes) before they are sent.

Cookies and similar technologies

Cookies are small files a website stores in your browser. We also use your browser's local storage in the same way. We group them into three kinds.

Strictly necessary. These make the store work: your basket, checkout, signing in, security and remembering your cookie choice. They are set by Shopify and do not need your consent.

Analytics. These tell us how people use the site, which pages work and where they get stuck, so we can improve it. We use PostHog, which can record how you move through a page (page views, clicks and scrolling), and Google Analytics.

Marketing. These let us measure whether our adverts on Meta (Facebook and Instagram) and Google lead to visits and sales, and show our adverts to people more likely to be interested. They include Meta's and Google's own tags, and the identifiers they set when you arrive from one of their adverts.

Your choice. When you first visit, our cookie banner asks whether to allow analytics and marketing cookies. Nothing in those two categories runs until you allow it, and you can change your mind at any time through the Cookie preferences link at the bottom of every page. Refusing does not stop you using the store.

Much of this measurement passes first through our own server at sgtm.lukebond.store, run for us by Stape, before it reaches Meta or Google.

Reports of purchases to our advertising and analytics services

When an order is paid, our server tells Meta and our analytics service that a purchase took place, so we can measure whether our adverts lead to sales.

The report to Meta contains your email address, name, phone number, city, postcode, region, country and customer number, each turned into a one-way code (a hash) on our server before it is sent, which Meta compares with codes made the same way from its own users' details. It also contains what you bought and its value, the IP address and browser your order came from, and Meta's advert identifiers if your browser had them. The report to our analytics service contains the order, its value, its country and how you reached us, but not your name or email address.

We send the report to Meta only if your browser allowed marketing cookies on our store. The report to our analytics service is sent for every paid order, so that we have a complete record of our sales; you can object to it at any time by writing to info@lukebond.store.

Who receives your data

Shopify (Shopify International Limited, The Sidings, Grand Canal Quay, Dublin, Ireland, and its affiliates), which runs our store, checkout and customer accounts.
Payment providers, such as Shopify's payment service and PayPal, for the payment method you choose.
Klaviyo (Klaviyo, Inc.), which sends our emails and holds our mailing list, acting as our processor.
Tevello, which runs our members area for courses.
Judge.me, which collects and shows product reviews.
PostHog, for analytics, acting as our processor. Its data is held in the European Union.
Google (Google Ireland Limited), for Google Analytics and for measuring our Google adverts.
Meta (Meta Platforms Ireland Limited), for measuring and showing our adverts on Facebook and Instagram, under Meta's own terms.
Stape, which runs our measurement server in the European Union, acting as our processor.
Cloudflare (Cloudflare, Inc.), which runs our domain and the small servers that relay our analytics, deliver free packs and send purchase reports, acting as our processor.

Nobody else. We do not sell your data. We may disclose information where the law requires it, or to protect our rights in a dispute.

How long we keep it

Order and invoice records: 6 years after the end of the financial year in which the order was placed, because UK company and tax law requires it.
Your customer account: until you ask us to close it.
Our mailing list: until you unsubscribe. After that we keep only your email address on a do-not-email list, so we do not email you again.
Support emails: up to 3 years after the conversation ends.
Product reviews: for as long as the review is published, or until you ask us to remove it.
Analytics data in PostHog: 1 year. Recordings of how you moved through a page: 30 days.
Logs on our measurement server: no more than 10 days.
Cookies: each cookie expires on its own schedule. Our own first visit cookie lasts 90 days and our analytics link cookie 30 days. Our advert click identifier lasts 90 days. The random visitor number and any details you typed into one of our forms stay in your browser until you withdraw marketing consent or clear your browser's data for our site.
Meta and Google keep what they receive under their own terms and privacy policies.

Why we may lawfully use your data

To take and deliver your order, give course access, send service emails and provide support: the contract between us.
To keep order, invoice and tax records: our legal obligations.
To send marketing emails: your consent, which you can withdraw at any time by unsubscribing; or, for emails about similar products after you bought from us or started a checkout or trial, our legitimate interest in telling customers about our products, which you can stop at any time by unsubscribing.
For analytics and marketing cookies: your consent, given in our cookie banner, which you can withdraw at any time.
To publish your review: your consent, given when you submit it.
To prevent fraud and keep the store secure: our legitimate interest in protecting our customers and our business.
For the purchase report to Meta: your consent, given in our cookie banner.
For the purchase report to our analytics service: our legitimate interest in understanding our sales, which you may object to.

Where your data is stored

Some of our suppliers named above, or their parent companies, are in the United States or other countries outside the UK; where your data may reach them, we rely on the UK's adequacy regulations or on the standard contractual clauses, with the UK's addendum to them. Write to us for a copy of the relevant safeguards.

Your rights

Under UK and EU data protection law you may request a copy of what we hold, ask for it to be corrected or deleted, ask us to restrict how we use it, or to give it to you in a portable form, object to processing, or withdraw consent. Write to info@lukebond.store.

We may need to confirm it is you before acting on a request, usually by replying from the email address on your account. Some records, such as invoices, we must keep for the period the law requires even if you ask us to delete them.

You may also complain to the Information Commissioner's Office (ico.org.uk) or to your local supervisory authority. We would be grateful for the chance to put things right first.

Children

Our store is not directed at children and we do not knowingly collect data from them. If you think a child has given us their details, write to us and we will delete them.

Changes

If we change this policy, we will publish the new version here and update the date at the top.

This policy is written in English. If a translation of it differs from the English version, the English version applies, unless the law of the country where you live gives you, as a consumer, a better position.