Privacy policy

Visit Rhosneigr is run by Carley Williams, who is responsible for how your information is handled here (the data controller). Contact: hello@visitrhosneigr.wales.

What we collect

You can browse the Rhosneigr directory and read all content on this website without providing any personal information. We do not require registration or sign-up to use the site.

The site offers a live newsletter sign-up form. Subscribing is voluntary, requires no account, and uses double opt-in: you confirm your address by clicking a link sent to your inbox before any newsletter is delivered. We collect only the email address you provide, and use it solely to send updates about Rhosneigr.

You can also share a photo of a Rhosneigr business or place, report a photo, or claim a business listing. Those forms collect a little more, and each is explained in its own section below.

Newsletter signups

Newsletter signups are processed by Listmonk, a self-hosted email marketing platform running on our own server in the UK. Your email address is used only to send the newsletter. Email delivery is handled by Brevo, an email service provider based in France (EU).

Every newsletter includes a one-click unsubscribe link, no account needed, no asking to be removed. Unsubscribing marks your address as unsubscribed in Listmonk and stops all further delivery; the record is retained so you can re-subscribe later if you wish, but is not used for any other purpose. Records are not automatically erased. To have your address deleted, please email hello@visitrhosneigr.wales and we will remove it manually.

Sharing a photo

The Share a photo page lets you send us a photo of a Rhosneigr business or place. When you do, we collect:

• the photo itself (we strip location and camera details from it before it is stored);
• the name you want shown in the credit;
• only if you choose to give them, your email address and your Instagram handle;
• whether you ticked "Show my Instagram on the credit" and "Show me as a contributor";
• a scrambled (hashed) version of your IP address. It cannot be turned back into your IP address, and we only use it to limit spam, for example by capping how many photos one person can send in a day.

Every photo is checked by hand before it goes up. Your email address is only used to get in touch about your photo, for example to check that you run a business. Your Instagram handle is only shown on the site if you tick "Show my Instagram on the credit". If you tick "Show me as a contributor", your name may appear in our list of photographers.

Your private tracking link

When you send your first photo, we make you a private link that shows whether each of your photos is waiting, live, or not used this time. There are no accounts or passwords. The link contains a long random code, and we store only a scrambled copy of that code, so we cannot work out your link from our records.

Anyone who has the link can see the status of your photos, so keep it to yourself. Your browser saves the code in its local storage (not a cookie, and not used for tracking) so that a "Your photos" link appears the next time you visit the Share a photo page. We keep your credit name, your optional Instagram handle and your two tick-box choices against that code, so that later photos you send are linked to you.

Why we use this information

We use this information because you have asked us to show your photo and agreed to it: your consent is the legal basis. You give it by ticking the confirmation box before you send a photo, and by choosing to add an email address, an Instagram handle or the contributor option. You can change your mind at any time (see Asking for removal below).

How long we keep it

• Photos waiting for review are deleted if we have not reviewed them within 30 days. Photos we decide not to use are deleted straight away.
• The email address, Instagram handle and scrambled IP address on a submission are cleared 90 days after we approve, reject or expire it.
• Approved photos and their credits are kept until you ask us to remove them.
• Your contributor details (credit name, optional Instagram handle, tick-box choices and your tracking link) are kept while you are a contributor, until you ask us to remove them.

Reporting a photo

When you report a photo, we collect the photo being reported, the reason you selected, an optional message and an optional email address if you choose to provide them, and a scrambled IP address to enforce daily spam limits. This information is used solely to investigate and resolve the report. The optional message, email address and scrambled IP address are permanently cleared 90 days after the report is decided.

Claiming a business listing

The claim-listing form collects your name, email address, phone number, business role (owner, manager or staff) and any message you choose to write. This information is used to verify that you are who you say you are and that the listing belongs to you. It is not used for any marketing purpose. As described under Discord below, the submitted details are also posted to a private Discord channel so we can review and respond to the claim, and are stored in Supabase. No other third party receives this data.

Cookies

This site does not use tracking cookies, analytics, or any third-party tracking technology, apart from the Cloudflare Turnstile security check described below, which only loads on the Share a photo and Report a photo pages. There is no Google Analytics, Meta Pixel or comparable first-party analytics on any page. However, because Vercel hosts and serves the site, visitor IP addresses and request metadata are logged at the edge in order to deliver the page. That is technical personal data even though it is not used for behavioural tracking or profiling.

Third-party services

This site uses the following third-party services:

• Vercel: hosting and edge delivery. Vercel serves the site and logs the requests it receives, including visitor IP addresses, in accordance with their privacy policy.
• Namecheap: DNS for this domain, and inbound email forwarding for hello@visitrhosneigr.wales. Mail sent to that address is relayed by Namecheap to our private mailbox.
• Supabase: database and file storage. Business listing data (names, addresses, contact details and opening hours) is stored and served via Supabase, as are the records submitted through the claim-a-listing form, the Share a photo form (photos, credit names, optional emails and Instagram handles, and contributor details) and photo reports. Supabase processes this data on our behalf.
• Google Maps: business listings link to Google Maps for directions and reviews. Following one of those links takes you to Google's own site, where Google's privacy policy applies. No Google content is loaded on our pages.
• Cloudflare Turnstile: a security check on the Share a photo and Report a photo forms that tells people from bots. It loads only on those pages, and Cloudflare processes information about your browser on our behalf to run the check, in accordance with their privacy policy.
• Discord: used solely to notify us when a claim-a-listing form or a photo is submitted. For a claim, the submitted name, email, phone, role and message are posted to a private channel so we can review and respond. For a photo, the photo, credit name, any email address and Instagram handle you gave, and your tick-box choices are posted to a private channel so we can check it. For a report, the photo, the reason, and any message and email address you gave are posted to a private channel so we can deal with it.

Where your information is stored

Our database and file storage (Supabase) is hosted in the UK. Some services we use to deliver the site (Vercel, Cloudflare and Discord) may store or process information outside the UK, with appropriate safeguards provided by those companies.

Directory data accuracy

Business information in the directory (including names, addresses, phone numbers, websites and opening hours) comes from publicly available sources and is being checked against each business's own website, official open data (such as Food Standards Agency hygiene ratings and postcode data) and details confirmed by business owners. We do not show Google star ratings or review counts; each listing links to Google Maps, where you can read reviews. While we make reasonable efforts to keep information current, we cannot guarantee that all listings are accurate or up to date. We recommend verifying details directly with the business before visiting or making bookings.

If you are a business owner and believe your listing contains inaccurate information, please contact us at hello@visitrhosneigr.wales.

Nothing is sold

We do not sell your personal information, and we do not share it for advertising.

Your rights

You can ask for a copy of the information we hold about you, ask us to correct or delete it, or withdraw your consent at any time by emailing hello@visitrhosneigr.wales; and if you're unhappy with how we've handled your information you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Asking for removal

You can ask us to remove a photo, your contributor details, or anything else we hold about you at any time. Email hello@visitrhosneigr.wales and tell us which photo (a link to the listing page helps). We will remove it.

Contact

If you have any questions about this privacy policy or how we handle data, please contact us at hello@visitrhosneigr.wales.