Privacy Policy

DRAFT. Not legal advice. Chris Kirby must review this, ideally with a solicitor check, before going live. Items in [brackets] need completing.

Last updated: [date] (draft revised 13 October 2026: newsletter section added)

Controller: Chris Kirby, a sole trader operating Tidy Cyber (tidycyber.co.uk). Contact address: Chris Kirby, trading as Tidy Cyber, 9 Appledore Road, Brighton, BN2 4PT. Contact: [email]. ICO registration number: [ZAxxxxxxx] (data protection fee paid).

What we collect - Your email address and the domain(s) you submit. - Scan results: public DNS, certificate and HTTP header information about the domain you check. A free check of a domain you don't own only processes information that domain already publishes publicly. - Payment details are handled by Stripe. We receive only limited details (name, email, billing country, last 4 card digits), never full card numbers. - Basic server logs (IP address, time, pages requested) for security, kept for up to [30] days. - Free check log: for each free summary check we record the domain checked, the time, and a keyed hash of your IP address (not the IP itself), so we can enforce fair-use limits and spot abuse. Kept for [90] days.

Why we use it, and our lawful basis (UK GDPR Art. 6) - To provide checks, reports and monitoring alerts: contract. - Payments, invoices and accounting records: legal obligation (HMRC requires business records to be kept for 6 years). - Security, fraud and abuse prevention, including the free check log and rate limits: legitimate interests (keeping a free service available and preventing misuse). [Chris: record a short legitimate interests assessment.] - The monthly security tips newsletter and any other marketing emails: only with your consent (UK GDPR Art. 6(1)(a) and PECR reg. 22). You can withdraw consent at any time. See below.

Who we share it with (processors): Stripe (payments), Fly.io (hosting), Supabase (database), Resend (email delivery, once enabled) [confirm processors], and Google Public DNS (domain lookups only; no personal data). Some processors are outside the UK. Transfers rely on UK adequacy regulations or the International Data Transfer Addendum.

Retention: scan results for 12 months after your last activity; subscription records for the life of the subscription plus 6 years (accounting).

Monthly security tips newsletter

• How you sign up: only by ticking an unticked box ("Send me the free Tidy Cyber monthly security tips") on our website and then clicking the link in the confirmation email we send you (double opt-in). Until you confirm, you won't get any newsletter.
• What we record: your email address; the date and time you ticked the box and when you confirmed; where you signed up (results page, home page, blog or site footer); the exact wording you agreed to; and a keyed hash of your IP address (not the IP itself) as evidence of consent and to prevent abuse.
• Optional personalisation: if you sign up from a free check results page using the same email you checked with, we also store that domain, its latest score and how many high-priority issues it had, and update them when you run a new free check. We use this only to add a short "your domain" reminder to the newsletter. We don't store or use another person's check.
• What we send: about one email a month with security news, practical tips and occasional mentions of Tidy Cyber's own checks and plans. We don't sell or share your details with other marketers.
• Unsubscribing: every email has a one-click unsubscribe link (and supports your email app's built-in unsubscribe button), plus a page where you can unsubscribe or delete your details. You can also email [email].
• Retention: unconfirmed sign-ups are deleted after 30 days. If you unsubscribe, we delete the optional personalisation data and the IP hash and keep only your email address, the unsubscribe date and your original consent record on a suppression list, so we never email you again by mistake and can show what you agreed to. Choose "delete all my newsletter data" (or ask us) to remove that too. Active subscriptions are kept until you unsubscribe; [we'll ask inactive subscribers (no opens for 24 months) whether to stay subscribed - confirm].
• Email service: newsletters are sent through our email provider (Resend [confirm]), which processes your email address on our behalf.

Your rights: access, rectification, erasure, restriction, objection and portability. Contact [email]. You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Cookies: we use only strictly necessary cookies. Stripe sets its own cookies on the checkout page. [Update if analytics are added.]