We collect four things, and one of them is about somebody else.

If you pay for a listing, we keep your email address so we can tell you when somebody outbids you. If you use the site at all, your IP address sits in a rate limit table for a while so nobody can hammer us. Our analytics sets one cookie. And if you or anybody else runs the AI readiness check on a website, we store that result and publish it at a permanent public address.

That last one is the unusual item, it is about a website rather than about you, and it has its own section below.

We ask for it once, at checkout, and it is never displayed anywhere on this site. It exists so we can send you the one message that matters: somebody has paid more than you and you are no longer the #1. The rules page says the same thing in its own words.

We also hold an address when you list free, when you ask for a category, and when you set up a standing instruction to buy your position back. Same rule in every case: it is used to write to you about that thing, and it is not shown to anyone.

The lawful basis is performing the contract you entered when you paid. We do not send marketing, we have no mailing list, and there is nothing to unsubscribe from.

Every part of this site that costs us money or reaches out to somebody else’s server is rate limited, and a rate limit has to count something. It counts your IP address, stored as a row like checkout:203.0.113.9 with a window and a tally.

The lawful basis is our legitimate interest in not being used to attack other people, which is not a phrase we enjoy writing but is exactly what the rate limits prevent. Nothing else reads those rows and they are not joined to anything about you.

One, set by our analytics provider, so a visit can be counted once rather than twice and so a payment can be attributed back to the visit that produced it. Two other things exist and you should hear them from us rather than find them: signing in to the admin area sets a session cookie, which only the one person who runs this site can do, and the live visitor count keeps a random id in your browser’s session storage rather than in a cookie, which counts your tab, is attached to no name and is deleted a minute after you stop reading. We do not run advertising trackers and we do not sell anything about you to anybody.

Blocking it costs you nothing on this site. Everything works the same without it and we would rather say that than pretend otherwise.

The AI readiness check reads a website’s public homepage and its robots.txt, the way any visitor could, and grades how legible it is to assistants. We store that result and publish it at a permanent address that search engines can index.

Anybody can run that check on any website, including one they do not own. The result is built entirely from public files, and it is a judgement about a website rather than about a person. But for a sole trader whose site carries their own name, those are not always different things, and we would rather name that than let it sit unsaid.

So the rule is simple and it does not require you to prove anything. Every scan page has a link that takes it down. We do not ask who you are, we do not ask for a reason, and we do not ask for an email address, because collecting personal data in order to process a request to stop processing personal data would be absurd. Once removed, the page stops existing and leaves our sitemap.

Five companies, each doing one job. Our payment provider is the merchant of record and handles the card details, which never reach us at all. One service delivers our email. One hosts the site, the database and the images. One counts visits. One provides the language model used to screen submitted category names.

None of them is sent more than the job requires, and none of them is permitted to use it for anything else. We do not sell, rent or share personal data with anyone for their own purposes, and there is no arrangement under which we could.

Honestly: for now, until you ask us to delete it. This site has no automated retention schedule, and saying it has one would be the kind of claim this page exists to avoid.

A listing and its payment record are kept while the listing is on a board, because that record is the proof of what was paid and it is what a refund or a chargeback is checked against. Rate limit rows are pruned. Scan results are kept until somebody takes them down.

If you are in the UK or the EU, you have the right to see what we hold about you, correct it, have it deleted, object to us holding it, and take a copy elsewhere. You can complain to your data protection authority. In the UK that is the Information Commissioner’s Office.

We do not treat those as rights that only apply to people who happen to live in the right place. Ask, and we will do it.

One thing worth knowing before you ask us to delete a paid listing: the listing is a public advertisement and the payment record is what makes the board honest. We can remove the listing and the email address behind it. The fact that a sum of money was paid on a board on a date stays, because a ranking decided purely by money is worth nothing if the record of the money can be edited.

For a scan page, use the take it down link on the page itself. It works immediately and it asks you for nothing.

For anything else, the routes are on the contact page, along with an honest note about the state of the address on it. Decidedbymoney is run by one person, so it is that person who reads it and that person who does the deleting.