Privacy Policy

Updated 29 October 2026. This notice explains how we use personal information for the Bron Yr Aur website, shop and Citizen Portal.

Who is responsible

Bron Yr Aur Creative Micronation Ltd, company number 16438385, operates these services and is responsible for the personal information described here. Our registered office is Unit 1 Dyfi Eco Parc, Machynlleth, SY20 8AX, United Kingdom.

Scott Roe handles privacy enquiries at [email protected] and by post at our registered office. Please use either route to ask about your information or exercise your rights.

Information we collect and why

• Purchases and citizenship: your name, email, contact and delivery details, application answers, citizenship tier, citizen number, honorary title where applicable, membership dates and order/payment references. We use these to process your purchase, provide your citizenship and administer your account under our contract with you or steps you request before purchase.
• Date of birth: we collect your full date of birth to check the stated minimum age of 17, and keep it as part of your private citizen record. Age information is self-reported; this is not independent identity or age verification. Maintaining and correcting the ongoing citizen record is our legitimate interest. You may contact us to question this use or request correction or erasure; we will assess your request and any continuing need to retain it.
• Your photograph: we use the photo you add in Your Citizen Space for your profile and citizen ID. An eligible citizenship, citizen number and completed profile, including a photo, are needed before an ID can be issued. You cannot replace an existing photo yourself; contact the team if it needs changing.
• Agreements: we record the wording and date of agreements accepted during an application. Older applications may include a drawn signature; new applications do not request one. We review older signatures separately from the evidence of the agreement.
• Service and security records: account access, credential verification, errors, correspondence and relevant transaction records help us run the service, prevent abuse and resolve problems. These uses rely on our legitimate interests in operating a secure service. We keep records required by tax and company law to meet our legal obligations.
• Optional communications: mailing-list subscriptions, a social-media welcome and any public citizen listing require their own permission. Buying citizenship or acknowledging this notice does not subscribe you to marketing. You can unsubscribe from marketing emails or contact us to withdraw an optional permission.

Required fields are identified on the relevant form. Without the information needed for an application or purchase, we may be unable to complete it. Please do not include health information or other sensitive information in free-text answers unless we have specifically agreed a suitable way to handle it.

Who can see citizen information

Your account details, birth date, delivery address and application answers are private to you and authorised staff who need them. They are not shared with fellow citizens simply because they can sign in.

Any Citizen Registry made available to fellow citizens is restricted to authenticated citizens. A public name-and-honorary-title listing requires separate, optional permission. Registry participation, a social-media welcome and the Founder stone-engraving benefit are distinct purposes. No general registry agreement is treated as permission for public online publication.

Authorised Government Office staff can verify an ID and view the citizen name, portrait, number, title and current membership details needed for that check. This access does not give them the private application or date of birth.

Citizen voting

When you vote in the portal, we check your active citizenship tier and citizen number. A separate participation register records your account, citizen number and the ballot you took part in so that each citizen can submit only once. Running fair citizen participation and preventing duplicate submissions are our legitimate interests. Administrators can review that participation register.

The voting feature adds selections to combined answer totals without retaining individual ballots or linking selections to an account. It does not put choices in your profile, ID, email or marketing records. Individual selections cannot be retrieved, changed or removed from those totals after submission. Citizen results stay inside the portal and are released only after voting closes and the ballot’s selected rule is met: release at closing, on a specific date, or after administrator approval. Administrators may privately review closed results before citizen release. Totals for fewer than five participants are not displayed. Small groups, unanimous outcomes and server or database access can nevertheless make choices inferable. This is not a guarantee of anonymity against a compromised server or its operator.

Where a ballot offers optional reasons or suggested amendments, you may submit up to 3,000 characters. Feedback is stored separately with the ballot reference and a random record key, without your account, citizen number, choices, submission time or an identifier shared with participation. Government Office staff can read it after closing with at least five participants; it is not automatically published or included in aggregate results exports. The words themselves may identify you or others, so avoid names, contact details and identifying stories. We cannot retrieve feedback by account. Contact the Government Office with enough detail to locate any identifying text that needs review. Written feedback is retained only while needed to consider the proposal, amendments and related challenges; staff review it before any wider sharing.

Participation records are reviewed separately from the full citizen profile. They are needed while a ballot is open to prevent duplicate voting, and afterwards only while necessary to administer or resolve a challenge to that ballot. Contact us to request your participation information or its removal; a staff review considers the continuing need and prevents an erasure from inadvertently allowing another vote. Hosting security logs and backups follow their separate retention arrangements. Read How voting works inside the portal before submitting.

Digital ID downloads and Apple Wallet

Your date of birth is not included on the digital ID, in Apple Wallet or in a member/public listing. A downloaded ID contains the information visible on the card. A signed PNG also contains metadata used to check its authenticity and current status. Signing does not encrypt the image or stop copying: anyone you share the file with can read its visible information and embedded metadata.

Apple Wallet is optional. Adding a card registers pass and device identifiers and a notification token so we can deliver updates. Apple receives the notification token and an empty update notification; the updated signed card is fetched from our portal. Wallet passes are associated with your Apple Account, and Apple may receive pass information to display and manage them under its Wallet privacy notice. Remove the card to stop its device registration, or contact us for help.

Our service providers

We do not sell your personal information. We use selected services to operate the website:

• WP Engine: website hosting, backups and operational security.
• Cloudflare: domain/DNS services and, where enabled, network delivery and protection.
• Stripe: payment processing and related fraud prevention. Card details are entered through Stripe’s payment service; we retain order and payment references rather than your full card details.
• Resend: service emails such as account access, password resets and purchase messages.
• Mailchimp: mailing-list subscriptions and communications you choose to receive.
• Apple: optional Wallet cards and update notifications.
• CookieYes: recording and applying cookie preferences. The site-managed GTranslate service is limited to public information pages; it is kept off signed-in pages, applications, account screens and checkout.

We share delivery information with the people or carriers fulfilling your order, and may disclose information where required by law or necessary to deal with a legal claim. Payment and platform providers may also act as independent controllers for their own services, security or legal obligations.

Some providers and their support/subprocessor operations are outside the United Kingdom, including in the United States. A European email-sending region does not mean all associated processing stays in Europe. Provider data-processing arrangements address international transfers using applicable adequacy arrangements or contractual safeguards, including Standard Contractual Clauses and the UK Addendum where relevant. Contact us for information about the safeguards applicable to your data.

Cookies and optional features

Essential cookies support sign-in, cart/checkout, security and your privacy choices. Use the cookie-preference control to review or change optional categories. Optional analytics, advertising or embedded services must follow your choices where consent is required. Withdrawing a cookie choice does not remove information already lawfully processed. A browser’s own translation feature is controlled by you and your browser provider, separately from this website.

How long we keep information

• Active citizenship: we keep the information needed to provide and administer it. An active lifetime Founder membership is not treated as an expired term membership.
• Expired Associate or Companion citizenship: we keep the profile, photo and application answers for a 12-month renewal window after expiry, then review and remove information no longer needed. A renewal, another active membership, a dispute or a legal duty is checked first. You can still make an earlier erasure request.
• New applications never purchased: personal answers are reviewed for removal after 90 days. Paid applications, unresolved payment disputes and historical Founder records are excluded from that automatic age-based selection. A “failed” order label alone is not proof of non-payment.
• Purchase and accounting records: records required for company accounting are generally kept for six years from the end of the financial year concerned, and longer where a specific legal reason requires it. This does not justify keeping the whole citizen profile or photo for that period.
• Marketing: subscription information is used until you unsubscribe or it is no longer needed. A limited suppression/permission record may be kept to honour your choice and demonstrate how it was obtained.
• Credentials and citizen numbers: we keep only the records needed to avoid reissuing a number and establish whether an issued credential remains valid or has been revoked. This is reviewed separately from the full profile.
• Correspondence, logs and working copies: we review these for the service issue, security need or claim they support and remove them when that purpose ends. Privacy exports are temporary; WordPress normally expires generated export files after three days.

Backups rotate under the hosting and email providers’ schedules rather than being edited immediately each time a record is removed. Information awaiting expiry in a backup is kept out of normal use; if a backup is restored, completed removals must be reapplied. We record necessary exceptions and review them instead of keeping every record indefinitely.

Your rights

Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your information, object to processing based on legitimate interests, and withdraw consent for optional uses. Withdrawing consent does not affect earlier lawful processing. We may need proportionate information to verify the request; we will explain any applicable exception or continuing retention need.

We normally respond within one month, subject to the rules for clarification or complex requests. Contact [email protected]. You may also complain to the UK Information Commissioner’s Office or the relevant supervisory authority where you live.

We use checks for age eligibility, payment completion, membership access and credential validity to operate the service. If you think one of these checks is wrong, contact the team for a review. We do not use citizen applications to make automated decisions with legal or similarly significant effects.

Changes to this notice

We will update this page when our practices change and take further steps to explain material changes where needed. The dated wording accepted with an earlier application remains part of that agreement record; it is not silently rewritten when this page changes.