Last updated: 23 July 2026 · Applies to thedessertdetective.com
Summary: We collect only what we need to run The Dessert Detective. We never sell your data. You can delete your account and all associated data at any time. We store data in the UK/EU on Supabase (hosted on AWS EU). If you have questions, email us at [email protected].
The Dessert Detective ("we", "us", "our") is the operator of thedessertdetective.com — a UK dessert shop discovery platform. For the purposes of UK GDPR and the Data Protection Act 2018, we are the data controller.
Contact: [email protected]
We are not currently registered with the ICO as we fall below the fee threshold, but we comply fully with UK GDPR obligations.
We only collect personal data that is necessary for the service. Here is a complete breakdown:
| Data | Why we collect it | Legal basis |
|---|---|---|
| Email address | Account login and communications | Contract (account registration) |
| Username | Display name on your account | Contract |
| Name | Personalise your experience | Contract |
| City / Country | Show relevant local content | Contract |
| Phone number | Optional — account recovery only | Legitimate interests |
| Password (hashed) | Authenticate you securely — never stored in plain text | Contract |
| Marketing preferences | To send or withhold marketing emails | Consent |
| Favourite shops | Show you saved venues | Contract |
| Submitted events | Display events you created | Contract |
| Last login timestamp | Security — inactive account detection | Legitimate interests |
| Data | Why we collect it | Legal basis |
|---|---|---|
| Business name | Display on the directory | Contract |
| Contact name | Account management communications | Contract |
| Email address | Account login and business communications | Contract |
| Phone number | Account verification and support | Contract |
| Password (hashed) | Authenticate you securely | Contract |
| Messages sent to us | Customer support communications | Contract |
| Promotion requests | Process paid promotions | Contract |
| Data | Why we collect it | Legal basis |
|---|---|---|
| Reviews (ratings, notes, up to 3 photos) | Displayed publicly on the shop page you reviewed | Contract / consent |
| Detective case files (incl. embedded video reel links) | Displayed publicly on your detective profile and the case page | Contract / consent |
| Favourites | Show you saved venues on your account | Contract |
| "I want this" item wants | Community demand signal, aggregated into anonymised counts shown to the business | Legitimate interests |
| Suggested edits / photo uploads | Improve listing accuracy — reviewed by us or the business before going live | Legitimate interests |
| Data | Why we collect it | Legal basis |
|---|---|---|
| Offer claims (unique code, claimed/redeemed status, timestamps) | Issue you a single-use claim code and let the business verify/redeem it in-store | Contract |
| Which offers you have claimed | Enforce one claim per account per offer | Contract |
| Data | Why we collect it | Legal basis |
|---|---|---|
| Email leads (newsletter) | Send dessert updates if opted in | Consent |
| Shop suggestions | Improve the directory | Legitimate interests |
| Shop claims | Verify business ownership | Contract |
| Reactions (likes on shops) | Community features — not linked to your identity if not logged in | Legitimate interests |
| PWA install/prompt events | Understand how people use the app — no personal identifiers | Legitimate interests |
| Google Analytics data | Understand site usage via anonymised analytics | Legitimate interests |
| Location data (GPS) | Show dessert shops near your current position on the Near Me map — only processed in your browser, never stored on our servers | Consent (browser permission) |
| Payment data (Stripe) | When paid features go live (business promotions, detective membership) — we never see or store your full card details; Stripe processes payment directly | Contract |
All personal data is stored on Supabase, hosted on Amazon Web Services (AWS) in the EU-West region. This keeps your data within the UK GDPR adequacy framework.
Our website is hosted on Netlify (US company with EU Standard Contractual Clauses in place). Static pages and CDN-cached content do not contain personal data.
Email notifications are sent via Resend (US company, SCCs in place). Emails are not stored permanently — they are sent and discarded.
Analytics are processed by Google Analytics 4 with IP anonymisation enabled. We do not use Google Analytics for advertising targeting.
We use Apify to gather publicly available listing information (e.g. Google Maps, Instagram) for shops that already exist independently of this collection — this does not involve your personal account data.
When paid features go live, payments will be processed by Stripe (SCCs in place) — we never see or store your full card details.
| Data type | Retention period |
|---|---|
| User account data | Until you delete your account, or 3 years of inactivity |
| Business account data | Until you delete your account, or 3 years of inactivity |
| Favourites | Until you delete them or your account |
| Events | Until you delete them or your account |
| Messages to us | 2 years from the date sent |
| Email newsletter leads | Until you unsubscribe |
| Reactions / likes | 90 days if not linked to an account; indefinitely if linked |
| Shop suggestions / claims | 2 years |
| PWA analytics events | 12 months |
| Google Analytics data | 14 months (GA4 default, configured by us) |
| Reviews and case files | Until you delete them or your account; kept if a case file forms part of the public record of a now-deleted account (anonymised) |
| Offer claims (codes, redemption status) | Kept indefinitely against the offer for business redemption stats — the code itself becomes void immediately if you or the business deletes the offer |
We do not sell, rent or trade your personal data to any third party, ever.
We share data with the following processors only to the extent necessary to run the service:
We may disclose data if required to do so by law, court order, or a regulatory authority. We would notify you of any such request unless legally prohibited from doing so.
We use a minimal set of cookies and local storage — for login sessions, basic functionality, and anonymised analytics. We do not use advertising cookies, tracking pixels or third-party remarketing tools.
For the full list of cookies, what each one does, how long it lasts, and how to manage your preferences, see our Cookie Policy — kept as the single up-to-date source so this notice can't drift out of sync with it.
You have the following rights regarding your personal data. To exercise any of them, email us at [email protected] or use the options in your account settings.
| Right | What it means | How to exercise it |
|---|---|---|
| Right of access | Request a copy of all data we hold about you | Email us — we respond within 30 days |
| Right to rectification | Correct inaccurate data | Edit in your account settings, or email us |
| Right to erasure ("right to be forgotten") | Delete your account and all personal data | Delete Account button in your account settings, or email us |
| Right to restrict processing | Ask us to pause processing your data | Email us |
| Right to data portability | Receive your data in a machine-readable format | Email us — we will provide a JSON export |
| Right to object | Object to processing based on legitimate interests | Email us |
| Right to withdraw consent | Withdraw marketing consent at any time | Account settings → Preferences, or email us |
We aim to respond to all requests within 30 calendar days. If a request is particularly complex, we may extend this by up to a further two months — we will inform you if this is the case.
We will only send you marketing emails if you have explicitly opted in (either at registration or in your account settings). You can withdraw consent at any time:
Withdrawing marketing consent does not affect transactional emails (e.g. password resets, account confirmations) which we send on the basis of contract performance.
You can delete your account at any time from your Account page. When you delete your account:
Deletion is irreversible. We cannot recover your account after deletion is processed.
The Dessert Detective is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
We may update this privacy notice from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We will notify registered users by email for significant changes.
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK's supervisory authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113
We would always appreciate the opportunity to address your concern directly before you contact the ICO — please email us first at [email protected].