Privacy

Who we are

The data controller is [Company name], [registered address]. Company number [company registration number]. ICO registration number [ICO registration number]. You can reach us through the contact form.

Accounts

If you list a firm you create an account with your name, email address and mobile number. Your password is never stored; we keep only a salted scrypt hash of it. Your name, email address and mobile number are not shown publicly.

Firm listings

A listing is public. It shows the firm name, logo, description, phone number, website, the postcode area and area covered, and any app links you add. A logo you upload is stored in our database and is public on your listing.

Messages, reports and enquiries

When you use the contact form or report a listing, we store what you send (your name, email address, phone number if you give one, and your message) and email it to our team so we can reply. A report is linked to the listing it is about.

When a firm applies for ads, we keep its chosen platforms, budgets, offer, notes and contact phone to run and invoice the campaign.

Cookies

We use one cookie, td_session. It keeps you signed in, is set only when you sign in, lasts 14 days, and is not readable by scripts on the page (httpOnly). It is strictly necessary, so no cookie banner is needed. We do not use tracking or advertising cookies.

The sign-up form keeps what you've typed (everything except your password and logo) in your browser's session storage (td-signup-v1) until you finish or close the tab. It never leaves your device until you submit the form.

On our server, sign-in sessions and the tokens in confirmation and password-reset emails are stored only as hashes. A sign-in session is deleted up to 7 days after it expires, and a used or expired email token 30 days after it was used or expired.

Statistics

To show firms how their page is doing we keep anonymous daily counters: page views, calls, app-link taps and website clicks, grouped by where the visit came from. When you tap an App Store or Google Play link on our site it goes through our own link first, so we can add one to the anonymous counter before sending you on to the store. Known bots are excluded. We do not store IP addresses or browser details with these counters.

Spam protection

To limit abuse of sign-in, sign-up and the forms, we store a keyed hash of your IP address with the time of each attempt, for 24 hours. The address itself cannot be read from it.

Who else is involved

• postcodes.io receives the postcode you type into search or sign-up. We send it from our server, not from your browser.
• Our email provider (Hostinger Email, over SMTP) delivers the emails we send, such as account confirmations and messages to our team.
• Our hosting provider (Hostinger) runs the site and its database.
• Apple App Store and Google Play: if you follow a firm's app link, you leave this site and their privacy policies apply.

How long we keep things

We keep account and listing data while the listing exists, and messages for [retention period]. Anonymous counters are kept for [retention period].

Your rights

Under UK GDPR you can ask to see the data we hold about you, correct it, have it erased, or object to how we use it. Use the contact form and we'll reply. You can also complain to the Information Commissioner's Office.

Deleting your listing

You can edit your listing at any time from your dashboard. Deleting a listing or an account is not something you can do yourself yet, so please ask us through the contact form and we'll do it.