Last updated 1 January 2024

Privacy policy

This describes what the platform actually stores and why. The technical detail is accurate. The legal framing — lawful bases, retention periods, your controller and processor relationships — needs review by someone qualified before you publish it.

Draft — not yet reviewed by a solicitor

This document describes how the platform actually works, which is the part only we can write. It has not been checked by a qualified lawyer and it is not legal advice. Sections marked below need professional input before launch. See src/config/legal.ts.

Who we are

Needs a solicitor’s review

Parade Media Ltd, 1 Example Street, Marlow, SL7 1AA, United Kingdom, is the data controller for personal data processed through Parade. Contact us at support@parade.example.

If you subscribe as a business

Your name, email address, and business details, so we can operate your account and publish your listing.
Your card is handled entirely by Stripe. We never see or store card numbers; we store a Stripe customer reference.
The marketing source you arrived from (UTM parameters or an ad click ID), so we can tell which advertising works.
Records of what you submitted, when, and what we decided, so both sides have a record.

If you subscribe as a reader

Your email address and the city edition you chose.
Whether you opened an edition and which links you clicked, so we can report honest figures to the businesses in it.
Nothing else. We do not sell, rent or share the reader list, and there is a one-click unsubscribe in every email.

What we deliberately don’t collect

We do not store raw IP addresses. Where we need to distinguish between visitors — for rate limiting, and for de-duplicating impressions — we store a salted hash that cannot be reversed to an address.

We do not load any third-party analytics or advertising script unless the operator of this deployment has configured one, and none is required for the product to work.

Advertising platforms

Needs a solicitor’s review

If we run advertising, we may share hashed identifiers with the advertising platform to measure whether a campaign produced a subscription. This is described in the cookie policy and can be disabled by the operator.

How long we keep it

Needs a solicitor’s review

PLACEHOLDER. Set concrete retention periods for account data, analytics events, email logs and cancelled accounts, and have them reviewed.

Your rights

Needs a solicitor’s review

Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. Email support@parade.example and we will respond within one month.