Abreeze

Who we are

Abreeze is built and run by a single independent developer, not a large company. When this policy refers to "we", "us", or "Abreeze", it means the person responsible for running the service and, under UK data protection law, the data controller for the personal data described in this policy.

If you have any questions about this policy or how your data is handled, contact privacy@abreeze.co.

What we collect

We collect only what's needed to run the service:

Account details – your name, email address, and password (or passkey credential, if you sign in that way).
Access needs – the accessibility needs you add to your profile (for example, step-free access, hearing loop, or carer admission), and your Access Card ID if you provide one. This is special category data under UK GDPR (it relates to disability), and we only process it with your explicit consent – see your rights.
Outreach records – the requests composed and sent to venues on your behalf, and any reply a venue sends back.
Forwarded emails – ticket confirmation emails you forward to your Abreeze inbound address, so we can identify the venue and event and draft a request automatically.
Technical data – standard server logs (IP address, browser type, timestamps) kept briefly for security and debugging.

Your access needs are special category data

Because your access needs relate to disability, they're treated as a more sensitive category of personal data under UK GDPR. We only add anything to your profile when you choose to add it yourself, and doing so is treated as your explicit consent for us to process that data for the purpose of composing and sending accessibility requests on your behalf.

You can remove any access need, or delete your whole profile, at any time from your account – see your rights.

Why we use it, and on what legal basis

To provide the service (contract) – your account, profile, and outreach history exist so Abreeze can do the thing you signed up for.
To compose and send outreach on your behalf (your explicit consent) – your access needs are only ever included in a request after you've reviewed and chosen to send it, or after you've turned on automatic sending.
To keep the service secure and working (legitimate interest) – technical logs, rate limiting, and abuse prevention.

Venues – when you send (or auto-send) an outreach request, the access needs you've chosen to include, your name, and your Access Card ID (if set) are sent directly to that venue by email. This is the core purpose of the service, and it only happens for the specific venue and visit you're requesting arrangements for.
Resend, our email delivery provider, sends outbound requests and receives forwarded ticket emails on our behalf. Resend, Inc. is incorporated in the United States, but the email traffic itself is processed on servers located in Ireland – within the European Economic Area – under a standard data processing agreement.
Our hosting provider, to run the application itself.

We do not sell your data, and we do not share it with advertisers.

How long we keep it

We keep your account and outreach history for as long as your account is active, so you have a record of what's been requested and confirmed. If you delete your account, your personal data is deleted, other than what we're required to keep for a short period for legal or security reasons (for example, fraud prevention).

Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Correct anything that's inaccurate
Delete your account and personal data
Withdraw consent for us to process your access needs, at any time
Object to or restrict certain processing
Receive a copy of your data in a portable format

Most of this you can do yourself from your account page. For anything else, email privacy@abreeze.co. If you're unhappy with how we've handled your data, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

Cookies and analytics

We use two strictly necessary cookies: one to keep you signed in, and one to protect forms on the site from being submitted by anyone but you. Neither tracks you across other sites or is used for advertising, so neither requires a cookie consent banner under UK rules.

We may use privacy-focused analytics (such as Plausible) to understand overall traffic to the site. This kind of analytics doesn't use cookies and doesn't collect anything that identifies you personally – it only produces aggregate numbers, like how many people visited a page.

Children

Abreeze isn't intended for children, and we don't knowingly collect data from anyone under 16.

Changes to this policy

If we make a material change to how we handle your data, we'll update this page and, for significant changes, let you know directly.