In brief
The short version
The scanner collects nothing. Your spreadsheet is read and checked inside your own browser and is never sent to us or to anyone else. We do not see your products, your suppliers, your SKUs or your file. You can disconnect from the internet after this page loads and the scanner still works.
The only thing we ever collect is an email address you type into the waitlist form, and only if you choose to.
Controller
Who is responsible
__CONTROLLER_NAME__ (postal address available on request — write to __CONTACT_EMAIL__) is the data controller for the waitlist. Questions, or any request below: __CONTACT_EMAIL__.
The check
The scanner
The compliance check runs entirely in your browser. Your file is read with your browser's own file reader, checked against a list of requirements downloaded as a static file, and displayed. Nothing about the file is transmitted, logged, stored or profiled, and we could not retrieve it if we wanted to.
Our hosting provider records ordinary web-server information when your browser requests a page — IP address, time, which files were requested — as every web server does. We use that only to count how many checks are run and for which markets. It is not linked to any email address and we do not attempt to identify anyone from it.
The scanner sets no cookies and contains no analytics, advertising or tracking scripts. Our build process checks this automatically and refuses to publish a version that could transmit your file.
The list
The waitlist
What we collect: your email address, and an approximate SKU count if you choose to give one.
Why: to send you the monthly compliance-change digest you asked for, and to tell you when the full product is available.
Lawful basis: your consent, given by ticking the box on the form. You can withdraw it at any time, and withdrawing it is as easy as giving it — use the unsubscribe link in any email, or write to us.
How long: until you unsubscribe, or after two years with no engagement, whichever comes first. Then it is deleted.
What we never do: sell your address, share it for anyone else's marketing, or add you to anything you did not ask for.
Processors
Who else processes your email address
We use Cloudflare to host this site and to store the waitlist, in a database created to keep data in the European Union. Cloudflare, Inc. is established in the United States; the database itself runs and stores data only in the EU, though Cloudflare's infrastructure can access it from elsewhere to operate the service.
This is an interim arrangement while a dedicated mailing-list provider is set up. We do not currently record whether digest emails are delivered or opened. Digests are sent to each address individually, and every one carries its own working unsubscribe link.
Your rights
What you can ask us to do
Under the UK GDPR and the EU GDPR you may ask us for a copy of the personal data we hold about you, ask us to correct or delete it, object to or restrict how we use it, ask for it in a portable form, and withdraw consent at any time. Since the only thing we hold is an email address and an optional SKU count, most of these come down to one action, and we will do it without argument.
Write to __CONTACT_EMAIL__. We will respond within 30 days.
If you think we have handled your data badly you can complain to a supervisory authority — in the UK the Information Commissioner's Office, in the EU the authority for the country you live in. We would rather you told us first, but it is your right either way.
Updates
Changes
If this notice changes materially we will update the date at the top, and tell waitlist subscribers in the next digest rather than changing it quietly.