Privacy Policy

1. Who we are

Deco Operations Ltd is a company registered in England and Wales (company number 17032490). Our registered office is in London, United Kingdom. We are registered with the Information Commissioner’s Office (ICO registration number ZC112793). We operate the website decooperations.co.uk and the Docket order-management platform at docket.decooperations.click.

For the purposes of the UK GDPR and the Data Protection Act 2018, Deco Operations Ltd is the data controller. You can reach us at hello@decooperations.co.uk.

2. What data we collect and why

Contact form (decooperations.co.uk)

When you submit the contact form on our website we collect your name, email address, phone number (if provided), the topic you selected, and the message you wrote. If you tick the optional marketing checkbox we also record that consent. Phone number is optional and used only to follow up on your enquiry.

Lawful basis: legitimate interests (responding to your enquiry). If you opt in to marketing, we additionally rely on your consent for that purpose.

Form submissions are processed by Formspree, Inc. (see §7 below) and delivered to our inbox. We do not store your submission on our own servers beyond what our email provider retains.

Docket — dry-cleaner order management

Docket is used by independent dry-cleaning shops (our clients) to manage customer orders. When a shop uses Docket to process your order, the following data may be collected:

• Your name and mobile phone number (provided at drop-off)
• Order details (garment description, ready date, price)
• SMS messages sent to your number about your order status

Lawful basis: performance of a contract (processing and returning your laundry order). The dry-cleaning shop is the data controller for your customer data; Deco Operations Ltd acts as a data processor on their behalf.

Phone numbers are stored securely in the EU and are used only to send you order-status SMS notifications via Twilio. We do not use your number for any other purpose, and we do not share it with third parties other than the sub-processors listed in §7.

3. Red Moon Practice (iOS app)

Red Moon Practice is a guitar-practice app for iPhone. Your playing never leaves your device: it has no user accounts, no advertising and no third-party trackers, and it never transmits your audio, your recordings, your journal notes, your song names or your artist name. The one thing it can send is a set of anonymous usage counts, and a single switch in Settings ▸ Privacy stops them at any time. Where that switch starts depends on where you are: in the EEA and Switzerland the counting is off until you turn it on, and everywhere else — including the UK — it starts on, and the app tells you so while you are setting it up.

• Where your content lives: Songs you add, loops, exercises, routines, and journal entries are stored on your device. The app has no cross-device sync, so this content is not copied to any server of ours or to iCloud, and we never have access to it. If we add sync in a future version it will use your own private iCloud storage, and this policy will be updated before it ships.
• Your audio files: The app practises against audio files you choose from your device or iCloud Drive, and only ones you explicitly pick. When you add a song, Red Moon keeps its own copy inside the app’s storage on your phone, so the song still plays if you later move, rename or delete the original, and so it comes back with your phone if you restore from a backup. Your original file is never moved or altered. That copy stays on your device: it is included in your own device backup, and it is never uploaded to us, copied off your phone, or shared with anyone.
• The microphone: Used for two things. The tuner listens to a played string to work out its pitch, analysing the sound as it arrives and keeping none of it. And practice takes you choose to record are saved locally on your device. Neither is ever uploaded or shared — the app has no way to send audio anywhere. The microphone is the only system permission the app asks for; it does not request access to your music library, and it cannot play Apple Music or Spotify streaming audio at all.
• Anonymous usage counts: Unless switched off, the app reports which features get used — that a practice run started, that a loop was made, that an exercise was created from a particular template. The list of what can be sent is fixed in the app’s code and cannot be extended without a new release: it is built so that the values it is capable of sending are a fixed set of predefined options, with no way to attach free text to them. There is no account, no device identifier, no advertising identifier, no cookie and no fingerprint, and the counts are not joined up across sessions, so they cannot be traced back to you or assembled into a profile.
• Lawful basis and how to stop it: This depends on where you are, because the law does. In the EEA and Switzerland, storing or reading information on your device for analytics requires your consent under ePrivacy Art. 5(3). So the app asks, the answer is “no” until you say otherwise, and you can withdraw at any time in Settings ▸ Privacy, effective immediately. In the UK, the Data (Use and Access) Act 2025 (Sch. A1 para. 5, in force 5 February 2026) exempts first-party analytics used solely to gather statistics for improving a service, provided you are given clear information and a simple, free way to object. That is the basis we rely on: the app tells you during setup, the counting is limited to improving Red Moon Practice, and the switch in Settings ▸ Privacy is the means of objecting — one tap, free, effective on the next event and with no loss of function. We rely on the same reasoning elsewhere in the world. Either way, because the counts are irreversibly anonymous they are not personal data, so there is no record tied to you for us to access, correct or erase.
• Subscriptions and payment: The app is sold as an auto-renewing subscription through the App Store. Apple is the merchant: your payment method, billing address and purchase history are handled entirely by Apple under Apple’s privacy policy, and we never see or store them. The app checks your subscription status with the App Store on your device; because it has no accounts, that status is not linked to a name, an email address or anything else identifying you, and it is not sent to us.
• Contacting support from inside the app: Settings ▸ Help & About ▸ Contact Support lets you write to us without leaving the app. When you tap Send — and only then; nothing is sent in the background — we receive the email address you enter, the message you write, and three technical details the form displays to you before you send: the app version, your iOS version, and your device model (for example “iPhone17,1”). That is the whole of it. Nothing is attached from your library: not your songs, your recordings, your journal notes or your artist name. Lawful basis: legitimate interests (responding to your enquiry). Delivery is by Formspree, Inc. (see §7), the same processor as the contact form on this site, and retention follows the contact-enquiry rule in §4. The email address is used to reply to you and for nothing else — it is never added to a mailing list, and the app has no accounts to attach it to.
• Third-party sharing: Our analytics provider, Aptabase, while the counts are switched on — processing them in the European Union (see §7) — and Formspree, only when you send a support message as described above. The other processors listed in this policy (Vercel, AWS, Twilio) are not used by this app. Nothing is sold, shared for advertising, or used to track you across apps or websites. The app does not use the IDFA or the App Tracking Transparency prompt, and never will.

If a future version adds a feature that processes data differently (for example, an optional AI feature), this policy will be updated before that feature ships, and any such processing will be clearly disclosed and opt-in.

4. How long we keep your data

• Contact form enquiries: retained in our inbox for up to 2 years, then deleted.
• Docket order records: retained for up to 3 years from the order date to support dispute resolution and shop accounting, then permanently deleted.
• Marketing consent records: retained until you withdraw consent.
• Red Moon Practice usage counts: these carry no account, device identifier or any other identifier, so there is no per-person record to retain or delete — only aggregate counts of how often a feature was used. Your own practice content is never sent, and stays on your device until you delete it.

5. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data (where no overriding legal basis applies)
• Object to processing based on legitimate interests
• Withdraw consent at any time (where consent is the lawful basis)
• Data portability (where processing is automated and consent- or contract-based)
• Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk

To exercise any of these rights, email us at hello@decooperations.co.uk. We will respond within one month.

6. Cookies and tracking

decooperations.co.uk does not currently set any cookies or use third-party analytics. If this changes we will update this policy and add a cookie notice.

Docket uses session cookies (HttpOnly, Secure) for staff authentication only. No cross-site tracking cookies are used.

7. Third-party sub-processors

8. Security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. If you have concerns, contact us at hello@decooperations.co.uk.

9. Changes to this policy

We may update this policy from time to time. Material changes will be noted at the top of this page with a revised “Last updated” date. Continued use of our services after a change constitutes acceptance of the revised policy.

10. Contact

Questions about this policy or how we handle your data: hello@decooperations.co.uk