Privacy policy

The short version

No cookies are set.
No advertising and no third-party trackers are run.
Data is never sold, rented or shared for marketing.
Visits are measured with a tool that uses no cookies and does not identify the visitor.
The only personal detail requested is an email address, and only if a visitor chooses to join the newsletter.
A visitor can ask to see or delete their data at any time.

Who runs this site

This site is run by The Centre for Digital Consumers, a UK non-profit that is not a registered charity. Under data protection law the Centre is the ‘data controller’, which means it is responsible for a visitor’s information. It can be reached about anything on this page at privacy@cfdc.org.uk.

This policy is governed by UK data protection law: the UK GDPR and the Data Protection Act 2018.

What the site collects, and why

When someone visits the site

The hosting provider, Vercel, processes basic technical information every time a page loads: the device’s IP address, the browser and device type, the pages requested and the time they are requested. This happens for every website anyone visits. It is how a server returns a page and keeps the site secure and online. The legal basis is a legitimate interest in running a safe, working website. Vercel keeps these access logs only for a short period.

How visits are measured

Vercel Web Analytics is used to understand roughly how many people visit and which pages they read. It uses no cookies, builds no profile, and does not follow visitors to other sites. Figures are aggregated and cannot be traced back to an individual. The legal basis is a legitimate interest in understanding whether the work is useful.

When someone subscribes, the email address is collected and used for one thing: to send the monthly digest requested. The address is stored by the email provider, Buttondown, who send the emails on the Centre’s behalf. Tracking of opens and of which links are selected is turned off, so emails carry no tracking pixels and there is no record of whether an email was opened or what was selected in it.

The legal basis is the subscriber’s consent, given by subscribing. It can be withdrawn at any time through the unsubscribe link in every email, or by emailing. When someone unsubscribes, the address is removed.

The free tools

The free tools are built to work without an account and without storing what is entered. If a specific tool ever needs to handle information differently, it says so at the point of use.

The chat assistant sends messages to an AI service and does not store them. People are asked not to enter personal details.

Cookies

No cookies are used for analytics, advertising or anything else. Because there are no cookies, there is no cookie banner.

Who else can see the data

Information is not sold, rented or traded, and is never shared for anyone else’s marketing. Two service providers are used to run the site, and they only handle data in order to provide their service.

Vercel hosts the website, provides the visitor analytics described above, and through its AI Gateway passes chat messages to a model on Amazon Web Services. These are not stored, though the provider may hold them briefly to guard against misuse.
Buttondown stores newsletter subscribers and sends the digest.

These providers are based in the United States, so using them involves transferring data outside the UK. Where that happens, the transfer is covered by the safeguards UK law sets for international transfers, such as the UK’s International Data Transfer Agreement or standard contractual clauses. Information can also be disclosed if the law demands it.

How long things are kept

Newsletter email: kept until the reader unsubscribes, then removed.
Server logs: kept by the host for a short period, then deleted.
Analytics: only aggregate figures are kept, so there is no personal record to hold.

Data protection rights

Under UK data protection law, a person can ask the site to:

be told what data is held about them, and be given a copy
have anything wrong corrected
have their data deleted
restrict or object to how it is used
withdraw consent to the newsletter

To exercise any of these rights, a person can email privacy@cfdc.org.uk. A response comes within one month, and it is free.

Complaints

If a reader thinks their data has been handled badly, they should tell the site first so it can be put right. There is also the right to complain to the UK regulator, the Information Commissioner’s Office, at ico.org.uk.

Changes to this policy

If the way data is handled changes, this page is updated. If the change is significant and an email address is held, the reader is told.