Privacy Policy
Version 1.0 — effective 16 October 2026
1. Who is responsible for your data
The data controller is Noticed Sites, who operates Noticed Sites (noticedsites.com).
- Address: Noticed Sites, Pepys Court, Prestwood, Buckinghamshire, HP16 0QP, United Kingdom
- Email: support@noticedsites.com, which is also the contact for any privacy question or request
This policy explains how we use personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. The data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email, username, display name, password (stored only as a salted, one-way hash by our auth provider, Supabase; we never see it), avatar, bio, country, social links, theme preference | You |
| Organisation data | Organisation name, logo, website, team size, members and roles, invitations | You / org admins |
| Submission data | Website URL, title, descriptions, categories, technologies, credits (names and roles of people credited), screenshots, videos, alt text | You / other submitters crediting you |
| Payment data | Name, email, billing country, card brand and last 4 digits, wallet type, payment status, receipt numbers. Full card details are processed by Stripe, not us. | You / Stripe |
| Voting data | Your scores, the time you voted, whether you opened the live site, time spent in the scoring panel; round picks | You / your device |
| Integrity and security data | Salted hashes of IP addresses, their /24 network range and a device profile (user agent, language, platform), network (ASN) information, Turnstile results, fraud signals and vote weights, account creation time (used as an anomaly signal only) | Your device / our systems / Cloudflare |
| Community data | Favourites, follows, collections and notes, public voting profile setting | You |
| Newsletter data | Email, consent record (date, source, wording), engagement statistics (opens and clicks) | You / our email provider |
| Directory data | Listing content, subscription status, views and clicks on your listing | You / our systems / Stripe |
| Communications | Support and contact messages, reports and appeals | You |
| Analytics data (with consent) | Pages viewed, events, approximate location, device and browser, via Google Analytics cookies | Your device / Google |
| Technical logs | Error reports (Sentry, with personal data scrubbed), server logs | Our systems |
We don't collect special category data on purpose. Please don't include any in your content.
Badges on other websites: when a badge is loaded on another website, we receive standard request information. We don't set cookies or store IP addresses for badges. We only count impressions by site, day and referring domain.
3. Why we use it, and our lawful bases
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Creating and running your account and organisations | Contract |
| Taking submissions, running automated checks, publishing listings, running votes and awards, issuing badges and certificates | Contract |
| Taking payments, issuing receipts, managing saved cards and subscriptions | Contract; legal obligation (tax and accounting records) |
| Preventing vote manipulation and fraud, weighting votes, securing the Service, rate limiting, bot protection | Legitimate interests (fair and trustworthy awards, and security). We've completed a legitimate interests assessment. |
| Showing public profiles, credits, rankings and award histories | Contract (for your own profile); legitimate interests (accurately crediting people named on public work) |
| Public voting profile (showing your individual votes) | Consent, which you can withdraw at any time in Settings |
| Newsletter (The Noticed Weekly) | Consent (double opt-in) |
| Service emails (results, receipts, security, account notices) | Contract / legitimate interests |
| Google Analytics | Consent (via the cookie banner) |
| Speed tests (we send the submitted website URL to Google PageSpeed Insights) and URL safety checks (Google Web Risk / Safe Browsing) | Contract / legitimate interests |
| Handling complaints, reports, takedowns and legal claims | Legitimate interests; legal obligation where applicable (including the Online Safety Act 2023) |
Automated decision-making: our fraud systems automatically adjust vote weights and may flag or invalidate votes. These decisions affect awards but have no legal effect on you. A person reviews any account ban or disqualification, and you can ask for a human review of any integrity decision (support@noticedsites.com).
4. Who we share data with
We use these service providers (processors), who act on our instructions under data processing agreements:
| Provider | What they do | Location / transfer safeguard |
|---|---|---|
| Supabase | Database, authentication, file storage, background jobs | UK (London region); support access may be from other countries under UK IDTA / Addendum |
| Vercel | Website hosting and edge network | Functions in London; global CDN. UK–US data bridge / IDTA. |
| Stripe | Payments, saved cards, subscriptions, fraud prevention (Radar) | UK/EU/US. Stripe is also an independent controller for some of its own compliance and fraud purposes. |
| Our SMTP email provider | Sending all emails (account verification and password resets, results, receipts, winner kits) and the newsletter, through our own SMTP server | UK/EU |
| Google (Google Analytics 4) | Website analytics, only with your consent | US/EU. UK–US data bridge / IDTA. |
| Google (PageSpeed Insights API, Web Risk / Safe Browsing) | Testing submitted website URLs for speed and safety. Only the website URL is sent, not personal data about you. | US/EU |
| Cloudflare (Turnstile) | Bot protection on sign-up, login, voting and forms | Global. UK–US data bridge / IDTA. |
| Upstash | Rate limiting and counters (hashed identifiers only) | EU/UK region |
| Sentry | Error monitoring, with personal data scrubbed | EU/US. UK–US data bridge / IDTA. |
We may also share data with professional advisers, with authorities where the law requires it, or with a buyer if the Service is transferred (and we'd tell you).
What other people can see: your public profile, credits, published submissions, public collections, live and historic scores, and (only if you opt in) your individual votes once the voting window has closed.
We never sell your personal data.
5. International transfers
Where data goes outside the UK, we rely on UK adequacy regulations (including the UK–US data bridge for certified US companies), or on the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. Contact us for details.
6. How long we keep data
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account. Then it's deleted or anonymised within 30 days. |
| Published submissions, credits, awards, scores | Kept as a permanent public archive. If you delete your account, your votes are anonymised (kept as numbers with no link to you), so past results stay correct. Credits can be changed to a plain-text name on request. |
| Payment and tax records | 6 years after the end of the tax year they relate to |
| Integrity data (IP, subnet and device hashes, fraud signals) | Salted hashes of the IP address, its /24 network range and a device profile (browser type, language, platform) stored with each vote: 30 days, then deleted automatically. Vote flags (the rule, reason and evidence counts, no hashes): kept for as long as the vote counts towards an award period. Raw IPs are never stored with votes; they appear only in server logs for up to about 30 days. |
| Newsletter consent records | For as long as you're subscribed, plus 2 years as proof of consent |
| Support, reports and appeals | 2 years after closure |
| Original uploaded image files | 90 days, after which only the processed versions are kept |
| Raw speed-test reports | 12 months |
| Analytics (Google Analytics) | 14 months |
7. Your rights
You have the right to:
- access your data
- rectify inaccurate data
- erase it
- restrict or object to processing (including processing based on legitimate interests)
- data portability
- withdraw consent at any time (this doesn't affect processing that happened before you withdrew)
Many of these can be done yourself in Settings: download your data, delete your account, turn off public votes, and change cookie and newsletter choices. For anything else, email support@noticedsites.com. We'll respond within one month.
8. Complaints
If you're unhappy with how we've handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/, or 0303 123 1113.
9. Children
The Service isn't intended for under-16s, and we don't knowingly collect their data.
10. Security
We use encryption in transit, access controls (row-level security in our database), multi-factor authentication for staff, hashed identifiers for integrity checks, and we minimise the data we keep. No system is perfectly secure. We'll notify the ICO, and you where required, of qualifying personal data breaches.
11. Changes
We'll post changes here and update the date. If a change is significant, we'll tell you by email.