Privacy

DutyDelta is operated by Black Ember Labs, which is the data controller for the purposes of the UK and EU GDPR. This page describes what the service collects, why, and for how long. It is written to match what the software actually does.

What we collect

Site analytics. DutyDelta sets no cookies and uses no third-party analytics or advertising service. Each browser tab is given a random identifier that lives in sessionStorage and is discarded when the tab closes. It is not persistent and does not follow you to other sites, so no consent banner is needed. Against that identifier we record the page path, the referring URL, any campaign parameters in the link, your browser’s user-agent string, and how long the page was open.

IP addresses are never stored in full. An IPv4 address is truncated to its first three groups and an IPv6 address to its first two before anything is written down. This is enough to tell a datacentre crawler from a person and not enough to identify you.

Your email address, if you add a code to the free watchlist or open an account.

Your client catalogues, if you subscribe: the tariff classifications you monitor, the name you give each client, and any description you attach to a line. This is commercially sensitive and is treated as such — it is scoped to your account and is never pooled, aggregated across customers, or sold.

Payment details are never collected by us. Checkout and billing are handled entirely by Stripe. We receive a customer reference and a subscription status. We never see or store a card number.

Why we collect it

• To provide the service you asked for — matching tariff changes to your codes and producing your reports.
• To email you about changes affecting the codes you asked us to watch.
• To understand which pages bring people to the site, so it can be improved. Our legitimate interest, and the reason this is kept to the minimum above.
• To take payment and meet the accounting obligations that follow from it.

Who else sees it

Only the processors the service runs on: Railway (hosting and database, EU West region), Cloudflare (DNS and edge), and Stripe (payments). We do not sell personal data, share it for advertising, or use it to train anything.

How long it is kept

• Analytics records: 24 months.
• Watchlist entries: until you unsubscribe.
• Account and catalogue data: while your account is open, and for 30 days after you close it, after which it is deleted.
• Invoices and payment records: as long as tax law requires us to keep them.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask for it in a portable form, or object to processing based on legitimate interest. Email [email protected] and we will respond within 30 days. If you are in the EU or UK you also have the right to complain to your national data protection authority.

Changes

If this page changes materially we will say so on the site before the change takes effect. The date at the top always reflects the current version.