In short
- The details you enter in the calculator (income, tax, hours, city, household) stay in your browser. We do not receive them.
- We count, without your details, which items are recommended or selected in each city, and clicks on business links.
- To count each visitor only once a day, we use a scrambled code of your IP address. We do not store the address, and we delete the code within 2 days.
- We do not sell your data or share it with other businesses. If we offer that later, it will be opt-in, and you will choose each time.
- Businesses that list with us have an account. We keep their email address private.
Who we are
TimeShop is run by [To confirm: legal entity name, company number and registered address]. We are the controller of the personal data described here. Contact: [To confirm: privacy email address].
What we collect, why, and for how long
| Data | Why | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Calculator and /earn inputs | They stay in your browser, in the page address after the # sign. Browsers do not send that part to us or to the businesses you visit. If you share the page address, the person you share it with can see your details. | Not collected | Until you close or clear the page |
| Counts: items recommended or selected in each city; clicks on business links | To show businesses where demand is, to show demand on /earn, and to estimate advert value. The counts hold only a city, an item and a number. | Not personal data | As long as they are useful |
| A scrambled code of your IP address (SHA-256 with a random salt that changes every day) | To count each visitor once a day and stop abuse of the counts. | Legitimate interests: accurate counts and abuse prevention | Deleted within 2 days, with the salt, so it cannot be linked across days |
| Business accounts: email address, password (stored only as a hash), business name, website, listings and their click counts | To run the business account, review listings and show approved listings. Business name, website, prices and strengths are public. | Contract | Until the account is deleted, then [To confirm: backup period] |
| Sign-in records for business accounts, including IP address | Security of accounts. | Legitimate interests: security | [To confirm: retention of authentication logs] |
| Server logs of our hosting providers (IP address, browser type, pages requested) | To run and secure the service. | Legitimate interests: security and operation | [To confirm: log retention at our hosting providers] |
Browser storage and cookies
We use no advertising or analytics cookies. If you sign in to a business account, your browser stores a sign-in token so that you stay signed in. This is strictly necessary for the service. [To confirm: whether any other storage or analytics will be used at launch]
Adverts
Businesses pay to list, and their listings are labelled “Advert”. Your browser, not our server, decides which options to show you, using what you entered. Payment does not change the ranking. When you click a business link, you go to that business's website, and its own privacy notice applies. The page address it receives does not include your calculator details.
Service providers
These providers process data for us, only on our instructions:
- Neon: database and business accounts (Neon Auth). Region: AWS US West (Oregon).
- Vercel: website hosting. Region: [To confirm: Vercel region].
- [To confirm: email provider for sign-up emails, if email verification is turned on]
Some providers are in the United States. Transfers from the EEA, UK or Switzerland use [To confirm: the EU-US Data Privacy Framework and/or Standard Contractual Clauses, per provider].
Your rights
Depending on where you live, you can ask to access, correct, delete, restrict or move your personal data, and object to processing based on legitimate interests. This includes the GDPR (EEA), the UK GDPR, the New Zealand Privacy Act 2020, the Australian Privacy Act 1988, and California law (CCPA/CPRA). We do not sell or share personal information, as the CCPA defines those terms. To use a right, email [To confirm: privacy email address]. We reply within one month.
Because we do not receive calculator inputs and keep only short-lived codes of IP addresses, we usually hold no personal data about visitors who do not have an account.
You can complain to your data protection authority, for example [To confirm: lead authority: e.g. the Irish Data Protection Commission, if the EU establishment is in Ireland], the UK Information Commissioner's Office, the New Zealand Privacy Commissioner or the Office of the Australian Information Commissioner.
Children
TimeShop is not for children under 16, and business accounts are for adults only.
Changes
If we change how we use data, we will update this page and its date. For any new use of data that is already collected, such as sharing with businesses, we will ask for new, separate consent.