Privacy notice

The short version

• We use your email to send you sign-in codes and, if you ask, your picks.
• We use what you tell us (prizes, budget, sites, timing) and what you do (clicks, entries) to pick better draws for you.
• We make combined, anonymous market reports about UK comps and sell them to competition sites. Every figure covers at least 20 players. Nobody ever gets your name, email or anything about you personally. You can opt out in your account.
• We never sell or share your personal details, and we never store your IP address.
• One exception, only if you allow marketing cookies: when you make an account and when your email is confirmed, we tell Meta (Facebook and Instagram), with a scrambled (hashed) copy of your email, so Meta can tell whether one of our ads brought you. Without that consent, Meta gets nothing.
• You can download everything we hold, or delete your account, from your account page.

Who we are

[legal name (to follow before launch)], trading as DrawHawk, of Shernden Manor, Shernden Lane, Marsh Green, Edenbridge, Kent TN8 5PS. We decide how your data is used, so we're the "controller" under UK GDPR. Contact us about anything here at hello@drawhawk.com.

What we collect

• Account: your email address, when you confirmed you're 18+ and in the UK, your choices about emails, and a referral code.
• Preferences: the prizes you like, your budget, sites you switched on or off, alerts, and when you want emails.
• About you: your first name (only to say hi; nobody else sees it), your age and when you gave it, and where in the UK you live (or that you'd rather not say). We store your age to keep DrawHawk 18+ and, as age bands only, for anonymous research. If you give an age under 18, we delete your account and keep only a count that it happened, never the age.
• Profile (optional): how often you enter, how you heard about us, whether you'd like to join the panel, and survey answers.
• Entries and wins you log in My record, and your monthly limit.
• Reviews, problem reports and draw result reports you send us.
• Your watchlist, saved searches and prize requests.
• Clicks on our links (which draw, from where, when), with your browser's user agent stored only as a scrambled hash.
• Email events: whether a picks email was delivered, opened or bounced.
• If you allow marketing cookies: Meta's cookies (_fbp, and _fbc if you came from one of our ads); on your account, the date you allowed marketing (cleared if you change your mind) and the dates we told Meta about your sign-up and your confirmed email.
• Searches you make on DrawHawk (kept without your name if you delete your account).
• Free monthly draw entries, votes and survey answers.
• If you run a competition site and make an operator account: your name, work email, company, the sites you claim, how you proved you run them, and a record of our decisions. Operator accounts are kept separate from player accounts.
• Technical data: to stop abuse we keep scrambled (hashed) versions of email addresses and IP addresses for 24 hours after a sign-in attempt. We never store your IP address itself. We also count, without any email or name, how often sign-in codes are asked for and sent again.
• If you join the DrawHawk Plus waitlist: which features you'd use, your answer about the price and any note. If you join without an account, just your email address and those answers. We use that email once, to tell you Plus is ready.
• If you buy DrawHawk Plus: your plan, its status and dates (started, renews, ends), any refund, when you ticked "Start Plus now", and the reason you gave if you cancelled. Stripe holds your card details; we never see them.
• If you turn on phone alerts (Plus): the address your browser gives us for sending notifications to that device, its two encryption keys, and a short label like "iPhone Safari" (never your full browser details). Turn them off on the device or in your account and it's deleted; it's also deleted when the browser says it's no longer valid. Our notification helper (a small script in your browser) only shows alerts and sets no cookies.

Why, and our lawful basis

• To run your account and send your picks (contract: it's the service you signed up for).
• To send picks emails and alerts (consent: you ticked the box, and you can untick it any time).
• Analytics cookies (consent: only if you allow analytics on the cookie banner; Reject or change your mind any time).
• Marketing cookies and telling Meta about your sign-up and confirmed email (consent: only if you allow marketing on the cookie banner; change your mind any time with "Cookie settings" at the bottom of every page, and we stop telling Meta anything more).
• Error reports, so we can fix what breaks (legitimate interests: no cookies, no tracking, personal details stripped out).
• To improve the picks, learn your best send times, and keep DrawHawk secure and free of fraud (legitimate interests).
• To make combined, anonymous market research for competition sites (legitimate interests: it pays for the free service; it never identifies you; you can opt out).
• To run the free monthly draw and contact the winner (contract: the free draw terms).
• To keep records the law requires, and to deal with complaints (legal obligation).
• To sell and run DrawHawk Plus (contract: the Plus terms), and to keep payment records the law requires (legal obligation).

What competition sites see

Only combined figures, for groups of 20 players or more, counted after anyone who has opted out (and anyone who has deleted their account) is removed. Never names, emails, your entries, or anything that could identify you.

To opt out of market research, switch it off in your account settings. It doesn't change your picks.

Who helps us run DrawHawk

These companies process data for us, under contracts that only let them use it to provide their service to us:

• Supabase: our database and sign-in. Data stored in London, UK.
• Vercel: hosts the website. Our pages run in London, UK (Vercel Inc., USA).
• Resend: sends our emails, from Ireland (Resend Inc., USA).
• Cloudflare: our domain, email forwarding, and the bot check on sign-up (Cloudflare Inc., USA, global network).
• PostHog: website analytics, only if you allow analytics cookies. EU hosting (Germany).
• Meta Platforms Ireland Ltd: measures which of our ads on Facebook and Instagram led to sign-ups, only if you allow marketing cookies. When you make an account we send Meta a sign-up event, and when your email is confirmed an email-confirmed event, each with a hashed copy of your email, a hashed player number, Meta's own cookie ids and, from the browser you signed up on, your IP address and browser details (passed on, never stored by us). For collecting and sending this, we and Meta are joint controllers; for measuring our ads, Meta acts for us under its Business Tools terms. Meta may move data to the USA under the UK Extension to the EU-US Data Privacy Framework.
• Sentry: error reports, so we can fix bugs, and page-speed timing on about 1 in 10 page loads. EU hosting (Germany). Emails, codes, links and IP addresses are removed; it sets no cookies.
• Stripe: card payments for DrawHawk Plus (only if you choose it) and, from December, for competition sites that buy reports. Stripe holds your card details; we never see or store them. Stripe operates in the UK, Ireland and the USA.

Where data goes outside the UK, it's protected by UK adequacy regulations or the UK's approved contract terms.

How long we keep it

• Your account, preferences, profile, record and reviews: until you delete your account.
• Clicks and email events: 2 years, then deleted or made anonymous.
• Sign-in abuse checks (hashed): 24 hours.
• Free draw entries and results: 2 years after the draw (to show it was run fairly). Published entry lists contain no personal data.
• Addresses that bounced or complained: kept as a scrambled hash only, for as long as we send email, so we never email them again.
• After you delete your account: personal data goes straight away. Backups roll over within 7 days.
• Plus waitlist: until you take yourself off the list or delete your account. Joined without an account? We delete your email address 30 days after the one email telling you Plus is ready, or sooner if you ask at hello@drawhawk.com.
• Your Plus subscription details: until you delete your account, when we cancel the subscription and delete our copy. Stripe keeps its own payment records for as long as the law requires.

Your rights

You can ask to see, correct, delete or move your data, object to how we use it (including the market research), and withdraw consent at any time. Most of this you can do yourself: "Download my data" and "Delete my account" are on your account page, and every email has an unsubscribe link.

For anything else, email hello@drawhawk.com. We'll reply within a month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113. We'd like the chance to fix it first.

Children

DrawHawk is for adults only. We don't knowingly hold data about anyone under 18; if we find we do, we delete it.

Changes

If we change this notice in a way that matters, we'll email you before it takes effect.