Privacy policy
What we collect, why we need it and the choices you have. Last updated 11 August 2026.
Fun Finds is the data controller for the personal information described here. Questions or rights requests can be sent to hello@funfinds.co or through the contact page.
Information you give us
The contact form stores your name, email address and message. We use it to read and respond to the message. Our lawful basis is legitimate interests: we need a workable way to answer users and correct listings. Do not include sensitive personal information in the form.
Technical information
Our hosting and API services process ordinary request logs, which can include an IP address, requested URL, timestamp, browser details and error information. We use these logs to operate the service, prevent abuse and investigate faults. The contact form also uses an IP address briefly to enforce a submission limit; the address is not written to the contact-message record.
Cookies, local storage and analytics
The public Fun Finds site does not currently set analytics or advertising cookies, run product analytics, or store user preferences in local storage. A cookie banner is therefore not required for the current public experience. The private administrator area uses a strictly necessary, secure session cookie after an authorised administrator signs in.
Place information
We use information published by place operators and other public sources. Our catalogue is about places, not profiles of individual visitors. Public material may still contain names or other personal information. We keep supporting records where needed to verify a listing and document editorial decisions. Contact us if you believe a listing or supporting record includes personal information that should be corrected or removed.
Place-image permission requests
We may use business contact details published by a place operator to ask for place-image permission. Before sending one request, we record the image source, the page that published the contact address and evidence of the operator’s corporate status. We use this information under our legitimate interests in improving place listings and showing the exact image for which we seek permission. We do not send these requests when we cannot confirm that the contact belongs to a UK corporate subscriber. The request email links to a private page that expires and is not indexed by search engines. Only someone holding that link can see the proposed image, and we store the link in a one-way hashed form so it cannot be recreated from our records. The page shows the exact image, the permission wording and the address we wrote to, and it cannot change anything else about a listing. A place operator can approve the proposed image, upload one alternative, decline, or ask us not to make further contact. An image uploaded through the page stays private until permission is recorded and the image is published. We retain a minimum suppression record so that future sends honour an objection. Approval records the grantor’s identity and authority, the selected image digest, requested attribution, the permission wording and the decision time. Permission can be withdrawn through hello@funfinds.co; we will remove the image from our live services within 30 days unless we must retain evidence to handle a legal claim. Asking us not to send photo requests does not withdraw you from anything else you have asked to receive, and unsubscribing from anything else does not by itself stop a photo request. The page offers a separate option to stop every kind of Fun Finds email.
Who handles the data
We use service providers to host the website, database and application infrastructure. They process information for us under their own security and data-protection commitments. Some providers may process data outside the UK; where that happens, we rely on the provider’s applicable transfer safeguards. Resend delivers place-image permission email for us and processes the recipient address and message content. Its primary processing takes place in the United States under its data-processing agreement and applicable transfer safeguards. We disable open or click tracking for these requests.
How long we keep it
We keep contact messages while they are needed to handle the request, maintain an audit trail and improve the catalogue. We do not currently run automatic deletion. An administrator removes records manually when they are no longer needed or after a valid deletion request, unless an active dispute or legal obligation requires us to keep them. Infrastructure providers retain technical logs according to their configured operational retention periods. Place-image requests expire after 14 days. We delete private proposed images and alternatives within 24 hours after a request is declined, expires, fails or is published. We keep declined or expired request evidence for 12 months to prevent repeat contact. We keep permission and publication evidence while the image is in use and for six years after withdrawal or removal. Suppression records remain while the relevant outreach programme operates so that we can continue to honour the objection.
Your rights
Depending on the circumstances, you can ask for access, correction, deletion, restriction or objection, and you may have a right to data portability. Email hello@funfinds.co with enough detail for us to identify the relevant record. You can also complain to the UK Information Commissioner’s Office at ico.org.uk.
Changes to this policy
We will update this page before introducing public analytics, preference storage or another material change in data use. The date at the top shows when the wording last changed.