Privacy Policy

Email address

When you sign up for launch notifications, we collect your email address.

Legal basis: Consent (GDPR Article 6(1)(a)) – you explicitly provide your email and tick a consent checkbox.

Analytics and usage data

We use Google Analytics 4 and Vercel Analytics to understand how visitors use this site. This includes:

• Pages visited and time spent on each page
• Device type, browser, and screen resolution
• Approximate location (city/region level, derived from anonymised IP)
• Referral source (how you found our site)
• User interactions (button clicks, scrolling behaviour)

Vercel Analytics: Cookieless and privacy-first. Collects aggregated, anonymised page view data without tracking individual users or using cookies.

Legal basis: Legitimate interest (GDPR Article 6(1)(f)) – we need to understand site performance to improve user experience. We've balanced this against your privacy rights by anonymising IP addresses and offering opt-out options.

Advertising data

We use Google Ads to promote GuardianScan. Google may collect:

• Whether you clicked on one of our ads
• Ad conversion data (if you sign up after clicking an ad)
• Cookie identifiers for ad personalisation

Legal basis: Legitimate interest (GDPR Article 6(1)(f)) – measuring advertising effectiveness is essential for a sustainable business model. You can opt out via Google Ads Settings.

We'll send you one email when GuardianScan launches (pre-launch phase only). After launch, we may occasionally send product updates, but you can unsubscribe at any time via the link in every email. We will never sell, rent, or share your email address with third parties for their marketing purposes.

We analyse site usage to identify popular features, fix bugs, and improve navigation. This helps us build a better product for developers.

We measure which ads and campaigns work so we can allocate our marketing budget effectively and reach the right audience.

Email addresses

• Storage: Supabase (PostgreSQL database, London region, UK)
• Security: Industry-standard encryption at rest and in transit (TLS 1.3). Access restricted to authorised personnel only.
• Retention: Stored until you unsubscribe or 30 days after product launch (whichever comes first). After that, permanently deleted from our systems and backups.
• Data location: UK only (ensures UK GDPR compliance and data sovereignty)

Analytics data

• Processor: Google LLC (Google Analytics 4)
• Data location: EU and US (Google operates under EU-US Data Privacy Framework and UK-US Data Bridge)
• IP anonymisation: Enabled – last octet of IP addresses removed before storage
• Retention: 26 months (Google's default), after which data is automatically deleted
• Transfer safeguards: Google's Standard Contractual Clauses (SCCs) ensure GDPR compliance for international transfers

Advertising data

• Processor: Google LLC (Google Ads)
• Data location: EU and US (same safeguards as Analytics)
• Retention: Up to 540 days for conversion tracking, 90 days for most ad cookies
• Transfer safeguards: Standard Contractual Clauses (SCCs)

These are required for the site to function and cannot be disabled:

• cookie-consent – stores your cookie preferences (1 year)

Cookieless analytics that tracks page views and performance:

• No cookies stored – uses ephemeral session tracking
• Privacy-first – no personal data collected
• GDPR compliant – no consent required (Recital 30)

Learn more: Vercel Analytics Privacy Policy

These track page views and user behaviour (requires consent):

• _ga – unique user identification (2 years)
• _gid – session identification (24 hours)
• _gat – throttles request rate (1 minute)

Opt out: Google Analytics Opt-out Browser Add-on

These measure ad performance and enable remarketing:

• _gcl_au – stores ad click information (90 days)
• IDE – ad personalisation (2 years)
• DSID – links activity across devices (2 weeks)

Manage preferences: Google Ads Settings

Request a copy of all personal data we hold about you. We'll provide this within 30 days, free of charge.

Correct any inaccurate or incomplete personal data (e.g., if your email address changes).

Request deletion of your data. Click "unsubscribe" in any email, or email us directly. We'll delete your data within 7 days.

Limit how we use your data while we investigate a complaint or accuracy issue.

Receive your data in a machine-readable format (CSV or JSON) to transfer to another service.

Object to processing based on legitimate interests (e.g., analytics or advertising). We'll stop processing unless we have compelling legitimate grounds.

Withdraw your email signup consent at any time via the unsubscribe link or by emailing us.