Privacy policy

This policy explains how Redbridge Retail Ltd ("we", "us" or "our") handles personal data when you use the BODYVERSE mobile app and website. Our approach is simple: we collect only what your account and your progress need, and we ask before anything more.

1. Who is responsible for your data

Redbridge Retail Ltd, a private company limited by shares registered in England and Wales under company number 17469279, with its registered office at 19 Ruthin Gardens, Cardiff, CF24 4AU, United Kingdom, is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 and, where it applies to you, the EU General Data Protection Regulation (GDPR). You can contact us about privacy at hello@bodyvers.click.

When a school, college or university uses BODYVERSE under an Education licence, the institution decides how its students use the Service. In that case, the institution is usually the controller of its students' data and we process it on the institution's behalf, as set out in our agreement with it.

2. What we collect

• Account: your email address, your display name, the sign-in method you use and the account identifier your sign-in provider gives us.
• Game progress: levels, experience points, achievements, unlocked systems, bio-cards, mission and Daily Challenge results, streaks, leaderboard scores and your in-app settings.
• Device and diagnostics: device model, operating system, app version, language, IP address, crash reports and performance data, which we need to run the Service and fix problems.
• Analytics, only with your consent: how you use the app, for example which missions you start and finish. You can refuse, and you can withdraw consent at any time.
• Purchases: purchases go through the Apple App Store or Google Play. We receive confirmation of what you bought and the status of your subscription. We never see your card number or other payment details.
• Messages: if you contact us, your email address and what you write.
• Education licence: for students, their class and group membership, assignments and progress, which their teachers can see.

3. What we do not collect without your explicit consent

We do not collect biometric data, health data, camera images or your location unless you give separate, explicit consent for a specific feature. If a feature needs the camera, the app will ask for permission first and explain why. You can refuse, and you can withdraw permission at any time in your device settings.

Character stats such as Energy or Recovery, and Body Lab results, are game attributes, not measurements of your body. You do not need to share any information about your health to play.

4. The website

• The website is a static site. There is no account or sign-in on the website.
• The 3D atlas runs entirely in your browser. What you select or explore in the model is not sent to us.
• We do not use advertising or analytics cookies on the website. If we add analytics, we will ask for your consent first and update this policy.
• Our hosting provider processes technical data, such as your IP address, browser type, the pages you request and the time of each request, to deliver the site and protect it from abuse. These logs are kept for a limited period under the provider's own policies.
• Links to other sites, such as app stores or the BodyParts3D archive, are covered by those sites' own privacy policies.

5. Why we use your data, and our legal bases

• To provide the Service, including your account, saved progress, leaderboards and anything you have bought. Legal basis: performance of our contract with you.
• To keep the Service secure and working, including preventing cheating and abuse, fixing crashes and improving performance using diagnostics. Legal basis: our legitimate interests in running a safe and reliable game. You can object to this use (see section 10).
• For analytics. Legal basis: your consent, which you can withdraw at any time.
• For features that need sensitive data or device permissions, such as the camera. Legal basis: your explicit consent.
• To meet legal obligations, such as keeping accounting records or responding to lawful requests from authorities. Legal basis: legal obligation.
• To answer your messages. Legal basis: our legitimate interests, or our contract with you when your message is about your account or a purchase.

6. How long we keep your data

• Account and progress: for as long as your account exists. After you delete your account, we delete or anonymise this data within a reasonable period, except where we must keep some of it by law or to resolve disputes.
• Diagnostics and crash reports: for a limited period, then deleted or aggregated.
• Analytics: until you withdraw consent, and in any case only for a limited period.
• Messages: for as long as we need to deal with your request, and a reasonable time afterwards.
• Records we must keep by law: for the period the law requires.

7. Who we share your data with

We do not sell your personal data. We share it only with:

• Service providers (processors) that help us run BODYVERSE, such as hosting and cloud infrastructure, crash reporting and, with your consent, analytics. They act only on our instructions, under contracts that protect your data.
• App stores (Apple and Google), which process purchases and subscriptions under their own privacy policies.
• Sign-in providers, which handle sign-in under their own privacy policies when you choose to use them.
• Other players, who can see your display name and scores on leaderboards.
• Your teacher or institution, if you use BODYVERSE under an Education licence.
• Authorities, when the law requires it or when it is necessary to protect the rights, safety or security of our users or others.
• A buyer or successor, if all or part of our business is sold or reorganised, who must continue to protect your data in line with this policy.

8. International transfers

Our service providers may process data outside your country, including outside the European Economic Area (EEA) and the UK. When they do, we use the safeguards the law requires, such as adequacy decisions or standard contractual clauses.

9. Children

BODYVERSE is rated 16+, and you must be at least 16 to create your own account. Students under 16 can use BODYVERSE only through an institution with an Education licence, in kids mode, which collects only the minimum data needed for classes, assignments and progress. The institution is responsible for obtaining any consent the law requires, for example from parents or guardians.

If we learn that a child under 16 has an account outside kids mode, we will delete it. If you are a parent or guardian and think this has happened, please contact us.

10. Your rights

Depending on where you live, you have the right to:

• access your personal data and get a copy of it;
• have inaccurate or incomplete data corrected (rectification);
• have your data deleted (erasure);
• restrict how we use your data in certain cases;
• receive the data you gave us in a machine-readable format, or have it sent to another provider (portability);
• object to uses based on our legitimate interests;
• withdraw consent at any time, without affecting what we did before you withdrew it;
• complain to a data protection supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk); if you live or work in the European Economic Area, you can also complain to the authority in your country.

To use your rights, email hello@bodyvers.click. We may need to confirm your identity first. We will reply within one month, or tell you within that time if we need longer, as the law allows.

We do not make decisions about you with legal or similarly significant effects based solely on automated processing.

11. Security

We protect personal data with technical and organisational measures suited to the risk, such as encryption in transit, access controls and giving staff and providers access only to what they need. No system is completely secure. If a data breach affects you, we will inform you and the authorities as the law requires.

12. Changes to this policy

We may update this policy as BODYVERSE changes. We will publish the new version on this page with a new date and, for significant changes, tell you in the app or by email. If a change needs your consent, we will ask for it.

13. Contact

Questions and requests: hello@bodyvers.click. Post: Redbridge Retail Ltd, 19 Ruthin Gardens, Cardiff, CF24 4AU, United Kingdom.