§ PRIVACY POLICY
What we collect. What we don't.
Plain English. Every field, every vendor, every retention window. If you cannot tell from this page exactly what data we hold and why, write to compliance@hotmessldn.com — we will rewrite this page until it's clear.
UPDATED 19 MAY 2026 · VERSION v1.0 · SMASH DADDYS LTD · REGISTERED IN ENGLAND
§ 01 · WHO WE ARE
Smash Daddys Ltd is the data controller.
Smash Daddys Ltd (registered in England, registered office available on request via compliance@hotmessldn.com) operates HOTMESS and is the data controller for all personal information described in this policy. We are accountable to the UK Information Commissioner's Office (ICO) and to you.
For all data-protection matters, including subject access requests, objections, complaints, and erasure requests, write to compliance@hotmessldn.com. We respond within 30 calendar days as required by UK GDPR Article 12.
§ 02 · WHAT WE COLLECT
The minimum needed to ship the feature you asked for.
We collect three categories of personal data, listed exhaustively below. We do not collect anything else. If a feature changes and we need new data, the page asking for it will state so before you submit.
Category A — Account data
- Email address (required) — used to contact you about your account and to send the welcome email.
- Full name (required at signup) — appears on your profile and in our records.
- Claimed username (required) — public; permanent as long as the account remains in good standing.
- City (London / Manchester / Brighton / Other) — used for regional cohort analytics in aggregate only.
- Date of birth or age confirmation — required to confirm you are 18 or older.
- Instagram handle (optional) — if you give it.
- Referrer string (optional) — free-text field if you tell us how you heard about us.
Category B — Technical data
- IP address — captured at signup for fraud prevention and rate-limiting. Stored in
founding_member_waitlist.ip_address. Deleted 90 days after account closure. - User agent string — captured at signup for the same reason. Same retention as IP.
- Cookies — see the Cookies Policy for the exhaustive list.
Category C — Optional / feature-specific data
- Trusted contacts — if you use the Safety Suite, the contact names, phone numbers, and emails you nominate. Stored in
trusted_contacts. You can delete each contact at any time; deletion is immediate. - Coarse location — only if you enable Pulse presence or live-location sharing. Coordinates are precision-limited before storage; never reverse-lookupable to addresses or venue names. See the anti-surveillance commitment in § 04.
- Recovery presence state — only if you opt in. Treated as identity, not risk; never surfaced beyond the surfaces you control.
§ 03 · WHY WE COLLECT IT
Lawful basis per UK GDPR Article 6.
| Data | Lawful basis | Purpose |
|---|---|---|
| Account data (Category A) | Contract (Art. 6(1)(b)) | Provide the platform you signed up for. |
| Technical data (Category B) | Legitimate interest (Art. 6(1)(f)) | Prevent fraud, abuse, and rate-limit signups. |
| Trusted contacts | Consent (Art. 6(1)(a)) | Send Safety Suite notifications you initiate. |
| Coarse location | Consent (Art. 6(1)(a)) | Render Pulse presence / live-location share. |
| Recovery state | Explicit consent (Art. 9(2)(a)) — special category | Surface recovery-aware UI you control. |
§ 04 · WHAT WE WILL NEVER DO
The anti-surveillance commitment.
HOTMESS users are queer Londoners. Queer Londoners are surveilled — by states, by police forces, by ad networks, and by extractive platforms that treat queer presence as a market. This is the load-bearing ethical posture that prevents HOTMESS from joining that list.
- We will never sell, licence, or transfer personal data to a third party for advertising, attribution, audience-building, or analytics enrichment.
- We will never aggregate behavioural data to outsiders. No "queer London engagement" reports, no demographic enrichment files.
- We will never run third-party tracking pixels. No Google Analytics, no Meta pixel, no LinkedIn insight tag, no TikTok pixel, no Amplitude, no Heap, no Mixpanel, no Hotjar.
- We will never reverse-lookup anonymised coordinates to venue names for any user-visible feature.
- We will never deduce sensitive attributes (sobriety, HIV status, sexual practice, religion) from behavioural signals.
- We will never share data with law enforcement outside valid UK legal process; documented response procedure in our internal le-requests doctrine.
- We will never accept ad-tech, attribution, or "engagement intelligence" vendor offers. Each refusal is logged.
§ 05 · WHO PROCESSES YOUR DATA
Three vendors. Each with a UK / EU-bound DPA.
We use the smallest set of vendors that can deliver the platform. Each is a data processor under our written agreement, processing only what is described below.
- Supabase (Supabase Inc., EU-region project) — primary database, authentication, file storage, and realtime fan-out. Stores Categories A and C above. Processes Category B for fraud-prevention only. DPA: Supabase standard processor agreement, EU SCCs in place.
- Resend (Resend, Inc.) — transactional email delivery only. Processes email address + the email body we generate at the moment of send. Does not retain bodies beyond the standard transactional log window.
- Stripe (Stripe Payments UK Ltd.) — partner-tier checkout only. Processes name, email, billing address, card details, and the tier code you select. HOTMESS never sees your card details. Stripe is its own controller for payment compliance.
- Vercel (Vercel Inc.) — application hosting. Processes IP address + user agent for routing only, per Vercel's standard processor agreement.
We do not use Google Workspace, Microsoft 365, Mailchimp, SendGrid, HubSpot, Salesforce, Pipedrive, Notion, Airtable, Slack analytics, Linear analytics, Segment, or any other "growth stack" vendor for member or partner data.
§ 06 · WHERE YOUR DATA LIVES
Primary storage is in EU-region Supabase infrastructure (eu-west-2). Stripe processes payment data in the UK / EU. Resend operates in US infrastructure under the appropriate transfer mechanisms (UK IDTA / EU SCCs). Vercel operates globally; HOTMESS edge functions are configured to prefer EU regions where the platform allows.
§ 07 · HOW LONG WE KEEP IT
| Data | Retention |
|---|---|
| Account data (active) | Until you delete the account. |
| Account data (after deletion) | Erased within 30 days; legal hold only where statutorily required (e.g. accounting records for partner payments). |
| IP + user agent | 90 days after account closure. |
| Trusted contacts | Until you remove the contact. Removal is immediate. |
| Coarse location for Pulse | Session-bounded. Not persisted between sessions. |
| Live-location share | Time-bounded by the share window you set. Deleted at expiry. |
| Beacons (your dropped events) | 24 hours by default; configurable per beacon up to 7 days. |
| Logs (Vercel platform) | Platform default (rolling 24 hours of detailed logs; aggregate-only beyond). |
| Partner payment records | 7 years (UK statutory minimum for accounting). |
§ 08 · YOUR RIGHTS
UK GDPR rights, exercisable at compliance@hotmessldn.com.
- Right of access (Article 15) — get a copy of all personal data we hold about you. Response within 30 days, free.
- Right to rectification (Article 16) — correct anything wrong.
- Right to erasure (Article 17) — delete your account and associated data. Caveats only where law requires we keep records (accounting, dispute history).
- Right to restriction (Article 18) — pause processing while a dispute is resolved.
- Right to portability (Article 20) — export your data in a machine-readable format.
- Right to object (Article 21) — object to processing based on legitimate interest. We honour or explain why we can't.
- Right to withdraw consent — at any time, in one click, for every consent-based feature.
- Right to lodge a complaint with the UK ICO. We'd rather you write to us first, but the right exists.
§ 09 · CHILDREN
HOTMESS is for adults. We require an 18-or-older affirmation at signup. We do not knowingly collect data from anyone under 18. If you believe a minor has signed up, write to compliance@hotmessldn.com and we will erase the account immediately.
§ 10 · CHANGES TO THIS POLICY
We will notify you of material changes by email to the address on your account at least 14 days before they take effect. Cosmetic changes (typos, link fixes) are made in place; the version + updated date at the top of this page always reflects the current state.
§ 11 · CONTACT
All data-protection enquiries: compliance@hotmessldn.com. General questions: care@hotmessldn.com. Founder: phil@hotmessldn.com.
IN MEMORY OF DJ LEE HARRIS · CO-FOUNDER, IN SPIRIT