Privacy Policy

2. Information We Collect

The information used depends on the features you choose:

• Account & Contact Data: Full legal name, email address, display name, and avatar preferences.
• Eligibility declarations: Date of birth, country of residence and the time you accept the account terms. These are declarations, not completed independent identity checks.
• Postal entry details: Residential address, postcode, reservation codes, postal confirmation records and any optional telephone number you supply for that route.
• Payments and payouts: Complimentary membership does not require payment card details. For an eligible, approved reward, ChartHigh needs the recipient and bank information necessary to arrange a manual bank transfer, together with relevant verification, approval and payment records. Payment is arranged outside the platform. Before collecting bank or verification details, we will explain the collection method, who receives the information and any additional processing. Do not include bank credentials or identity documents in an ordinary support message. Trust Payments is planned for future subscription billing and is not active.
• Participation and technical data: Challenges saved or reserved, learning activity, account preferences, connection and error records, and technical information such as IP address and browser details. Optional analytics are described below.
• Support & Email Data: Support messages, their category and reference, email delivery records, and the time and status of news email requests, confirmations and cancellations.

3. Lawful Bases for Processing

Under Article 6 of the UK GDPR, we rely on the following lawful bases:

• Providing the requested service: We use account, eligibility and participation details to administer your account, process reservations, verify and pay eligible approved rewards, keep payment records and answer support requests. This processing is necessary to provide the service under our terms. Without the required account or entry details, we cannot complete that account or reservation.
• Legal obligations: Where a specific legal requirement applies, we may need to keep records or respond to a lawful request.
• Legitimate interests: We use necessary security and operational records to prevent misuse, investigate faults and protect accounts. You can object to processing based on these interests.
• Consent: For optional analytics and news emails. News emails require a separate request and confirmation through an email link. You can unsubscribe in your account or from a news email. Withdrawing consent does not affect earlier lawful processing, your account access, or necessary account and support messages.

4. Data Processors & Third-Party Sharing

We do not sell your personal data. The following services help operate ChartHigh:

• Google Firebase: Account authentication, password-reset emails and storage of account, challenge, support and communication records.
• Resend: Delivery of welcome emails, support notifications and receipts, news subscription confirmation and news emails to confirmed subscribers. We provide the recipient address, name where used, message content and delivery identifiers.
• Fasthosts: Hosting our company email inboxes, including support correspondence and replies.
• Manual bank transfers: The banks or payment institutions handling a reward transfer receive the recipient and transaction information needed to process it. We will identify the relevant payment provider and any verification service when arranging a reward payment.
• Vercel: Website hosting and server-side application processing.
• Google Analytics: Optional website usage measurement when you accept analytics cookies.

These providers may process information outside the United Kingdom. Contact us for information about the locations and transfer safeguards applicable to your data. We may also disclose information where a legal obligation requires it.

5. Data Retention & Security

Retention depends on why a record is needed. Account information supports your access while you use the service. Reservations and postal records support challenge administration and the handling of questions or disputes. Verification, reward approval and bank-transfer records support payment administration, questions and any applicable legal record-keeping duties. Support correspondence, security records and consent history may need to be kept after you stop using an account to resolve an outstanding issue, prevent abuse or meet a legal obligation.

Closing a sign-in account does not necessarily erase all separately held operational records immediately. You can request deletion through support; if a record needs to be retained, we will explain the reason. An account balance or reward approval is not proof that a bank transfer has occurred. Actual transfers are recorded separately.

We use HTTPS and access controls to protect account information. Support requests, email delivery records and broker connection credentials are restricted to authorised operations.

6. Cookies and optional analytics

Cookies and local browser storage support sign-in, security and saved preferences. Optional website analytics have a separate choice:

• Necessary storage: Firebase sign-in state, security information and your cookie preference help the service work. Blocking this storage can prevent sign-in or stop preferences being saved.
• Optional analytics: Google Analytics measures website visits and interactions when you choose Accept Analytics. Analytics may use cookies and technical identifiers. Essential Only keeps optional analytics off.
• Your choice: You can change your analytics choice using the site's cookie controls. This is separate from news email consent and does not change your account or challenge reservations.
• Embedded services: Opening a third-party chart, video or external link may involve that provider's own processing. Its privacy and cookie information also applies to the service it provides.

7. Your Rights Under UK GDPR

Depending on the processing and any applicable exceptions, your data protection rights include:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where no statutory override applies.
• Right to Restrict Processing & Object: Request limits on how we process your data.
• Right to Data Portability: Receive your data in a structured, commonly used machine-readable format.

To exercise any of these rights, email support@charthigh.com. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.