# Privacy notice

Last updated 20 October 2026. Tollfair is operated by V.ONE ("we"). We are the controller of the personal data described here. ICO registration: [number pending].

## What we collect

- Your email address and the role you pick (seller, builder or both) when you join the waitlist.
- Optional details you give us: company name and a line on what you need.
- The datasets you star, and any one-line use case you add. Star counts are public; who starred is never public.
- Listings you submit, claims you make and evidence reports you file.
- Basic request data (IP address, user agent) used briefly to stop abuse such as scripted sign-ups.
- Only if you allow analytics: aggregate page views and load times (see Cookies and analytics below).

## Why we use it

- To run the waitlist and tell you when early access opens (your consent, which you can withdraw at any time).
- To decide which datasets to grade first and which providers to contact (our legitimate interest in building the catalogue).
- To verify that someone claiming a listing works for its provider.
- To keep the service secure and stop fake stars (our legitimate interest).
- To see which pages work and how fast they load (your consent, given in Cookie settings, which you can withdraw at any time).

## Who we share it with

Our processors: Supabase (database and email sign-in links) and Vercel (hosting, and analytics if you allow it). They act only on our instructions.

We never sell your personal information, and we never share it for cross-context behavioural advertising.

When a provider claims a listing, we may share the number of stars and the anonymised use-case notes for that dataset. We do not share who starred.

## How long we keep it

Until you delete your account or ask us to, or 24 months after your last activity, whichever comes first.

## Cookies and analytics

We use only strictly necessary cookies unless you agree to analytics. Analytics is off until you turn it on, and Global Privacy Control turns it off. You can change your choice at any time from Cookie settings at the bottom of the page. Our cookie notice lists every cookie and storage key we use.

## Your rights

Under the UK GDPR and the EU GDPR you can access, correct, export or delete your data, object to or restrict how we use it, and withdraw consent at any time. To delete your account and stars in one step, email hello@tollfair.com from the address you signed up with. You can complain to the ICO at ico.org.uk, or to the data protection authority where you live.

## US state privacy rights

If you live in California or another US state with a consumer privacy law (such as Colorado, Connecticut, Oregon, Texas, Utah or Virginia), you have these rights. The categories of personal information we collect are the ones listed under What we collect: identifiers (email address), professional details you choose to give (company name), and your activity on Tollfair (stars, listings, claims and, if you allow it, analytics). We don't collect sensitive personal information.

- Know and access: ask what personal information we hold about you and get a copy.
- Delete and correct: ask us to delete or fix it.
- Opt out of sale, sharing, targeted advertising and profiling: we do none of these. You can still record an opt-out with the Do Not Sell or Share My Personal Information link at the bottom of the page, and we treat a Global Privacy Control signal from your browser as an opt-out.
- No discrimination: using your rights never changes the service or price you get.
- Make a request: email hello@tollfair.com, yourself or through an authorised agent. We confirm it's you by replying to the email address on your account, and respond within 45 days. If we refuse, you can appeal by replying to our answer.