Privacy Policy

This policy explains what personal data FlashAlert collects, why we collect it, how we use it, and what rights you have over it. It applies to everyone who visits flashalert.co.uk, creates a retailer account, or subscribes to alerts from a retailer who uses our service.

1. Who we are

FlashAlert is a trading name of Naxtech, registered at 1 Burcombe Way, Reading, RG4 8RX, England.

For the purposes of UK data protection law, Naxtech is the data controller and data protection officer for FlashAlert. You can contact us at any time at contact@flashalert.co.uk.

2. Data we collect and why

2.1 Retailer accounts

When a retailer creates a FlashAlert account we collect:

• Shop name and town — to identify your shop uniquely within our system and label your subscriber sign-up page.
• Email address — to send your one-click dashboard access link, service notifications, and account-related communications.

We do not collect payment card details directly. Payment is handled entirely by Stripe (see Section 5). We receive a transaction reference and your email address from Stripe to record that a credit purchase was made.

2.2 Subscriber data (end customers)

When a member of the public scans a retailer's QR code and subscribes to their alerts, we collect:

• Email address — to deliver flash alerts from the retailer they subscribed to.

We do not collect names, phone numbers, postal addresses, or any other personal data from subscribers. We do not profile subscribers or use their email address for any purpose other than delivering the alerts they signed up for.

2.3 Website visitors

When you visit flashalert.co.uk we collect standard technical data through Microsoft Clarity, including anonymised information about how you interact with the page (mouse movements, scroll depth, clicks). This data is aggregated and does not identify you personally. See Section 9 for more on cookies and analytics.

3. Legal basis for processing

Under the UK GDPR, we rely on the following legal bases:

• Contract performance (Article 6(1)(b)) — processing retailer account data is necessary to provide the FlashAlert service.
• Legitimate interests (Article 6(1)(f)) — processing website visitor analytics to improve our service, where this does not override your interests or rights.
• Consent (Article 6(1)(a)) — processing subscriber email addresses. Subscribers give explicit consent at the point of sign-up. Consent can be withdrawn at any time by clicking the unsubscribe link in any alert email.

4. How we use your data

Retailer data

• To create and maintain your account and dashboard.
• To send your one-click dashboard access link when requested.
• To process credit purchases and record your credit balance.
• To notify you of important changes to the service or this policy.

Subscriber data

• To deliver flash alert emails from the specific retailer the subscriber opted in to.
• To manage unsubscribe requests and maintain suppression lists.
• To maintain consent records as required by law.

5. Third parties and data processors

We use the following third-party processors who may handle personal data on our behalf. All are bound by data processing agreements and applicable law.

SendGrid (Twilio)

We use SendGrid to deliver all outbound emails — both retailer account emails and subscriber flash alerts. SendGrid processes email addresses and email content on our behalf. SendGrid is certified under the UK–US Data Bridge framework. For more information, see Twilio's privacy policy.

Stripe

We use Stripe to process credit purchases. When you make a payment, your card details are entered directly into Stripe's secure environment — we never see, store, or process your card number, expiry date, or CVV. Stripe is PCI DSS Level 1 certified. For more information, see Stripe's privacy policy.

Microsoft Clarity

We use Microsoft Clarity for website analytics. Clarity collects anonymised behavioural data (scroll depth, click maps, session recordings) to help us understand how visitors use our website. Clarity does not collect personally identifiable information in a form we can access. For more information, see Microsoft's privacy statement.

6. Where data is stored

All FlashAlert account data and subscriber data is stored on servers located in the United Kingdom. We do not transfer personal data outside the UK except where a third-party processor (such as SendGrid or Stripe) operates internationally under appropriate safeguards, including the UK–US Data Bridge or standard contractual clauses.

7. How long we keep data

Retailer accounts

Retailer account data (shop name, town, email address) is retained for as long as the account is active. If you close your account or request deletion, we will delete your account data within 30 days, except where we are required to retain records for legal or accounting purposes (for example, records of financial transactions, which we retain for 6 years under HMRC requirements).

Subscriber data

A subscriber's email address is retained for as long as they remain subscribed to a retailer's alerts. When a subscriber clicks the unsubscribe link, their email address is immediately suppressed — meaning it is added to a do-not-contact list and no further alerts are sent. We retain suppressed addresses on our suppression list to prevent accidental re-addition, but they are not used for any other purpose.

If a retailer account is closed, all associated subscriber data is deleted within 30 days.

Website analytics

Anonymised analytics data collected by Microsoft Clarity is retained in accordance with Microsoft's standard data retention periods.

8. Your rights

Under UK GDPR you have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate data.
• Right to erasure — you can ask us to delete your data, subject to any legal retention obligations.
• Right to restrict processing — you can ask us to pause processing your data in certain circumstances.
• Right to data portability — you can ask us to provide your data in a structured, machine-readable format.
• Right to object — you can object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent (subscriber email addresses), you can withdraw consent at any time by clicking the unsubscribe link in any alert email, or by contacting us directly.

To exercise any of these rights, email us at contact@flashalert.co.uk. We will respond within one calendar month.

9. Cookies and analytics

We use only the following cookies and tracking technologies on flashalert.co.uk:

• Strictly necessary cookies — required for the website and dashboard to function (for example, session authentication). These cannot be disabled.
• Microsoft Clarity — anonymised behavioural analytics. Clarity may set cookies to track session data across pages. These are analytics cookies and require your consent where applicable under PECR.

We do not use advertising cookies, tracking pixels, or any third-party marketing cookies. We do not use Google Analytics or any Google tracking product.

10. Children

FlashAlert is a business-to-business service. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us at contact@flashalert.co.uk and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify active account holders by email. Continued use of the service after any update constitutes acceptance of the revised policy.

12. Contact and complaints

For any questions about this policy or to exercise your rights, contact:

• Email: contact@flashalert.co.uk
• Post: Naxtech, 1 Burcombe Way, Reading, RG4 8RX

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF