Privacy notice
The short version: we store as little as possible, and only after you have confirmed you asked for it.
Last updated: 28 October 2026
1. Who we are
Drop Radar is a trading name of POLICYANDPLAY LTD, a company registered in England and Wales (company no. 17253846). Registered office: 7 Cosford Drive, Shortstown, Bedford MK42 0DQ, United Kingdom. We are registered with the Information Commissioner's Office (ICO reg. ZC165321). POLICYANDPLAY LTD is the data controller for the personal data described here. "We" and "us" mean POLICYANDPLAY LTD. Contact: hello@dropradar.co.uk.
2. What we collect and why
| Data | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|
| Email address, alert scope and the page you signed up on, once you click the confirmation link | To send the restock alerts you asked for | Consent (you click the confirmation link) | Until you unsubscribe. After that we keep the bare address on a do-not-email list so you are not added again by mistake (legitimate interests), until you ask us to erase it |
| Email address, scope and timestamps of a sign-up you have not confirmed | To send one confirmation email and one reminder | Legitimate interests (completing a request you made) | Deleted after 7 days if you do not confirm |
| Email address, plan, subscription status, pass expiry, alert frequency and quiet-hours settings | To run your account, sign you in and decide what alerts you get | Contract | While your account is open, plus 30 days after you ask us to close it |
| Your shelf: items you watch, price caps and notify settings (only if you sign in) | To show the same shelf on every device and send the alerts you set | Contract | Until you delete the items or close your account |
| Payment records: your email, Stripe customer and subscription IDs, what you bought, amount, date and status. Stripe takes your card details; we never see or store them | To give you access, handle refunds and keep accounts | Contract; legal obligation (tax and accounting records) | 6 years. Unfinished checkout records are deleted after 30 days |
| A log of which alert emails we have sent to you | To stop us sending the same alert twice | Legitimate interests | While you are subscribed |
| Anonymous outbound click counts: which shop and item link was clicked, which part of the site, and a random ID for your browser session. No email address and no IP address | To see which shop links are useful and to keep the service running | Legitimate interests. You can switch this off, see our cookie policy | Up to 24 months |
| Messages you send us | To reply and keep a record | Legitimate interests | 2 years after the last message |
| Technical logs from our host: IP address, browser type, pages and times | Security and fixing faults | Legitimate interests | Up to 30 days |
We do not use your data for automated decisions that have legal or similarly significant effects on you. Alerts are matched to the scope or shelf you chose.
3. Marketing emails
Restock alerts are what you signed up for, and you join the list only after you click the confirmation link. If we tell you about Pro in an alert email, we do that on the basis of your consent or, if you are a customer, the "soft opt-in" for similar products. Every email has an unsubscribe link, and you can object to marketing at any time. Alerts you set up on your shelf are service messages and stop when you remove the item or close your account.
4. Who we share it with
We never sell personal data. These providers process it for us:
- Netlify (website hosting and the code that runs sign-in, sign-up and alerts; US).
- Supabase (database for subscribers, accounts and shelves).
- Resend (sends our emails, so it receives your address and the message; US).
- Stripe (takes payments for Pro and passes, and holds payment records; US). Stripe is also a controller for its own fraud and legal duties. See Stripe's privacy policy.
- Shops we link to. Product pictures load straight from the shops' own image servers, so those shops see your IP address. If you follow a link to a shop, that shop's own privacy policy applies.
We may also disclose data where the law requires it.
5. International transfers
Some providers are in the US. We rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
6. How long we keep it
The periods are in the table in section 2. When a period ends we delete the data or strip it of anything that identifies you.
7. Your rights
You can ask us for a copy of your data (access), to correct it (rectification), to delete it (erasure), to restrict how we use it, to move it to another service (portability), and to object to what we do on the basis of legitimate interests, including to direct marketing at any time. Where we rely on consent you can withdraw it at any time; the unsubscribe link in any email does this. You also have rights about automated decision-making; we do not make decisions of that kind. Email hello@dropradar.co.uk and we will reply within one month. To delete your shelf as well as your alerts, say so and it is gone, not just hidden.
8. Complaints
If you're unhappy with how we've handled your data, email hello@dropradar.co.uk with "Data protection complaint" in the subject. We'll acknowledge within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
Signup and purchase sources
To understand which pages and campaigns help customers, our private conversion report records signup requests, confirmed emails, account-watch additions and completed paid checkouts. It uses a pseudonymous code derived from your email to connect these actions, alongside the action page, form placement and available campaign or referring website name. It does not store your email, IP address, full referrer URL or search query in this report. We use this information to improve the service and retain conversion events for 90 days. You can object by contacting us.
Remembering a journey between pages is optional and requires your choice in cookie settings or beside a signup form. Journey details stay in this tab for up to 24 hours. Without this choice, each action captures only the source available on that page. The report connects recorded conversions using the pseudonymous code; confirmations and orders can use an earlier recorded signup or watch source. Missing information stays unknown.
9. Cookies and browser storage
We use a small number of cookies and browser-storage items to keep you signed in and remember your shelf. We run no advertising or third-party tracking. Details, and how to switch off anonymous click counting, are in our cookie policy.
Links to eBay on our stock pages are affiliate links. Clicking one takes you to their site with our partner ID in the address, and they may set their own cookies there to record that you came from us. A link to Hamleys marked "affiliate link" goes through Awin, an affiliate network, first: awin1.com records the click with our publisher ID and may set its own cookie, then sends you on to Hamleys. We do not send them your email address or any account detail. See disclosure.
10. Children
Drop Radar is not directed at children under 13 and we do not knowingly collect their data. If you think a child has given us their email address, contact us and we will delete it.
11. Changes
If we change this notice in a way that matters, we will update the date above and, where it affects your subscription or marketing, email you.