Privacy Notice

1. Who we are

Secret Scarlet is operated by Sam Gallagher, the data controller for information collected through this website. Contact: secretscarletuk@gmail.com.

2. Information we collect

To record a private-list request we require an email address. A first name, “Shopping For” choice and country are optional. You can leave these optional fields blank and still register. We use your declared country and shopping preference to understand interest by market and whether visitors are considering a purchase for themselves or as a gift; we do not infer these from your name or email address. Providing a country does not confirm delivery availability. Marketing consent is also optional: declining it does not prevent the registration being recorded, but we will not use that registration to send optional launch, product or private-list marketing emails.

We record the consent choice and, where consent is given, its timestamp and the version of the notice shown. We also create a signup ID or internal record number and retain the landing URL, referring source, and available campaign fields (source, medium, campaign and content), including initial and latest conversion touch where available.

For service security we process limited request information and retain only short-lived, one-way hashed rate-limit keys rather than raw IP addresses. First-party funnel analytics record an anonymous session ID, event name, time, page path, campaign fields, referrer domain, viewport category, entry point, result state and, on a successful signup only, whether the request was for yourself or a gift. Email addresses and names are not written to the analytics event table.

3. Why we use information

Private-list administration. We use registration details to record and administer the request. Our lawful basis is our legitimate interest in operating the private list a visitor has deliberately asked to join, with data limited to what that administration requires. Optional country and shopping-preference information also supports our legitimate interest in understanding demand and planning this pre-launch service. You can omit it or ask us to remove it.

Marketing. We use email and optional first name for launch, product and private-list marketing only where you have actively opted in. Our lawful basis for that activity is consent. Consent can be withdrawn at any time by using the unsubscribe route in an email or contacting us.

Security and abuse prevention. We use limited technical signals, validation and short-lived rate-limit records to protect the website and its database. Our lawful basis is our legitimate interest in network and information security and preventing misuse.

First-party analytics. We measure the private-list funnel so we can understand whether the site works and which campaign routes are effective. Our lawful basis is our legitimate interest in measuring and improving this limited pre-launch experience. The event record is deliberately minimised: it excludes email, name, raw IP, fingerprinting and full form submissions.

4. Services that process information

Cloudflare provides the website hosting, edge runtime, D1 database, media delivery and security infrastructure. Google Sheets holds the production private-list record. Google Apps Script transfers validated registrations to that sheet and runs the existing email workflow; messages are sent through Google Apps Script’s MailApp service. Sender holds email subscriber records and provides our new email delivery, automation and unsubscribe service. During migration, the existing Google email workflow remains in use until the replacement is verified. These providers process information on our behalf to provide those functions. We do not sell personal information.

5. International processing

Cloudflare, Google and Sender operate internationally, so information may be processed outside the United Kingdom. Where that involves a restricted transfer, we rely on the safeguard applicable to the provider and service under UK data-protection law, such as an adequacy regulation or UK-approved contractual safeguards. You may contact us for more detail about the safeguard applying to your information.

6. Retention

Private-list records are kept while the list remains active and the record is needed to administer it. If you unsubscribe or ask for deletion, we remove data that is no longer required, while retaining only what is reasonably necessary to honour suppression choices, demonstrate consent history, resolve disputes, secure the service, or meet legal and accountability obligations. Funnel events are kept only while useful for current funnel measurement and accountability. Short-lived rate-limit records expire after their abuse-prevention window and are removed automatically. We review these categories rather than assigning an unverified fixed period to every record.

7. Security processing and local storage

Cloudflare may process technical request information and, where its bot-management controls apply, may use strictly necessary security cookies such as __cf_bm. This is security processing, not advertising tracking. Secret Scarlet’s funnel measurement uses a random first-party identifier held in session storage for the current browsing journey. This implementation introduces no cross-site advertising tracker, behavioural advertising profile, fingerprinting or session replay.

8. Automated decisions

Secret Scarlet does not use this information for automated decision-making or profiling that produces legal or similarly significant effects. Ordinary funnel measurement and automated queue retries are not used to decide a person’s eligibility or treatment.

9. Your rights

You may ask to access, correct, restrict or erase your personal information, object to processing based on legitimate interests, or withdraw consent. Contact us at the email address above. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.

10. Changes

We may update this notice as the service develops. The latest revision date and version will appear at the top of this page.