Privacy Policy

2. Information We Collect

The information used depends on the features you choose:

• Account & Contact Data: Full legal name, email address, display name, and avatar preferences.
• Eligibility declarations: Date of birth, country of residence and the time you accept the account terms. These are declarations, not completed independent identity checks.
• Postal entry details: Residential address, postcode, reservation codes, postal confirmation records and any optional telephone number you supply for that route.
• Payments and payouts: Current testing does not require payment card or bank details. Payment collection and real reward transfers are not enabled. Trust Payments is planned for a later integration; we will explain any new processing before asking you to use it.
• Participation and technical data: Challenges saved or reserved, learning activity, account preferences, connection and error records, and technical information such as IP address and browser details. Optional analytics are described below.
• Support & Email Data: Support messages, their category and reference, email delivery records, and the time and status of news email requests, confirmations and cancellations.

3. Lawful Bases for Processing

Under Article 6 of the UK GDPR, we rely on the following lawful bases:

• Providing the requested service: We use account, eligibility and participation details to administer your free testing account, process reservations and answer support requests. This processing is necessary to provide the service under our terms. Without the required account or entry details, we cannot complete that account or reservation.
• Legal obligations: Where a specific legal requirement applies, we may need to keep records or respond to a lawful request.
• Legitimate interests: We use necessary security and operational records to prevent misuse, investigate faults and protect accounts. You can object to processing based on these interests.
• Consent: For optional analytics and news emails. News emails require a separate request and confirmation through an email link. You can unsubscribe in your account or from a news email. Withdrawing consent does not affect earlier lawful processing, your account access, or necessary account and support messages.

4. Data Processors & Third-Party Sharing

We do not sell your personal data. The following services help operate ChartHigh:

• Google Firebase: Account authentication, password-reset emails and storage of account, challenge, support and communication records.
• Resend: Delivery of welcome emails, support notifications and receipts, news subscription confirmation and news emails to confirmed subscribers. We provide the recipient address, name where used, message content and delivery identifiers.
• Fasthosts: Hosting our company email inboxes, including support correspondence and replies.
• Vercel: Website hosting and server-side application processing.
• Google Analytics: Optional website usage measurement when you accept analytics cookies.

These providers may process information outside the United Kingdom. Contact us for information about the locations and transfer safeguards applicable to your data. We may also disclose information where a legal obligation requires it.

5. Data Retention & Security

Retention depends on why a record is needed. Account information supports your access while you use the service. Reservations and postal records support challenge administration and the handling of questions or disputes. Support correspondence, security records and consent history may need to be kept after you stop using an account to resolve an outstanding issue, prevent abuse or meet a legal obligation.

Closing a sign-in account does not necessarily erase all separately held operational records immediately. You can request deletion through support; if a record needs to be retained, we will explain the reason. We do not treat illustrative reward balances as proof of a real financial transaction.

We use HTTPS and access controls to protect account information. Support requests, email delivery records and broker connection credentials are restricted to authorised operations.

6. Cookies and optional analytics

Cookies and local browser storage support sign-in, security and saved preferences. Optional website analytics have a separate choice:

• Necessary storage: Firebase sign-in state, security information and your cookie preference help the service work. Blocking this storage can prevent sign-in or stop preferences being saved.
• Optional analytics: Google Analytics measures website visits and interactions when you choose Accept Analytics. Analytics may use cookies and technical identifiers. Essential Only keeps optional analytics off.
• Your choice: You can change your analytics choice using the site's cookie controls. This is separate from news email consent and does not change your account or challenge reservations.
• Embedded services: Opening a third-party chart, video or external link may involve that provider's own processing. Its privacy and cookie information also applies to the service it provides.

7. Your Rights Under UK GDPR

Depending on the processing and any applicable exceptions, your data protection rights include:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where no statutory override applies.
• Right to Restrict Processing & Object: Request limits on how we process your data.
• Right to Data Portability: Receive your data in a structured, commonly used machine-readable format.

To exercise any of these rights, email support@charthigh.com. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.