Privacy
Last updated 24 August 2026.
Safety Shortlist is a curated link directory. It has no user accounts, sets no cookies and runs no tracking script. The only personal information it holds is what somebody has typed into one of four forms, and this page says exactly what happens to each of them.
Who we are
Safety Shortlist is run by a sole trader in England. For anything about your information, including a request to delete it, email hello@safetyshortlist.com. We are the data controller for everything described below.
The newsletter
If you subscribe we store your email address, the date you subscribed, the date you confirmed and, if you leave, the date you unsubscribed. No name and nothing else.
The form posts to this site, not to a third party. Your address is stored here first and then sent to beehiiv, which sends the newsletter and handles the confirmation email. If that handover fails we still hold the address and can send it again later.
The lawful basis is your consent, given by typing your address and then confirming it from the email beehiiv sends you. You can withdraw it from the unsubscribe link in any email, or by asking us. When you unsubscribe we keep your address with the date you left, so that we do not add you again by mistake, and we send you nothing.
Submitting a link
The submission form stores what you type: the name and web address of the thing you are suggesting, which list you think it belongs in, a description, any offer or access code you give us, an optional thumbnail image and your email address.
Your address is used once, to tell you if the link goes live. It is never added to the newsletter and we do not pass it on. The lawful basis is our legitimate interest in running the directory and replying to people who ask to be in it.
A submission we have not acted on is deleted automatically 30 days after it arrives, along with any image you uploaded. That is a scheduled job, not something we remember to do. Submissions we approve or reject are not deleted automatically: an approved one is the record of a listing that is live and a rejected one is the record of a decision. Ask us and we will delete yours.
Sponsoring a list
Buying a sponsored slot stores your name, your email address, the product name, the link, the description, any thumbnail you upload, how many months you bought, the amount charged, the dates the slot runs between and the reference of your Stripe checkout.
The lawful basis is the contract between us. We need this to place the slot, to know when it ends and to keep the accounts.
A record is created before you are sent to Stripe, because your image cannot travel with you through the redirect. If you close the payment page without paying, that record and your image are deleted, within the hour in the normal case and within a day at the outside.
When a slot ends it stops showing on the site that same moment, and a daily job marks it finished. Your contact details stay in the record after that, because it is also the record of a payment. We keep it for six years from the end of the tax year the payment falls in, which is how long HMRC expects business records to be kept, and then delete it.
The leaderboard
A leaderboard entry stores the name, link and description you give, any thumbnail, the running total you have paid, how many times your entry has been clicked, your email address and the reference of your Stripe checkout.
Everything in that list is shown publicly except your email address and the Stripe reference, which are never displayed. The lawful basis is the contract between us.
A leaderboard place is permanent. It is never reduced and never expires, so the entry stays on the site until you ask us to remove it. Your email address is kept for as long as the entry exists, because it is what tells us a later payment is a top up of your entry rather than somebody else starting a new one. Payment records are kept for six years, as above.
The contact form
The contact form takes your name, your email address and your message, and emails them to us. None of it is written to our database at any point. The message becomes an ordinary email in our mailbox and is used to reply to you. The lawful basis is our legitimate interest in answering people who get in touch.
Payments
Card payments are taken by Stripe on Stripe’s own hosted page. Your card number never reaches this site and we never see it. We receive the amount, the currency, whether it succeeded and a checkout reference. Stripe holds the payment itself and has its own privacy notice.
Clicks
Every outbound link on the site goes through a redirect that adds one to a counter on the listing, and adds a tag to the address so the site receiving the visit can see it came from here.
That counter is a single number per listing. We do not record who clicked, when they clicked or what else they looked at, and there is no way to work any of that out from what is stored.
Cookies and analytics
This site sets no cookies at all, and stores nothing in your browser. It runs no analytics and no tracking script: there is no Google Analytics, no advertising pixel and no third party embed anywhere on it. That is why you have never been asked to accept anything.
Our hosting provider, Vercel, records ordinary server logs for the requests it serves, which include IP addresses. When you submit the newsletter or contact form your IP address is also held in memory for ten minutes to limit how many times the same source can submit. It is not written to our database and it is not linked to what you typed.
Images you upload
Thumbnails uploaded through the submit, sponsor or leaderboard forms are stored in a public bucket, so anyone who has the address of the file can view it. Do not upload anything you would not want seen. Images belonging to submissions and payments that were never completed are deleted along with the record.
Who else sees your information
We do not sell anything to anyone and we do not share information for advertising. These are the companies that process it on our behalf so that the site works:
- Supabase, which hosts the database and the uploaded images.
- Vercel, which hosts and serves the site.
- Stripe, which takes payments.
- beehiiv, which stores newsletter subscribers and sends the newsletter.
- Resend, which sends our email, including anything sent from the contact form.
Some of them are based outside the United Kingdom, and where that is the case the transfer relies on the safeguards in that provider’s own data processing terms. We will also disclose information if the law requires it.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, or object to it. Where we rely on your consent, you can withdraw it at any time.
Email hello@safetyshortlist.com and say what you want. We will reply within one month. There is one limit worth knowing: where a record is also the record of a payment we have to keep it for tax purposes, so we will remove it from the site and keep only what the accounts need.
If you are unhappy with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk.
Changes
If this page changes, the date at the top changes with it. See also the terms.