Privacy policy

1. Who is responsible

The controller is AJ Wylie, trading as Needoh Alert, the service at NeedohAlert.com. For a privacy request, use Support inside the app. We aim to reply within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk. We would like the chance to put a problem right first.

2. What we collect

Account details, if you join:

• username;
• password, stored only as a salted hash, never as the words you type;
• UK mobile number, stored in full so we can text a code and stop the free week being used twice. The app shows other people, and your own account screen, only the end of the number;
• whether a free week or a paid plan is active, the plan type, and the dates it runs;
• a Stripe customer reference and subscription reference, if you pay. We do not store the card number, expiry or security code.

Security and messages:

• a sign-in session, kept in a secure cookie on that browser or Home Screen app;
• a short-lived text code, stored as a hash until it expires or is used;
• support messages and shop requests you send, with your username and the time.

Alerts, if you turn Phone alerts on:

• the push address and keys for that phone, so Apple or Google can deliver a notification while the app is closed;
• that phone’s alert choices, such as hidden items, shops, and whether you only want in-stock alerts.

On the phone itself, and not as a full copy on our account, the app can store your basket, recent alert list, display settings, and whether you have finished the tour. Those stay in the browser storage on that device until you clear them.

We also handle public product names, prices, pictures and links from shop websites, so we can show what they are selling. That is information about products, not about you.

3. Why we use it

We use this information to:

• create and protect your account, including the text code that checks the mobile number;
• run the free week once per number, and provide the stock checker you asked for;
• take payment, renew a monthly plan, and cancel it when you ask;
• send stock notifications you have switched on;
• read and answer support messages and shop requests;
• keep the service secure, stop abuse of the free week, and fix faults;
• meet tax and accounting duties for payments.

The legal reasons are: the contract with you; our legitimate interest in running a secure alert service and answering support; your consent for optional phone notifications and for the text that checks your number; and a legal duty where tax records are required. You can withdraw notification permission on the phone at any time. The account and the checks you already asked for can continue without phone alerts.

We do not use your number for marketing texts. We do not sell your information. We do not use it to build advertising profiles.

4. Who we share it with

We use other companies only to run the service:

• Stripe, to take card payments and manage a subscription;
• our text provider, to send the one-time sign-up code to your mobile;
• our database and hosting providers, to store the account and run the site;
• Apple Push Notification service and Google’s push service, to deliver a notification to a phone that has Phone alerts on.

A shop does not receive your Needoh Alert account. If you press checkout, you go to that shop’s own site. What you do there, including any account or payment you make with them, is covered by their policy, not this one.

We can also disclose information if the law, a court, or a regulator requires it, or if we must do so to protect the service or other people’s rights.

5. Where it is stored

We aim to keep account data in a secure database used for this service. Stripe, the text provider, Apple and Google may process some of that data outside the UK. Where they do, we rely on the UK rules for international transfers, including adequacy regulations or standard contractual clauses, as the provider makes them available.

6. How long we keep it

• Text codes are kept only until they expire or are used, and for a short time after so we can limit repeat attempts.
• The session cookie ends when you sign out or when the session expires, whichever comes first. A session can last up to 60 days.
• The account is kept while it is open, and then for a limited period so we can deal with a dispute, a chargeback, or a repeat free-week attempt.
• Push details are deleted when you turn Phone alerts off on that phone, or when the phone provider tells us the address is no longer valid.
• Support messages are kept long enough to handle the request and to see repeat problems.
• Payment references are kept for as long as UK tax and accounting rules need, which can be up to 6 years after the payment.

On-device basket and settings stay until you clear the site data or remove the Home Screen app’s data.

7. How we protect it

Passwords and text codes are hashed. The session cookie is HTTP-only, so a page script cannot read it. The account screen masks the mobile number. Staff access to the inbox is limited to operating the service. No method of storage is perfect. Please use a password you do not use anywhere else.

8. Your rights

Under UK GDPR you can ask us to:

• tell you what we hold about you and give you a copy;
• correct it;
• delete it, unless we must keep it for the law or a live dispute;
• restrict or object to certain uses;
• give you data you provided, in a portable form, where the law requires that;
• stop phone alerts, which you can also do on the phone and with the Phone alerts switch.

You can change your password in Account. To close the account or ask for a copy of your data, use Support and say it is a privacy request. We may ask you to confirm it is your number before we release or delete anything.

9. Cookies and storage on the device

We use one essential sign-in cookie so you stay signed in. It is not an advertising cookie. We do not use analytics or marketing cookies.

The app also uses the phone’s local storage for the basket, hidden items, alert switches, the tour, and a flag that this phone should receive alerts. That storage is required for those features. You can clear it in the browser or by removing the Home Screen icon’s website data. Clearing it can sign you out and empty the basket on that phone.

10. Children

Needoh Alert is a paid alert service for people buying from shops. It is not directed at children under 13, and an account should be opened by someone who is 18 or by a parent. Do not send us a child’s phone number.

11. Changes

We will update this page if the service changes what it collects. The date at the top will change. If a change is serious, we will also say so in the app. The current Terms of service explain the contract for using Needoh Alert.