Privacy policy

What we collect, and why

We try to collect as little as possible. Here is the full list:

When you create a member account

• Email address or mobile phone number — one or the other is required so you can sign in and so we can contact you about moderation outcomes or appeal responses.
• Display name — the name shown next to your comments.
• Password (hashed) — we store a one-way hash, never the password itself.
• Account timestamps — when you joined, when you last signed in.

Lawful basis: contract (UK GDPR Article 6(1)(b)) — we need this to provide the account you signed up for.

When you post or comment

• The comment text, the time you posted it, and which article or listing it relates to.
• If a comment is reported or moderated, the reason and our action are recorded for the audit trail described in our community guidelines.

Lawful basis: legitimate interests — running a moderated community in a way that is fair to every member.

When you visit the site

• Server logs — the IP address your request came from, the page you asked for, the time, and your browser's user-agent string. These are kept for up to 30 days for security and abuse prevention.
• Google Analytics — only if you accept the cookie banner. We use it to count visits and see which sections are popular. IPs are anonymised before processing. See our cookies notice for the full list.

Lawful basis: server logs — legitimate interests (security). Analytics — consent (UK GDPR Article 6(1)(a)).

When you use the directory or contact form

• If you suggest or claim a business listing, we record what you submitted plus an audit trail (who suggested it, when, and any moderation outcome).
• If you email us, we keep the email and our reply for as long as we need to handle the matter, then delete it.

Lawful basis: legitimate interests — running the directory and replying to people who contact us.

Who we share data with

We do not sell your data. We share it only with the small number of service providers that make the site work:

• Google Analytics (Google LLC) — pageview counts, only if you accept the cookie banner. Data is processed in the EU/US under Google's standard contractual clauses.
• Twilio — SMS one-time passcodes for sign-in and moderation alerts.
• Stripe — payment processing, only if you ever make a paid purchase from a directory listing. We never see or store your card number.
• Our own server hosting — the site runs on dedicated servers we control; the database and email logs are not shared with anyone outside that.

How long we keep things

• Account records — for as long as the account exists. If you ask us to delete it, we remove your personal details within 30 days; comments may be retained but anonymised so threads stay readable.
• Moderation records — up to 24 months after the most recent action, so repeat-offender patterns are visible to moderators.
• Server logs — up to 30 days.
• Analytics — Google's default retention is 14 months for event-level data; we do not extend that.
• Backups — rolling 30 days, then automatically overwritten.

Your rights

Under UK GDPR you can:

• Ask for a copy of the personal data we hold about you (right of access).
• Ask us to correct anything that is wrong (right to rectification).
• Ask us to delete your account and personal data (right to erasure).
• Ask us to limit how we use your data while we sort something out (right to restriction).
• Object to us using your data on the basis of legitimate interests.
• Withdraw your analytics consent at any time — visit our cookies notice to change your choice.

Email privacy@lincoln.life and we will respond within one calendar month.

Complaints

If you are not happy with how we have handled your data, please contact us first — we will do our best to put it right. If you are still unhappy, you can complain to the Information Commissioner's Office, the UK regulator for data protection.

Changes to this policy

We will update the "Last updated" date at the top of the page whenever this policy changes. Significant changes will also be flagged in a banner on the homepage for at least a week.