This page describes what we collect, why, how long we keep it, and how to exercise your rights under UK GDPR.
The data controller is Lucid ICT Limited, a company registered in Scotland (company number SC760973), registered office Aves Business Centre, 11 Jamaica Street, Aves House, Greenock, Inverclyde, PA15 1XX.
Your email address and the display name, role and company size band you give us; an account's country; the content of any review, price report, claim or flag you submit; sign-in sessions, each with a hashed identifier, the time it was created and last used, a hashed IP address and a browser identifier; and, if you manage a vendor's listing, that link between your account and the vendor.
Running your account, publishing a review or price report you chose to submit, and running a sponsorship you bought: contract. Moderating content, preventing fraud and abuse, rate-limiting sign-in and submissions, and keeping security and audit logs: legitimate interest. We do not send marketing email, so nothing on this site is processed on the basis of consent.
A magic sign-in link is kept for 48 hours, whether or not it is used, then removed. A session is removed once it expires. Records of Stripe billing events are kept for 90 days. Everything else tied to your account is kept for as long as the account exists; deleting your account is described below.
There is no password anywhere on this site. A sign-in link contains a random token; we store only its SHA-256 hash, never the token itself, so a copy of the database cannot be used to sign in as you. A link works once, expires after 15 minutes, and is tied to what it was issued for.
To enforce one review and one price report per person per product, and to spot the same person creating repeat accounts, we compute a keyed hash of your canonicalised email (HMAC-SHA256 with a secret held only on our server) and store that hash alongside the review or price report instead of your address. If your account is later deleted, the content and its hash stay, marked as posted by a former member, but the hash cannot be reversed back to an email address. This is processed under legitimate interest in preventing abuse of the review and pricing systems.
You can ask to see the data we hold about you, correct it, have it erased, restrict or object to processing, or receive it in a portable format. Export and deletion are available from your account once you are signed in. If you are unhappy with how we have handled a request, you can complain to the Information Commissioner's Office at ico.org.uk.
For anything on this page, write to [email protected].
