Privacy Policy
Effective 13 September 2026
1. Who we are
This policy explains what personal data Holyrood Watch (“we”, “us”) collects, why, and your rights over it. We act as data controller, and you can reach us at hello@holyroodwatch.com.
2. What we collect
- Email address — when you create an account and sign in.
- Password — only if you choose to sign up with one. It passes through our server to Supabase Auth, which stores a hash of it rather than the password itself. We never store your password.
- Google account details — if you sign in with Google, Google gives us your email address and basic profile information. We never see your Google password.
- Alerts — the keyword, portfolio, and topic criteria you set for a standing alert.
- Watched questions — which written questions you’ve chosen to watch.
- Subscription status — free or Pro, linked to your Stripe customer ID. We don’t see or store your card details — Stripe handles those directly.
We don’t use analytics or tracking cookies. The only cookies set are strictly necessary ones: keeping you signed in, completing Stripe checkout, and the Cloudflare bot check on the sign-in and sign-up forms.
3. Why we collect it
- To let you sign in and manage your account.
- To send you the morning briefing and watch-notification emails you’ve asked for.
- To operate the Pro subscription (billing, upgrades, cancellations).
- To enforce free-tier limits.
4. Who we share it with
We use the following processors. None of them may use your data for their own purposes.
| Processor | What they receive | Purpose |
|---|---|---|
| Supabase | Email address, alerts, watched questions, subscription record | Authentication, database hosting |
| Resend | Email address | Sending briefings and notification emails |
| Stripe | Email address, payment details (held by Stripe, not us) | Subscription billing |
| Vercel | IP address (in server logs), email address (via app requests) | Application hosting |
| Email address, basic profile information | Sign-in, if you choose to sign in with Google | |
| Cloudflare | IP address, browser characteristics | Bot check on the sign-in and sign-up forms |
| Upstash | IP address, email address | Short-lived counters that rate-limit the auth endpoints |
| Sentry | Diagnostic data about errors (see note below) | Error monitoring |
Two of these are narrower than the table alone suggests. Sentry is configured not to send personal data — no IP addresses, no user identifiers, and no session recording — so it receives information about errors rather than about you. The Upstash counters are keyed on your IP address or email address and expire within minutes; they hold nothing else.
5. Where your data is stored
Your data is stored on our processors’ infrastructure, which may be located outside the UK. Where it is, we rely on those processors’ standard contractual safeguards.
6. How long we keep it
We keep your account data for as long as your account is active. If you delete your account, we delete your alerts, watched questions, and subscription linkage; we may retain minimal billing records Stripe requires us to keep for legal or tax reasons.
7. Your rights
Under UK GDPR you can ask us to:
- Access the personal data we hold about you.
- Delete your account and associated data.
- Correct inaccurate data.
- Export your data.
To exercise any of these, email hello@holyroodwatch.com. You can also complain to the ICO if you’re unhappy with how we handle your data.
8. Children
Holyrood Watch isn’t intended for anyone under 16.
9. Changes
We’ll update the effective date above and notify users by email of material changes.