Privacy policy

Assaylist is an independent business-software review and comparison site for the United Kingdom, published at assaylist.uk.

The data controller for the personal data described in this policy is the operator of Assaylist, of London, United Kingdom. The registered entity details are being finalised and will be published here before the site begins trading commercially.

Our registration with the Information Commissioner's Office is in progress and the registration number will be published here once issued.

For any question about this policy or about how we handle your data, write to hello@assaylist.uk. We aim to respond within two working days, and we are required to respond substantively to a data subject request within one month.

We collect only what a specific feature of the site needs in order to work.

• Newsletter subscribers. Your email address, the interest topics you chose, the exact consent wording you agreed to, the page you subscribed from, your browser's user-agent string, and a salted one-way hash of your IP address as evidence of consent.
• Contact messages. Your name, email address, the topic you selected, your message, a salted hash of your IP address and your user-agent string.
• Reviews you submit. The name, job title, company, industry and company size you choose to give, your ratings and written review, and a salted hash of your IP address (used to rate-limit submissions and detect spam).
• Affiliate click records. Only if you have agreed to the affiliate cookie category: which product you clicked through to, when, a salted hash of your IP address, your user-agent string, the referring page and a country code.
• Cookie consent records. Your choices, the version of this policy they were made against, the page you were on, and a salted hash of a randomly generated visitor identifier — not your IP address.

We never store a raw IP address. Every IP address is passed through a salted SHA-256 hash before it is written. The salt is a secret held outside the database, and it is rotated annually, which breaks the ability to correlate records across periods.

Under Article 6 of the UK GDPR we rely on the following:

• Consent (Art. 6(1)(a)). Newsletter emails, analytics cookies and affiliate tracking cookies. You may withdraw consent at any time, and withdrawing it is as easy as giving it.
• Legitimate interests (Art. 6(1)(f)). Responding to your contact enquiry, publishing and moderating user reviews, and protecting the site from spam and abuse. We have assessed that these do not override your rights and freedoms; you may object at any time.
• Legal obligation (Art. 6(1)(c)). Retaining consent records so we can demonstrate compliance with PECR and the UK GDPR.

Strictly necessary cookies run without consent because the site cannot function without them. Nothing else loads until you have made a choice — analytics and affiliate scripts are not merely hidden before consent, they are not requested at all.

Full detail of each cookie, and a link to reopen the preferences panel, is in our cookie policy.

We do not sell personal data and we do not share it for anyone else's marketing. We use the following processors, each under a written data-processing agreement:

• Supabase — database and file storage. Our project is hosted in the London (eu-west-2) region, so the primary store holds UK-resident data.
• Vercel — application hosting and serverless functions, configured to run in the London (lhr1) region.
• Google Analytics 4 — website analytics, loaded only with your consent, with IP anonymisation enabled.
• Our transactional email provider — newsletter confirmation and administrative notifications.
• Affiliate networks we have joined, which set their own tracking when you click an affiliate link and you have consented to that category. Each network is an independent controller for its own tracking.

Our database and application functions are hosted in the United Kingdom. Some of our processors are US-incorporated companies whose support and engineering staff may access data from outside the UK.

Where that happens, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the supplementary technical measures described in this policy — principally that IP addresses are stored only as salted hashes and that we hold no special-category data.

Personal data is kept no longer than necessary. Our retention schedule is enforced by a nightly automated purge, not by memory:

• Affiliate click records — 14 months, then deleted.
• Contact messages — 24 months from receipt, then deleted.
• Unsubscribed newsletter records — 24 months from the date you unsubscribed, then deleted, except for a one-way hash of your address kept on a suppression list so you are not added back by mistake.
• Newsletter sign-ups never confirmed — 30 days, then deleted.
• Cookie consent records — 24 months, then deleted.
• Reviews submitted but never moderated — 12 months, then deleted.
• Administrative audit logs — 24 months, then deleted.
• Published reviews — kept indefinitely as public editorial content, subject to your right to erasure below.

Under the UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Rectify data that is inaccurate or incomplete.
• Erase your data where we no longer have a lawful reason to keep it.
• Restrict our processing while a dispute is resolved.
• Portability — receive your data in a machine-readable format.
• Object to processing carried out under our legitimate interests.
• Withdraw consent at any time, without affecting processing already carried out.

To exercise any of these, email hello@assaylist.uk. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

If you ask us to erase a published review, we remove or anonymise the identifying content — the reviewer name becomes “Former user” and the job title and company are cleared — while keeping the numeric rating, so that the product's aggregate score remains an honest record of what reviewers actually said.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain directly to the UK supervisory authority at any time:

• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline: 0303 123 1113
• ico.org.uk/make-a-complaint

When we make a material change we update the effective date at the top of this page and increment the policy version recorded against cookie consent — which means you will be asked for your cookie choices again rather than having an old decision carried over.