Privacy policy
This policy tells you what personal data Areacodes holds, why we hold it and how long we keep it.
Who we are
AREA CODES LTD is the controller of your personal data. Our company number is 17312325. Our registered office is 1 Bond Street Cottages, Brighton BN1 1RP.
To speak to us about your data, send an email to ten@acbrighton.com.
The App Store shows our founder as the seller of the Areacodes app. Our founder publishes the app for AREA CODES LTD, and AREA CODES LTD is the controller.
Version: 18 September 2026
Who can use the app
You must be 16 or over to use the Areacodes app. We do not ask for your date of birth.
The data we hold
These tables show each type of personal data, why we hold it, our lawful basis and how long we keep it. Backups are included.
If you use the Areacodes app
| Data | Why we hold it | Lawful basis | How long we keep it | Who handles it |
|---|---|---|---|---|
| Email address | To sign you in, and to send you sign-in codes. | Contract | Until you delete your account, or 24 months after you last use the app. We email you 30 days before that. Backups keep it for 90 more days. | Cloudflare, Resend, Backblaze B2 |
| Name, if Sign in with Apple gives it | To set up your account. | Contract | Until you delete your account, or 24 months after you last use the app. We email you 30 days before that. Backups keep it for 90 more days. | Cloudflare, Apple, Backblaze B2 |
| Apple account ID, if you use Sign in with Apple | To sign you in with Apple. | Contract | Until you delete your account, or 24 months after you last use the app. We email you 30 days before that. Backups keep it for 90 more days. | Cloudflare, Apple, Backblaze B2 |
| Sign-in code | To make sure that you own the email address. If our delete account page gets an address that has no account, we send a note in place of the code. | Contract | The code expires after 5 minutes. A record that stops repeat codes to your address stays until you ask for a new code. Backups keep both for 90 more days. | Cloudflare, Resend |
| Sign-in session: a session key and the name of your phone's or browser's software | To keep you signed in. | Contract | Until you sign out or delete your account, or 400 days after you last use the app. A session from our delete account page stops when the deletion stops. | Cloudflare, Backblaze B2 |
| Account number: a random ID | To connect your Claims and Redemptions to your account, and to find faults. | Legitimate interests | Kept. After you delete your account and the backups expire, nothing connects it to you. | Cloudflare, Sentry, Backblaze B2 |
| Your phone's location, if you let the app use it | To show the Businesses nearest to you first. | Legitimate interests | Not kept. We use it for that one request only. | Cloudflare |
| Claims and Redemptions: the Voucher, the Business, the time, the discount and the price you paid | To give you the offer, and to show each Business the verified visits that Areacodes brought. | Legitimate interests | Kept as a record. After you delete your account and the backups expire, nothing connects it to you. | Cloudflare, Backblaze B2 |
| The last time you used the app | To delete accounts that nobody uses for 24 months. | Legitimate interests | Until your account is deleted. Backups keep it for 90 more days. | Cloudflare, Backblaze B2 |
| Push consent and push tokens | To send you pushes about new places and Claims that expire soon, only if you agree. | Consent | A push token goes when you sign out or delete your account, or 270 days after your phone last connects. Your consent record goes when you delete your account. Backups keep both for 90 more days. | Cloudflare, Expo, Apple, Backblaze B2 |
| Fault reports, with your account number only | To find and repair faults. | Legitimate interests | 30 days in Sentry. 7 days or less in our server logs. | Sentry, Cloudflare |
If you use the business portal
| Data | Why we hold it | Lawful basis | How long we keep it | Who handles it |
|---|---|---|---|---|
| Email address, and sign-in sessions with the name of your browser | To sign you in to the business portal, to email you the Invitation that tells you how, and to email you once when your Business gets its first Redemption. | Contract | Until we remove your access, or your Business closes and you have no other Business. Sessions end after 30 days. Backups keep it for 90 more days. Fault reports keep your user ID for 30 days. | Cloudflare, Resend, Sentry, Backblaze B2 |
| Invitation: your email address and the Business | To let you join your Business on the portal. | Contract | 30 days after you accept it or it expires. Backups keep it for 90 more days. | Cloudflare, Resend, Backblaze B2 |
If you own a Business on Areacodes
| Data | Why we hold it | Lawful basis | How long we keep it | Who handles it |
|---|---|---|---|---|
| Business terms acceptance: the version of the Business terms that you accepted, and the time | To show that your Business agreed to the Business terms, and to ask again when they change. | Contract | Until we remove your access, or your Business closes. Backups keep it for 90 more days. | Cloudflare, Backblaze B2 |
| Business contact details: phone number, email address, website, Instagram and other links | To show the Business to people who use the app, and to contact the owner. | Contract | Until the Business closes. At closure we delete them and change the Business name to "Closed business". Backups keep them for 90 more days. | Cloudflare, Backblaze B2 |
| Business address and its map position | To show the Business on the map, and to make sure it is in Brighton and Hove. | Legitimate interests | As long as the Business record, because its Redemptions point to it. Backups keep it for 90 more days after a change. | Cloudflare, OpenStreetMap Nominatim, Backblaze B2 |
If you are in a Business image
| Data | Why we hold it | Lawful basis | How long we keep it | Who handles it |
|---|---|---|---|---|
| Business images where you can be seen | To show the Business to people who use the app. We remove location and camera data from the file before it reaches us. | Legitimate interests | Until the Business removes the image or closes. If we remove an image for moderation, we keep it for 90 days. If you ask us to erase it, we delete it immediately. | Cloudflare, Cloudflare Workers AI |
If you visit this site
| Data | Why we hold it | Lawful basis | How long we keep it | Who handles it |
|---|---|---|---|---|
| Visit data: the page, the referring site, your browser and your country | To count visits to this site. | Legitimate interests | Cloudflare keeps it. We see totals only and keep no copy, so none of it is in our backups. | Cloudflare Web Analytics |
| IP address | To limit how many messages one connection can send. | Legitimate interests | Not stored and not logged. We use it for the limit check only. | Cloudflare |
| Browser signals for the spam check | To stop bots from sending our forms. | Legitimate interests | We keep none. Cloudflare uses them for the check. | Cloudflare Turnstile |
If you contact us
| Data | Why we hold it | Lawful basis | How long we keep it | Who handles it |
|---|---|---|---|---|
| Your message: your name, email address, text and business name if you give it | To reply to you. | Legitimate interests | We do not store it on our servers. It stays in our mailbox for 2 years after our last reply. | Cloudflare, Resend, Microsoft 365 |
When you delete your account
When you delete your account, we delete your email address, your name, your sign-in sessions and your push tokens. We cancel the Claims that you did not use.
We keep the record of each Redemption, because it shows a Business the visits that Areacodes brought. The record keeps the text of the offer as it was when you claimed it. After our backups expire, 90 days later, nothing connects a Redemption to you.
If nobody uses an account for 24 months, we send an email 30 days before we delete it in the same way.
Who handles your data
These companies handle personal data for us. A processor uses the data only as we tell it to. An independent controller uses the data under its own privacy policy.
Apple is an independent controller for Sign in with Apple. OpenStreetMap Nominatim finds the map position of a Business address. It gets the address only.
Some of these companies are in the US. When we send data to the US, we use the safeguards that UK law requires.
| Company | Role | What it does | Where |
|---|---|---|---|
| Cloudflare | Processor | Runs our servers, database, image storage and logs. | Stored data in the EU. Requests go to the nearest Cloudflare site. |
| Cloudflare Workers AI | Processor | Checks each new Business image and flags images for our review. It does not keep or train on them. | Cloudflare network |
| Cloudflare Turnstile | Processor | Checks that a form on this site is sent by a person, not a bot. | Cloudflare network |
| Cloudflare Web Analytics | Processor | Counts visits to this site, with no cookies. | Cloudflare network |
| Resend | Processor | Sends our emails: sign-in codes, no-account notes, messages from our forms, and business portal Invitations and First Redemption emails. | US |
| Microsoft 365 | Processor | Holds our mailbox, ten@acbrighton.com. | UK and EU |
| Sentry | Processor | Collects fault reports. It stores no IP address. | EU (Germany) |
| Backblaze B2 | Processor | Holds our encrypted nightly backup of the database. | EU (Netherlands) |
| Expo | Processor | Sends pushes to your phone. It keeps no push text after delivery. | US |
| Apple | Independent controller | Runs Sign in with Apple and delivers pushes to iPhones. | Ireland and US |
| OpenStreetMap Nominatim | Independent controller | Finds the map position of a Business address, one time. | UK and Netherlands |
Cookies
This site sets no cookies for analytics or advertising. Cloudflare Web Analytics counts visits without cookies, so this site shows no cookie banner.
Our forms use Cloudflare Turnstile to stop bots. Turnstile is strictly necessary, and it does not track you. When you delete your account on this site, a sign-in cookie keeps you signed in until the deletion is complete. That cookie is also strictly necessary.
Your rights
You have the right to:
- Get a copy of your personal data.
- Correct data that is wrong.
- Erase your data.
- Limit how we use your data.
- Object when we use your data for our legitimate interests.
- Get your data in a format that a computer can read.
- Withdraw your consent at any time. This does not change what we did before.
To use a right, send an email to ten@acbrighton.com from the email address of your account. If you send it from a different address, we send a code to your account address first. We reply in one month or less.
How to erase your data
If you use the app, open the app and delete your account. You can also delete it on our delete account page.
If you are a Business member, a Business owner or a person in a Business image, send an email to ten@acbrighton.com. Tell us which data to erase.
How to complain
Send your complaint to ten@acbrighton.com. We tell you that we have your complaint in 30 days or less.
You can also complain to the Information Commissioner's Office (ICO). Go to ico.org.uk/make-a-complaint or call 0303 123 1113.