Privacy notice
What we collect, why, where it is kept and for how long. We collect as little as the Service needs.
Last updated
Who is responsible
VapeRecord is the controller for the personal data described here. Contact [email protected] for anything in this notice.
What we collect
- Visits. Our servers keep standard request logs (IP address, time, page, browser) for security and debugging. Analytics use Plausible, which is cookieless and counts visits in aggregate without identifying you.
- Accounts, once they open: your email address, your name if you give it, your organisation and your role in it. Sign-in sets a session cookie that is needed for the account to work.
- Stock files you upload for a check. These are business records. If a file contains personal data, such as a staff name in a column, it is processed only to run your check.
- Billing, once paid plans open: handled by our payment provider. We store its customer and subscription identifiers, never card details.
- Messages you send us, including disputes.
We do not set advertising or tracking cookies, and we do not show a cookie banner because none is needed.
Public records about businesses
Records describe products and organisations, using what public registers publish. Where a register publishes a person's name, for example a sole trader's trading name, we show only what the register already shows, and we correct or remove it on request where the law requires.
Why we use it
- To run the Service and the checks you ask for (contract).
- To keep the Service secure and answer disputes (legitimate interests).
- To keep billing and tax records (legal obligation).
Where it is kept
Servers and storage run in the EU on Hetzner, behind Cloudflare. Where a provider processes data outside the UK or EU, transfers rely on the UK adequacy regulations, the Data Privacy Framework UK extension, or standard contractual clauses with the UK addendum. See Subprocessors for the list.
How long we keep it
- Files from a free check are deleted after 90 days.
- On a paid plan, your organisation can delete a file at any time. Line-level data is deleted when the account is deleted.
- Request logs are kept for 30 days.
- Billing records are kept for as long as UK tax law requires.
Your rights
You can ask to access, correct, export or delete your personal data, or object to how we use it, by emailing [email protected]. We answer within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.