CLEAR INFORMATION. PRACTICAL CHOICES.
Your tools. Your privacy.
Updated 26 October 2026
This notice covers freestack.co.uk, its account features and its companion extension. You can browse without an account. Newsletter signup and optional statistics are separate choices.
Who is responsible?
WETTON&CO LTD is the controller, trading as FreeStack. Company number 16313497, registered in England and Wales. Registered office: C/O Hilton Consulting Canalot Studios, 222 Kensal Road, London, England, W10 5BN. Jake Wetton handles privacy enquiries. Contact support@freestack.co.uk or use Your data.
What we use and why
| Information and purpose | Lawful basis | Retention |
|---|---|---|
| Email, account ID and authentication records to provide your login. Supabase manages passwords; Resend delivers essential account messages. | Contract to provide your requested account; legitimate interests in account security. | Account lifetime or accepted deletion request. Review accounts inactive for two years; inactivity does not automatically delete your stacks. |
| Stacks, links, notes, saved tools, guide progress and watches to provide your collection. The extension sends the page address and details you choose to save, rather than a browsing-history feed. | Contract to provide your requested collection. | Until removed or your account is deleted. Unsynced browser stacks stay on your device until cleared. |
| Display name, contributions, ratings, snapshots, suggested tools and uploaded images to provide the directory/community. | Contract for requested publication; legitimate interests in accurate listings and content safety. | Published while useful and permitted. Rejected/withdrawn contributions and uploads reviewed for removal after 180 days; subject to rights requests. |
| Newsletter email, consent wording/version, source, confirmation, delivery and withdrawal records. | Consent for marketing; legitimate interests for limited compliance/suppression evidence. | Until you unsubscribe; limited suppression record while necessary, reviewed annually. Unconfirmed requests removed after expiry plus seven days. Completed onboarding payloads removed after 30 days. |
| Name, email, company, website and advertising brief; details of explicitly requested TDA audits. | Steps at your request before a contract and contract if agreed; legitimate interests in business-enquiry handling. | Unconverted ad enquiries reviewed for deletion after 24 months. Contract/financial records for the applicable legal period. TDA reports are handled by Wetton&Co’s TDA service. |
| Privacy requests, content reports, complaints and handling records. | Legal obligation where applicable; legitimate interests for other complaint handling and safety. | While open; normally two years after closure, then case details anonymised, unless a documented legal hold applies. |
| Recent activity, member timestamps, abuse counters and owner administration logs. | Contract for recent activity; legitimate interests in security and service administration. | Recent activity: 90 days. Rate-limit records: window expiry plus one day. Owner audit: one year. Member records reviewed with inactive accounts. Provider logs follow supplier controls. |
| Optional public page/event counts, broad device category and referring hostname to improve the site. | Consent: off until you allow statistics. | 180 days. No persistent visitor ID, fingerprint, search text, full referrer URL or private account path in counters. |
An email is necessary for an online account/recovery, but marketing and optional profile/project details are your choice. Do not submit sensitive personal information or confidential client data. Specific records may need longer retention for a legal obligation or active claim; we document the reason.
What is public?
Approved contributions, directory listings and approved listed stacks are public and may be indexed or copied. An unlisted shared snapshot can be read by anyone holding its link. Private notes and unshared stacks are not published. The owner dashboard displays submissions, subscribers, reports, member emails and activity, but does not display private stack notes. Authorised technical administration may access stored data for support, security or rights requests.
Suppliers and overseas processing
OpenAI Sites and hosting infrastructure including Cloudflare run the website, database, assets and restricted backups. Supabase manages authentication and a separate private recovery copy; the FreeStack project is configured in London (eu-west-2). Resend handles account/service/newsletter email, contacts, bounces and complaints. Password screening sends Pwned Passwords only a short hash prefix, not your password, full hash or email.
Suppliers and subprocessors can process information outside the UK, including the US and Singapore. London hosting does not restrict all support and operational processing to the UK. The supplier terms describe safeguards for restricted transfers, including Standard Contractual Clauses with the UK Addendum where applicable. Read the Sites DPA, Supabase DPA and Resend DPA, or ask us for relevant safeguards. We do not claim all processing remains in the UK. We do not sell subscriber details.
External image hosts receive normal connection information when their images load. Linked services have their own privacy notices. TDA receives your details only when you request its audit; the form does not subscribe you to marketing.
Cookies and statistics
The cookies and storage notice explains login cookies, browser stacks and appearance preferences. Optional statistics require your choice first. Use “Privacy choices” in the footer to withdraw or change it. Do Not Track and Global Privacy Control override statistics permission. The current build has no advertising tracking pixels.
Your rights
Request access, correction, deletion, restriction or portability where applicable. Withdraw newsletter consent through an email’s unsubscribe link or contact us. Withdrawal does not affect earlier lawful use. Your data offers an immediate account export and a form for wider requests, including relevant provider records or uploaded-file copies.
You can object to legitimate-interest uses, explaining your circumstances, and to direct marketing at any time. Use Your data or email support@freestack.co.uk. Ordinary requests are free.
We verify identity proportionately before disclosing or erasing records. Rights requests are generally answered within one month; we explain any lawful extension or exception. Account creation does not subscribe you to marketing.
Complaints
Use the privacy complaint form or email us. We acknowledge complaints within 30 days, investigate and communicate an outcome without undue delay. You may also complain to the ICO; you do not need our permission.
Deletion and recovery
Accepted erasure requests cover relevant live records, uploads and supplier records, subject to justified exceptions. Restricted recovery copies are not used for ordinary operations. Application snapshots have a 30-day retention/review policy; at least two valid copies are preserved and a fresh recovery is required before automated Site snapshot expiry. Separately held and provider-managed copies need their own retention checks. Accepted erasure instructions must be reapplied before restored records return to service; contact us about the handling of a particular backup or supplier copy.
Children and automated checks
Account and contribution features are intended for adults aged 18 or over, but we do not use identity-document age checks and children may access public pages. Contact us about a child’s data. Automated security/website checks support review; public member submissions require editor approval. We do not use account data for solely automated decisions producing legal or similarly significant effects. We update this notice when processing changes and highlight material changes where appropriate.