Privacy policy
This policy tells you what personal data Areacodes holds, why we hold it and how long we keep it.
Who we are
AREA CODES LTD is the controller of your personal data. Our company number is 17312325. Our registered office is 1 Bond Street Cottages, Brighton BN1 1RP.
To speak to us about your data, send an email to ten@acbrighton.com.
The App Store shows our founder as the seller of the Areacodes app. Our founder publishes the app for AREA CODES LTD, and AREA CODES LTD is the controller. Google Play shows AREA CODES LTD as the seller.
Version: 6 October 2026
Who can use the app
You must be 16 or over to use the Areacodes app. We do not ask for your date of birth.
The data we hold
These tables show each type of personal data, why we hold it, our lawful basis and how long we keep it. Backups are included.
If you use the Areacodes app
| Data | Why we hold it | Lawful basis | How long we keep it | Who handles it |
|---|---|---|---|---|
| Email address | To sign you in, to send you sign-in codes, and to warn you before we delete an account that you do not use. | Contract | Until you delete your account, or 24 months after you last use the app. We email you 30 days before that. Backups keep it for 90 more days. | Cloudflare, Resend, Backblaze B2 |
| Name, if Sign in with Apple gives it | To set up your account. | Contract | Until you delete your account, or 24 months after you last use the app. We email you 30 days before that. Backups keep it for 90 more days. | Cloudflare, Apple, Backblaze B2 |
| Apple account ID, if you use Sign in with Apple | To sign you in with Apple. | Contract | Until you delete your account, or 24 months after you last use the app. We email you 30 days before that. Backups keep it for 90 more days. | Cloudflare, Apple, Backblaze B2 |
| Sign-in code | To make sure that you own the email address, and to stop other people from guessing your code. If our delete account page gets an address that has no account, we send a note in place of the code. | Contract | The code is stored scrambled, and it expires after 5 minutes. A record of each code that we send to your address expires after 1 day. A record of each wrong code that is typed for your address expires after 1 hour, or when you sign in. We delete expired codes and records every day. Backups keep both for 90 more days. | Cloudflare, Resend |
| Sign-in session: a session key and the name of your phone's or browser's software | To keep you signed in. | Contract | Until you sign out or delete your account, or 400 days after you last use the app. A session from our delete account page stops when the deletion stops. We delete sessions when they end. | Cloudflare, Backblaze B2 |
| Account number: a random ID | To connect your Claims and Redemptions to your account, and to find faults. | Legitimate interests | Kept. After you delete your account and the backups expire, nothing connects it to you. | Cloudflare, Sentry, Backblaze B2 |
| Your phone's approximate location, if you let the app use it | To show the Businesses nearest to you first. The app sends it rounded to about 100 metres. | Legitimate interests | Not kept and not logged. We use it for that one request only. | Cloudflare |
| Claims and Redemptions: the Voucher, the Business, the time, the discount, the price you paid, and whether the Business has since told us the visit was not real trade | To give you the offer, and to show each Business the verified visits that Areacodes brought. | Legitimate interests | Kept as a record. After you delete your account and the backups expire, nothing connects it to you. | Cloudflare, Backblaze B2 |
| The last time you used the app, to the day, and the date we warned you that we will delete your account | To delete accounts that nobody uses for 24 months, and to email you 30 days before. | Legitimate interests | Until your account is deleted. If you use the app again, we delete the warning date. Backups keep both for 90 more days. | Cloudflare, Backblaze B2 |
| How many wrong PINs were typed on your Claims, and when the first of them was typed | To stop one person guessing a Business's PIN. After 10 wrong PINs in 24 hours, you cannot redeem until the 24 hours end. | Legitimate interests | Until your account is deleted. The next wrong PIN after the 24 hours end starts the count again. Backups keep it for 90 more days. | Cloudflare, Backblaze B2 |
| Push consent and push tokens | To send you pushes about new places and Claims that expire soon, only if you agree. The app gives us a push token only after you say yes. | Consent | Your push tokens go when you turn pushes off. A push token goes when you sign out or delete your account, when Expo tells us the app is no longer on your phone, or 270 days after your phone last connects. After a push, a copy of the token stays with Expo's delivery result for up to 1 day. Your consent record goes when you delete your account. Backups keep both for 90 more days. | Cloudflare, Expo, Apple, Google Firebase Cloud Messaging, Backblaze B2 |
| Fault reports, with your account number only. The app sends no phone details and no install ID. | To find and repair faults. | Legitimate interests | 30 days in Sentry. 7 days or less in our server logs. | Sentry, Cloudflare |
| A random install ID, your IP address and the app version, when the app checks for an update | To get fixes to the app without a new store version. Expo counts install IDs to count monthly users of the app. | Legitimate interests | We do not get them. Expo keeps them under its own retention terms. | Expo |
| IP address and the name of the app, when our app draws the map | To draw the map in Explore. The app gets the map from OpenFreeMap, so OpenFreeMap sees them. | Legitimate interests | We do not get them. OpenFreeMap keeps its own access logs. | OpenFreeMap |
If you use the business portal
| Data | Why we hold it | Lawful basis | How long we keep it | Who handles it |
|---|---|---|---|---|
| Email address, and sign-in sessions with the name of your browser | To sign you in to the business portal, to email you the Invitation that tells you how, and to email you once when your Business gets its first Redemption. | Contract | Until we remove your access, or your Business closes and you have no other Business. Sessions end after 30 days, and we delete them when they end. Records that limit sign-in codes and wrong codes for your address expire after 1 day at most. Backups keep it for 90 more days. Fault reports keep your user ID for 30 days. | Cloudflare, Resend, Sentry, Backblaze B2 |
| Invitation: your email address and the Business | To let you join your Business on the portal. | Contract | 30 days after you accept it or it expires. Backups keep it for 90 more days. | Cloudflare, Resend, Backblaze B2 |
If you own a Business on Areacodes
| Data | Why we hold it | Lawful basis | How long we keep it | Who handles it |
|---|---|---|---|---|
| Business terms acceptance: the version of the Business terms that you accepted, and the time | To show that your Business agreed to the Business terms, and to ask again when they change. | Contract | Until we remove your access, or your Business closes. Backups keep it for 90 more days. | Cloudflare, Backblaze B2 |
| Business contact details: phone number, website, Instagram and other links | To show the Business to the public, in the app and on the map site. | Contract | Until the Business closes. At closure we delete them and change the Business name to "Closed business". Backups keep them for 90 more days. | Cloudflare, Backblaze B2 |
| Business email address | To contact the owner. We never show it to the public. | Contract | Until the Business closes. At closure we delete it and change the Business name to "Closed business". Backups keep it for 90 more days. | Cloudflare, Backblaze B2 |
| Business address and its map position | To show the Business on the map, and to make sure it is in Brighton and Hove. | Legitimate interests | As long as the Business record, because its Redemptions point to it. Backups keep it for 90 more days after a change. | Cloudflare, OpenStreetMap Nominatim, OpenFreeMap, Backblaze B2 |
If you are in a Business image
| Data | Why we hold it | Lawful basis | How long we keep it | Who handles it |
|---|---|---|---|---|
| Business images where you can be seen | To show the Business to people who use the app. We remove location and camera data from the file before it reaches us. Where an automatic check asks us to look at an image, we keep its note and the fact that we looked. | Legitimate interests | Until the Business removes the image or closes. If we remove an image for moderation, we keep it for 90 days. If you ask us to erase it, we delete it immediately. We keep the note and our decision, without the image, so the same picture is not asked about twice. | Cloudflare, Cloudflare Workers AI |
If you visit this site
| Data | Why we hold it | Lawful basis | How long we keep it | Who handles it |
|---|---|---|---|---|
| Visit data: the page, the referring site, your browser and your country | To count visits to this site and to our map site. | Legitimate interests | Cloudflare keeps it. We see totals only and keep no copy, so none of it is in our backups. | Cloudflare Web Analytics |
| IP address | To limit how many messages one connection can send. | Legitimate interests | Not stored and not logged. We use it for the limit check only. | Cloudflare |
| Your location, if you tap the locate button on our map site | To show the Businesses nearest to you first. | Legitimate interests | Not kept. We use it for that one request only. | Cloudflare |
| IP address and the name of your browser, when our map site draws the map | To draw the map. Your browser gets the map from OpenFreeMap, so OpenFreeMap sees them. | Legitimate interests | We do not get them. OpenFreeMap keeps its own access logs. | OpenFreeMap |
| IP address, when your email app loads the logo or the font in one of our emails | To show our emails in our own brand. We do not use it to count who opens an email. | Legitimate interests | We do not store it and we do not log it. Cloudflare serves the file and keeps its own access logs. | Cloudflare |
| Browser signals for the spam check | To stop bots from sending our forms. | Legitimate interests | We keep none. Cloudflare uses them for the check. | Cloudflare Turnstile |
If you contact us
| Data | Why we hold it | Lawful basis | How long we keep it | Who handles it |
|---|---|---|---|---|
| Your message: your name, email address, text and business name if you give it | To reply to you. | Legitimate interests | We do not store it on our servers. It stays in our mailbox for 2 years after our last reply. | Cloudflare, Resend, Microsoft 365 |
If you are an Areacodes admin
| Data | Why we hold it | Lawful basis | How long we keep it | Who handles it |
|---|---|---|---|---|
| Admin action record: what was done to a Business, a Voucher, a Redemption, a Membership or an Invitation — the email address of the member or the invited owner where the action was taken on one — who did it, when, and the reason typed at the time, if one was asked | To keep a record of every oversight decision and every onboarding step, so a suspension, closure, hard kill, reversal or Invitation can be accounted for. | Legitimate interests | For as long as we hold the Business. Backups keep it for 90 more days. | Cloudflare, Backblaze B2 |
| Admin email address: on the allowlist that makes you an Admin, and on your sign-in sessions | To sign you in to the admin portal, and to prove that only you can reach it. | Legitimate interests | Until the address is taken off the allowlist. Sessions end after 7 days, and we delete them when they end. Records that limit sign-in codes and wrong codes for your address expire after 1 day at most. Backups keep the sign-in record for 90 more days. Fault reports keep your user ID for 30 days. | Cloudflare, Resend, Sentry, Backblaze B2 |
When you delete your account
When you delete your account, we delete your email address, your name, your sign-in sessions and your push tokens. We cancel the Claims that you did not use.
We keep the record of each Redemption, because it shows a Business the visits that Areacodes brought. The record keeps the text of the offer as it was when you claimed it. After our backups expire, 90 days later, nothing connects a Redemption to you.
If nobody uses an account for 24 months, we send an email 30 days before we delete it in the same way.
Who handles your data
These companies handle personal data for us. A processor uses the data only as we tell it to. An independent controller uses the data under its own privacy policy.
Apple is an independent controller for Sign in with Apple. OpenStreetMap Nominatim finds the map position of a Business address. It gets the address only.
Some of these companies are in the US. When we send data to the US, we use the safeguards that UK law requires.
| Company | Role | What it does | Where |
|---|---|---|---|
| Cloudflare | Processor | Runs our servers, database, image storage and logs. | Stored data in the EU. Requests go to the nearest Cloudflare site. |
| Cloudflare Workers AI | Processor | Checks each new Business image and flags images for our review. It does not keep or train on them. | Cloudflare network |
| Cloudflare Turnstile | Processor | Checks that a form on this site is sent by a person, not a bot. | Cloudflare network |
| Cloudflare Web Analytics | Processor | Counts visits to this site and to our map site, with no cookies. | Cloudflare network |
| Resend | Processor | Sends our emails: sign-in codes, no-account notes, warnings before we delete an unused account, messages from our forms, and business portal Invitations and First Redemption emails. | US |
| Microsoft 365 | Processor | Holds our mailbox, ten@acbrighton.com. | UK and EU |
| Sentry | Processor | Collects fault reports. It stores no IP address. | EU (Germany) |
| Backblaze B2 | Processor | Holds our encrypted nightly backup of the database. | EU (Netherlands) |
| Expo | Processor | Sends pushes to your phone and delivers app updates. It keeps no push text after delivery. | US |
| Apple | Independent controller | Runs Sign in with Apple and delivers pushes to iPhones. | Ireland and US |
| Independent controller | Publishes our app on Google Play. | Ireland and US | |
| Google Firebase Cloud Messaging | Processor | Delivers pushes to Android phones. Expo hands each push to it. | US |
| OpenStreetMap Nominatim | Independent controller | Finds the map position of a Business address, one time. | UK and Netherlands |
| OpenFreeMap | Independent controller | Draws the map in our app and on our map site, and the map an admin puts the Business pin on. It gets your IP address, the name of your browser or app and the part of the map that is on screen. | Europe |
Cookies
This site sets no cookies for analytics or advertising. Cloudflare Web Analytics counts visits without cookies, so this site shows no cookie banner.
Our forms use Cloudflare Turnstile to stop bots. Turnstile is strictly necessary, and it does not track you. When you delete your account on this site, a sign-in cookie keeps you signed in until the deletion is complete. That cookie is also strictly necessary.
Your rights
You have the right to:
- Get a copy of your personal data.
- Correct data that is wrong.
- Erase your data.
- Limit how we use your data.
- Object when we use your data for our legitimate interests.
- Get your data in a format that a computer can read.
- Withdraw your consent at any time. This does not change what we did before.
To use a right, send an email to ten@acbrighton.com from the email address of your account. If you send it from a different address, we send a code to your account address first. We reply in one month or less.
How to erase your data
If you use the app, open the app and delete your account. You can also delete it on our delete account page.
If you are a Business member, a Business owner or a person in a Business image, send an email to ten@acbrighton.com. Tell us which data to erase.
How to complain
Send your complaint to ten@acbrighton.com. We tell you that we have your complaint in 30 days or less.
You can also complain to the Information Commissioner's Office (ICO). Go to ico.org.uk/make-a-complaint or call 0303 123 1113.