Privacy Notice

1. Who we are

The Dessert Detective (“we”, “us”) runs thedessertdetective.com, a UK directory of dessert shops. We are the data controller for the personal data described here, under UK GDPR and the Data Protection Act 2018.

[KAY: confirm you are exempt from the ICO data protection fee, or give your ICO registration number]

2. What we collect and why

You can browse the whole site without an account. We only collect personal data when you use a feature that needs it.

a) Site accounts

b) Business accounts and claims

Home sellers and sellers without a shop. If you don’t have a shop customers can walk into, we never show your street address, full postcode or exact location anywhere on the site, in our search results or in the information we give search engines. Your page shows only the area you choose (for example “Ealing, W13”), and maps show a shaded area of about a kilometre, not a pin. Customers get your address from you when they order. We still hold your full address privately so we can check your listing.

c) Reviews, quick reviews and items

Written reviews, photos and case files need an account and are shown publicly with your username. You can also leave a quick review (“Loved it”, “Good”, “Not for me”, with an optional short note) or suggest an item a shop sells with just an email address.

Markets. We list markets and the dessert stalls at them. Besides the form above, we read the public trader lists that market operators publish on their own websites and note each dessert stall’s business name and category (never photos or text). A stall only appears after our team checks it, and a stall can ask us to remove it at any time.

d) Saved lists and following shops

• Lists are private unless you make one public. A public list shows its name, description, the shops on it, your notes and your display name (your username, or your first name if you have no username). Anyone with the link can see it, and we may feature it on the homepage.
• When you follow a shop we email you a round-up of its new updates and offers: weekly, monthly or never, as you choose under Account, Following and alerts. Never more than one a week. Every round-up has a one-click unsubscribe.

e) Cake requests

Please read this before sending a cake request. We use your request to find bakers for you. If we forward it to bakers on your shortlist who manage their page on our site, each of those bakers receives: your name, email address and phone number (if given), the event, style, dietary needs, budget, date and time, collection or delivery and the delivery postcode, your description and the link to your inspiration photo. They may contact you directly. Bakers who haven’t claimed their page receive nothing; we may send you their details instead. To find bakers near you, our team may search Google Places for the area around your postcode; Google receives the search words and that area, never your name or contact details.

f) Offers

When you claim an offer we create a single-use code linked to your account so the shop can check it. We keep claims against the offer so the shop sees how many were used.

g) Other things you send us

h) Spam control and security

To stop abuse, forms record a hash of your IP address made with a secret key (not the address itself) for 24 hours. Signed-in sessions use a signed token kept in your browser’s local storage (not a cookie). It ends after a period without activity: 7 days for site accounts, 2 hours for business accounts.

i) Shop statistics

We count, for each shop and day, page views, direction taps, calls, website taps and saves to lists. These numbers carry no visitor identity. The shop’s owner sees them in the business portal and in a monthly summary email.

3. Our own visitor counts

As well as Google Analytics (only if you accept it), we keep our own simple counts so we know how the site is used by everyone. They work without cookies and store nothing on your device.

• Each page sends a small, anonymous count: the type of page, the website you came from (its domain only), any campaign tags in the link, whether you are on a phone, tablet or computer, and whether you are signed out, a member or a business.
• To count each visitor once a day, our server makes a code from your IP address and browser details using a secret key that changes every day. Only that code is stored, never your IP address. The codes are deleted after 48 hours, so you can’t be followed from one day to the next.
• If you are signed out we only keep totals per day. If you are signed in, we keep the time you were last active and totals of what your account has done (for example, reviews or saves), never a list of the pages you visited.
• Search terms are stored to show what people look for and what we’re missing. Before saving, we remove anything that looks like an email address or phone number and cut full postcodes to the first half (TW3 3LX becomes TW3). Search terms are kept for 90 days.
• Shop pages and case files also count a view for that shop or case, once per visitor per day, so the shop owner or the detective who wrote the case can see how many people looked. Only the daily number is kept.
• On market and where-to-buy pages we also count, as totals only: views of each market page, “Add to calendar”, taps on a market’s stalls, “Add your stall” requests, filters used, order-link taps and change reports. A place you search for on /markets or /delivered is kept only as its postcode district (W13) or town name, never a full postcode.
• Taps on the main buttons and links of each page (for example “Use my location” or a filter) are counted as totals per day, along with the part of the site you came from and went to next (for example from search to a shop page) and the kind of link that brought you (the bottom menu, a Google search). These are counts only: nothing joins them into a person’s journey and no code follows you from page to page.
• When the site lets you down we count that too, to fix it: a search with no results, nothing near the postcode district you chose, filters with no results, a page that wasn’t found (its address only), a link to a shop that doesn’t work, or a form you started but didn’t send (for four forms: claim a listing, add your stall, a cake request and a written review; we count starts and sends, nothing you typed).
• To compare today with yesterday “by this time”, the same totals are also kept per hour for 14 days.
• Search engines, bots and our own team are not counted. Daily totals are kept for 25 months.

4. Who we share data with

We never sell, rent or trade your personal data. We use these services to run the site, and give each only what it needs:

Transfers outside the UK: Netlify, Resend and Anthropic are based in the US. Netlify is certified to the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), with the standard contractual clauses and the UK International Data Transfer Addendum as a fallback. Resend uses the standard contractual clauses with the UK Addendum, and is also certified to the UK Extension. Anthropic uses the standard contractual clauses with the UK Addendum. Each is part of that provider’s data processing terms, which apply to our account.

Our team also uses Apify, outside the website, to collect publicly available information about shops (for example from Google Maps). It never receives your account data.

We may disclose data if the law, a court or a regulator requires it, and will tell you unless we are not allowed to.

5. How we use AI

We use AI (Anthropic’s Claude) to help write and check listings: shop summaries, short names for signature dishes, menu items read from menu photos, and first drafts of case files for our detectives to edit. It reads shop details, shop websites, the notes and menu photos sent with a shop suggestion, the text of a suggested edit, and detectives’ draft notes. Please don’t put personal details in those notes.

We also use it to suggest how a listing sells (a shop, market stall, home baker, delivery or post) from the details already on the listing, and to pick out the dessert stalls from markets’ public trader lists. Our team checks every suggestion before it changes a page.

AI is not used to make decisions about people. Claims, reviews, accounts and reports are decided by our team.

6. How long we keep data

7. The legal basis for each use

8. Cookies and storage on your device

We use only what the site needs to work, plus your own preferences, and Google Analytics only if you accept it. The full list, with each name, purpose and how long it lasts, is in our cookie policy. You can change your choice at any time with Cookie settings in the footer.

9. Your rights

To use any of these rights, email [email protected] or use your account settings.

We reply within one month. If a request is complex we may need up to two more months, and will tell you.

Published case files stay on the site after a detective deletes their account, but anyone, including the former detective or a person shown in a case file, can still ask us to remove their personal data from one (for example a face or a voice in a video). We decide each request on its own and may edit, blur or remove the case file.

10. Marketing emails and alerts

We only send marketing emails if you ticked the box (it is never ticked for you) or signed up for the newsletter. Round-ups about shops you follow go out only if you follow a shop, as often as you chose. To stop them:

• Use the one-click unsubscribe link in any marketing email or round-up
• Change it under Account, Settings (dessert news) or Account, Following and alerts (round-ups)
• Email [email protected]

Service emails (confirming your email, password resets, claim decisions, payment receipts) still go out, because the service needs them.

11. Deleting your account

You can delete your account at any time from your Account page. We then delete your profile (name, email, city, phone), your written reviews and photos, your lists, follows and alert choices. If you are a detective, your published case files stay on the site, credited to “a former Dessert Detective” (see section 9 to ask for personal data to be removed from one); drafts are deleted. Offer codes you claimed stay with the offer, without your account. Events you submitted are kept without your name or email. Quick reviews you left with your email stay on the shop pages without your name; email us from that address and we will delete them and the email too. We keep a record that an account was deleted, with the date and account type only, for 12 months. Deletion can’t be undone.

12. Children

The Dessert Detective is not for children under 13, and we don’t knowingly collect their data. If you think a child has given us personal data, tell us and we will delete it.

13. Changes to this notice

When we make important changes we update the date at the top and tell signed-in users. Old versions are available on request.

14. Complaints

If you are unhappy with how we handle your data, please tell us first at [email protected]. You can also complain to the UK regulator:

Information Commissioner’s Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113