Privacy notice
Version 2, 14 October 2026.
Who we are
Ceaselist is a trading name of Noverquis Ltd (company number 17521667, registered in England and Wales; registered office 37 Longfellow Way, London SE1 5TB). We are the controller of the personal data described here. We have paid the ICO data protection fee, and our registration is being added to the ICO's public register. Contact: [email protected]. We are not required to appoint a data protection officer; privacy@ reaches the person responsible.
What we hold, why, and our lawful basis
| Information | Why | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Your sign-in email address | To run your account and send sign-in links, service emails and renewal reminders | Contract (6(1)(b)) |
| The details you choose to share: name, other spellings, confirmed email addresses, and optionally address, phone, year of birth and company links | To identify you to each organisation so it can find and delete your records. You decide which types of organisation may see which details. | Contract (6(1)(b)) |
| Your signed authority to act | To prove to organisations that we act for you, and to defend ourselves if that is challenged | Contract; legitimate interests in establishing and defending legal claims (6(1)(f)) |
| Organisations' replies and our messages to them | To track each request, answer organisations, and prepare complaint packs if they ignore you | Contract (6(1)(b)) |
| Referral records (which customer's invite link a new customer used, payments counted towards a reward, credit earned) | To give the friend discount and credit, and to prevent abuse. The inviter is told only how many friends have subscribed, never who. | Contract; legitimate interests in preventing abuse (6(1)(f)) |
| Billing records (Stripe customer ID, subscription status) | To take payment and keep accounting records | Contract; legal obligation (6(1)(c)) for tax records |
| Security and service logs (IP address, browser, actions in your account) | To keep the service secure, prevent abuse and fix faults | Legitimate interests (6(1)(f)) |
We do not sell, rent or share your data for marketing, and we do not send you marketing. We never send an identity document to anyone without your approval each time. The service is not for people under 18.
Who we share it with
- Organisations you ask us to contact (data brokers you have not excluded): only the details you allowed for that type of organisation.
- Amazon Web Services (London region): sends and receives email, stores encrypted backups.
- Cloudflare: secure connection to this website.
- Stripe: takes payments. We never see or store your card details. Stripe keeps payment records as the law requires.
- Anthropic (if enabled): helps sort organisations' replies. Your identifiers are replaced with placeholders before any reply is sent to it, and it does not keep the data.
These providers act on our instructions under data processing terms. Where data is handled outside the UK (Stripe, Cloudflare and Anthropic are US-based), we rely on the UK–US data bridge where the provider is certified, or on the ICO's International Data Transfer Agreement or Addendum.
Automated processing
We sort organisations' replies automatically (for example, "deleted" or "asks for more details") so we can act on them quickly. This does not produce decisions with legal or similarly significant effects on you: you approve anything that shares more of your data, our team reviews uncertain cases, and you can flag any status that looks wrong.
Cookies
We use one strictly necessary cookie to keep you signed in. We use no analytics or advertising cookies, so we don't ask for cookie consent.
Security and retention
Your details are encrypted with a key unique to you. When you delete your account, we destroy that key, which makes your stored data unreadable.
- Everything is deleted 30 days after cancellation.
- Encrypted database backups are kept for 35 days.
- Copies of organisations' raw emails are kept for 90 days.
- Records of your signed authority (your name, the date and the text you signed) are kept for 6 years, the limitation period for contract claims.
- Billing records are kept for 6 years for tax purposes.
Your rights
You can ask to access, correct, delete, restrict or move your data, and object to processing based on legitimate interests. Most of this you can do yourself from your account (export, edit, delete), or email [email protected]. We reply within one month. If you are unhappy, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk, or your local supervisory authority if you live in the EEA.
Changes
If we change this notice in a way that matters, we will email you before the change takes effect.