Privacy Policy

1. Who is responsible

Ball of String Limited, a company registered in England and Wales (company number 17133708), 165 Angelica Drive, London E6 6NT ("we") is the "controller" of the personal information described here, under UK data protection law (the UK GDPR and the Data Protection Act 2018). Contact us at hello@notonthefridge.com. [TO CONFIRM: ICO registration and the data protection fee.]

2. What we collect

• If you join our email list: your email address, when you joined, and the wording you agreed to.
• If you write to us through the Help page: your name (if you give it), your email address, and your message.
• When you visit: your internet address, browser and device type, and the pages you view, which our hosting and database providers see and log. We also count visits and which briefs are popular using Vercel Web Analytics, which uses no cookies and does not identify you or follow you between sites or visits.
• Cookies and similar storage, described in the Cookie Policy.
• If you are on our team: your sign-in details and a record of what you do in the admin area.
• We don't collect accounts, passwords, drawings or dates of birth from visitors.

3. Why we use it, and our legal reasons

• To email you once when accounts and posting open, if you joined the email list (your consent, which you can withdraw at any time).
• To answer your messages (legitimate interests, and to take steps you asked for).
• To keep the site working and secure, and to understand how it is used (legitimate interests).
• To meet legal duties and handle legal claims (legal obligation, legitimate interests).

4. Who we share it with

We use these companies to run the site. They handle your information only to provide their service to us:

• Vercel: hosting for the website. It runs from servers in several countries, so some processing may happen outside the UK.
• Supabase: the database that stores the briefs, the email list and Help messages. Our database is hosted in London, in the UK, under Supabase's data processing agreement.
• Resend: sends emails from us, including copies of Help messages to our team mailbox. Resend processes the data in Ireland (the EU), and transfers to the UK are covered by the UK's adequacy decision for the EU. Our data processing agreement with Resend is part of its terms.
• Cloudflare: a security check on our team sign-in page.
• Google: for our team's sign-in.
• Vercel also provides our website analytics (Vercel Web Analytics), described above. [TO CONFIRM: any separate email-list provider if one is added.]
• Social platforms (Instagram, Facebook, Threads, Bluesky): if you click a link to them or we show one of their posts on the site, they may collect information about you under their own policies. We only load their embedded posts if you have accepted cookies.

We don't sell your personal information.

5. Sending information outside the UK

Some of our providers may process information outside the UK. Where they do, we rely on the UK's approved safeguards, such as an adequacy decision or standard contractual clauses. [TO CONFIRM WITH REVIEWER: mechanism for each provider.]

6. How long we keep it

• Email list: until we have sent you the email that accounts and posting are open, and then we delete it; or sooner if you ask us to remove you.
• Help messages: 12 months after the last reply, then we delete them.
• Server and security logs: kept by our hosting and database providers for the period each of them sets.
• Records of our team's actions in the admin area: 12 months.

7. Your rights

You have the right to ask us to show you the information we hold about you, correct it, delete it, limit how we use it, move it to another service, or object to some uses, and to withdraw any consent you gave.

To use any of these rights, email hello@notonthefridge.com. We will reply within one month. We may need to check who you are first. If you are unhappy with how we handle your information, tell us first; you can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

8. Young people

You must be 13 or older to join our email list. If we learn that someone under 13 has joined, we will delete their information. If you are a parent or carer and think this has happened, please email us.

The briefs themselves are suitable for all ages and need no personal information. [TO CONFIRM WITH REVIEWER: whether the ICO's Children's Code applies to a site with no accounts, and any steps needed.]

9. Keeping your information safe

Our database restricts who can read what, private information is kept apart from public content, and admin access is limited. No service is completely secure; if there is a breach that puts your rights at risk we will tell you and the ICO as the law requires.

10. Changes

We will update this policy when we change what we do with information, and put the date at the top. If a change matters, we will tell you on the site or by email.