Version 2026-10-01. Draft: not yet reviewed by our solicitor.
Privacy notice
Who we are
Launch500 is a trading name of 99 Developers Ltd, registered in England and Wales, company number 17257492. Registered office: 55 Queen's Gate, London SW7 5JW. 99 Developers Ltd, trading as Launch500, is the controller of the personal data this notice describes. Questions, and any request under the rights below: privacy@launch500.com (or use the contact form).
Our data protection officer is the one registered with the Information Commissioner’s Office for 99 Developers Ltd, and is reached through privacy@launch500.com (or use the contact form). We are registered with the ICO as a data protection fee payer under reference ZC245763.
What we process, why, and for how long
| What for | Data | Lawful basis | How long we keep it |
|---|---|---|---|
| Serving the site and keeping it secure | IP address, browser user agent, the address requested and the time, at Cloudflare's network and in our Worker's logs | Legitimate interests: delivering the site securely (Art 6(1)(f)) | [[HUMAN: Workers Logs retention period, read from the Cloudflare dashboard]] |
| Checking that a person, not a script, asks for a sign-in code, sends a Crash Test enquiry or sends a message through the contact form | Your IP address, which we pass to Cloudflare with the check, and signals from your browser, which Cloudflare Turnstile processes to give the check its answer; we receive only the answer | Legitimate interests: keeping accounts safe from automated abuse (Art 6(1)(f)) | We keep nothing from the check |
| Signing you in | Your email address, the six-digit code we email you, and two session cookies once you are signed in | Contract: you asked for an account (Art 6(1)(b)) | Your login: until you delete your account. An address typed into sign-in creates a login record even if it is never confirmed with its code, including one typed in by someone else; today that record is kept until the address's owner asks us to delete it at our privacy address. Session cookies: until you sign out, or 30 days after your last visit |
| Your account | Account kind (Crew or Garage), handle, display or company name, and a Garage's company website | Contract (Art 6(1)(b)) | Until you delete your account |
| Listings and claims | Product name, website, category and one line; how you proved the domain (your sign-in address's domain, or a DNS record, a tag on your homepage or a file on your site, which carry one token of which we keep only a one-way hash) | Contract (Art 6(1)(b)); legitimate interests in running an accurate directory (Art 6(1)(f)) | A live listing: while the product is listed, even after its Garage closes. Unpaid with the domain unproved: 72 hours. Unpaid, proved but not yet live, and untouched by its Garage for 30 days: deleted, as is one held for a person and not decided within 30 days. Paid: never deleted for lapsing; if its domain is still unproved 30 days after payment, the payment is refunded. Rejected: 2 years. Claim records: 2 years after they are resolved, or with the account |
| A Premium listing's profile | The listing's description, logo, whether the company is raising, its launch note, and any category it proposes. The account that proposed a category is recorded, and seen only by our staff and in that account's data download | Contract (Art 6(1)(b)) | Shown publicly as the company's own statements, and kept as long as the listing. A proposed category that no listing uses is deleted after 7 days. A logo is served only through our own address (/api/logo/<id>), never straight from storage; a logo file that no listing uses any more is listed for our staff to delete by hand |
| A company's answers about its product | The questionnaire a Garage fills in about its product: the company, prices and plans, where it runs, integrations, security, AI and data, support and competitors. This is information about the company, except the founders' names, which are there only if the company chooses to publish them | Contract (Art 6(1)(b)); for founders' names, legitimate interests in showing readers who is behind a product (Art 6(1)(f)) | Shown publicly as the company's own statements, with the date it last confirmed them, once the listing is live. Kept as long as the listing and deleted with it; included in the Garage's data download |
| Reviews you write | Your rating and the words of the review (headline, pros, cons, who it serves best, months used, what you switched from, company stage and team size), the times, and a verification tier worked out from your sign-in address at the moment you submit: whether its domain is a public mailbox or a domain of its own. The tier is shown on the review; your address never is | Contract (Art 6(1)(b)); legitimate interests in reviews a reader can weigh (Art 6(1)(f)) | Published: indefinitely; if you delete your account the words, rating and tier stay, detached from everything that names you. Pending reviews are deleted with your account; held and rejected ones, 1 year after the decision |
| Marking a review helpful | Which reviews your account marked, one mark per review, shown only as a count | Legitimate interests in surfacing the reviews readers actually use (Art 6(1)(f)) | With the review, or with your account, whichever goes first |
| Discussion under a Premium listing | A post's text, its kind (a comment or a maker's note), its state (visible, hidden or removed), its times, and the account that wrote it. A comment shows the author's handle; a maker's note shows the company's name | Contract (Art 6(1)(b)); legitimate interests in moderating what is posted (Art 6(1)(f)) | Visible and hidden posts: as long as the listing. Removed posts: deleted 1 year after removal. When you delete your account, your hidden and removed posts are deleted and your visible ones stay, no longer linked to you |
| Crash Cup votes | Which Crew account voted in which tie, for which side, when, the vote's weight, and whether it was flagged. To spot bursts of votes from one place, a one-way hash of your IP address (for IPv6, its network part) and the tie, keyed with a secret only our Worker holds, so the hash cannot be turned back into the address from our database | Contract (Art 6(1)(b)); legitimate interests in keeping the vote fair (Art 6(1)(f)) | Votes: 2 years, and deleted with your account. The public sees only each tie's totals, never who voted. The burst-detection hash: 90 days |
| Crash Cup entries | Which listing entered which season, whether by payment or by our invitation, its seed in the draw, and whether it was withdrawn | Legitimate interests in a draw anyone can check (Art 6(1)(f)) | Public, and kept with the season, and removed if the listing is deleted |
| Statistics for a listing's company (when it launches) | For each listing, each day and each site that sent visitors (its host name only, never the full address), counts of page views and website clicks. No IP address, browser string, cookie or other identifier is stored. To count a visitor once a day without knowing who they are, a key made from a one-way hash that changes daily; to limit counting from one address, counters hashed again | Legitimate interests: showing a company how its own listing is doing (Art 6(1)(f)) | Daily counts: 13 months, seen only by that listing's Garage. The daily key: 24 hours. The limit counters: 30 days. "Do not measure my visits" and your browser's Global Privacy Control signal (Sec-GPC) stop it before anything is counted |
| Contributed articles | The title, standfirst and body, the author's name, role and company, an optional https link for the author's bio, when the criteria were ticked as read, the editor's note, the piece's state, and the payment records for it | Contract (Art 6(1)(b)); our legal duty to keep accounting records (Art 6(1)(c)) | A published piece: permanently, and no longer linked to your account if you delete it. A piece declined or refunded after payment: 6 years. A piece no money touched (a draft, one accepted and never paid, one rejected before payment, or one never decided): 90 days after its last change, and deleted with your account. Payment records: 6 years |
| Crash Test orders | The product, the order's state, how many further runs have been used, the Vendor-commissioned mark and the dates, linked to the Garage; the notes a Garage sends with a further-run request; and our staff's note, which appears in the Garage's data download | Contract (Art 6(1)(b)); legitimate interests in keeping a record of what was agreed (Art 6(1)(f)) | 6 years after the order's last change. If the Garage's account is deleted, the order, its further-run notes and our note stay, without the link to the account |
| Recommendations | Which product a Crew member recommended, and when | Contract (Art 6(1)(b)) | 2 years |
| Reports | Who reported which listing, the reason, and up to 500 characters of detail | Legitimate interests: keeping the directory clean (Art 6(1)(f)) | 1 year after the report is resolved, or with the reporter's account |
| Security records | Keyed one-way hashes of email and IP addresses, never the addresses themselves, to enforce sign-in, contact form and posting limits; a log of account and moderation actions | Legitimate interests: keeping accounts and the directory safe (Art 6(1)(f)) | Limit counters: 30 days. The action log: your own entries are deleted with your account; the rest are kept 6 years |
| Selling a Premium listing | Stripe takes your card details on its own page. We receive the payment reference, amount and currency, the listing it was for, and whether it was later refunded or disputed. Stripe holds your name, email and billing address | Contract (Art 6(1)(b)); our legal duty to keep accounting records (Art 6(1)(c)) | 6 years from receipt of the payment |
| Crash Test enquiries | See the section below | See the section below | 12 months after the enquiry's last status change |
| Messages sent through the contact form | The topic you choose, your name if you give it, your email address, the web address concerned if you give one, your message, the page you sent it from, and the time. We store none of it on the site: it goes by email, through Resend, to our team, with your address to reply to, and we email you a reference. To limit how often the form can be used, we keep keyed one-way hashes of your email and IP address, never the addresses themselves, in the form's own counters | Legitimate interests: answering you (Art 6(1)(f)); legal obligation for legal notices and data protection requests (Art 6(1)(c)) | In our team's mailbox, as correspondence: 2 years after the last message. Resend, which sends it, keeps the emails and their logs for 30 days. Legal notices and complaints: 6 years after the matter closes. The limit counters: 30 days |
| Answering email to our mailboxes | Your name, email address and message | Legitimate interests (Art 6(1)(f)); contract where you ask to buy (Art 6(1)(b)); legal obligation for legal notices and data protection requests (Art 6(1)(c)) | 2 years after the last message. Legal notices and complaints: 6 years after the matter closes |
| Crediting a correction | Your handle, only if you ask for it | Consent (Art 6(1)(a)), which you can withdraw at any time | While the corrections log entry is published |
Crash Test enquiries
If you ask about a Crash Test through our enquiry form, we record what you enter: the product’s name and web address, your company, your name, your work email address, what you want tested, when you would like it done (a wish, not a booking), and the time you ticked to confirm you have read the five independence constraints, which the form shows and the vendor terms repeat. If you are signed in to a Garage account when you send it, the enquiry is linked to that account. Our staff record its status and may add a short note of up to 500 characters.
- Why: to reply to your enquiry and agree a test with you.
- Lawful basis: steps you ask us to take before entering into a contract (Art 6(1)(b)); where you write on behalf of a company, our legitimate interest in answering its enquiry (Art 6(1)(f)).
- Where: stored in our Supabase database in London, and read only by our staff, in our staff console, after signing in with a second factor. A Garage’s own data download includes its linked enquiries, with their status and any staff note.
- How long: deleted 12 months after the enquiry’s last status change. If you sent it from a Garage account, it is also deleted when that account is deleted.
- Limits: to stop abuse, the form takes a set number of enquiries a day from each IP address and each email address, and from the whole site. Those counts are kept as keyed one-way hashes, never the addresses, and deleted after 30 days, as the security records row above says.
Who receives data, and where
| Recipient | What for | Where | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. (processor) | Hosting (Workers), network, DNS, email routing to our mailboxes, and Turnstile | Cloudflare's global network; US parent company | Cloudflare's data processing addendum, version 6.4 (effective 3 April 2026): EU standard contractual clauses with the UK Addendum, and the Data Privacy Framework with its UK Extension |
| Supabase (processor) | Our database and sign-in | London (eu-west-2); Supabase support staff may access it from outside the UK | [[HUMAN: transfer safeguard in the Supabase DPA as accepted, with its date]] |
| Resend (processor) | Sending the sign-in code emails, and the contact form's messages to our team and its acknowledgements to you | United States | Resend's data processing agreement: standard contractual clauses as amended by the UK Addendum, and the Data Privacy Framework with its UK Extension. Resend keeps sent emails and their logs for 30 days |
| Stripe (processor for payments; an independent controller for its own fraud, anti-money-laundering and identity checks) | Taking payments. Card details go to Stripe, never to us | The Stripe entity named in our services agreement; data is transferred to Stripe, LLC in the US | Stripe's data processing agreement: the UK International Data Transfer Addendum with standard contractual clauses, and the Data Privacy Framework |
| Our mailbox provider (processor) | Reading and answering email sent to our addresses | [[HUMAN: mailbox provider behind the Email Routing destinations, and its region]] | That provider's data processing agreement |
| Our solicitor, our accountant, HMRC, and the ICO or a court where the law requires | Advice, tax and legal obligations | United Kingdom | None needed |
Each processor acts only on our instructions. We sell nobody’s data and run no advertising trackers.
Retention schedule
| Record | Kept for |
|---|---|
| Network and Worker logs | [[HUMAN: Workers Logs retention period, read from the Cloudflare dashboard]] |
| Your login and account | Until you delete them |
| A live listing | While the product is listed, even after its Garage closes |
| Unpaid listings, domain not proved | 72 hours |
| Unpaid listings, proved but not yet live | Deleted when untouched by their Garage for 30 days |
| Listings held for a person | Deleted if not decided within 30 days |
| Paid listings not yet live | Never deleted for lapsing; the payment is refunded if the domain is still unproved 30 days on |
| Rejected listings | 2 years after the decision |
| Claim records | 2 years after they are resolved, or with the account |
| Recommendations | 2 years |
| Published reviews | Indefinitely; detached from your account when you delete it |
| Pending, held and rejected reviews | Pending: with the account. Held and rejected: 1 year after the decision |
| Helpful marks on reviews | With the review, or with your account, whichever goes first |
| A Premium listing's profile | As long as the listing |
| A company's answers about its product, including founders' names | As long as the listing |
| Proposed categories that no listing uses | 7 days |
| Discussion posts | Visible and hidden: as long as the listing. Removed: 1 year after removal |
| Crash Cup votes | 2 years, or until the account is deleted |
| Crash Cup burst-detection hashes | 90 days |
| Crash Cup entries | Kept with the season, and removed if the listing is deleted |
| Listing statistics (when it launches) | Daily counts: 13 months. Daily keys: 24 hours. Limit counters: 30 days |
| Contributed articles | Published: permanently. Declined or refunded after payment: 6 years. Unpaid drafts, unpaid rejected pieces, accepted pieces never paid for and undecided pieces: 90 days after the last change |
| Crash Test orders and further-run notes | 6 years after the order's last change |
| Resolved reports | 1 year |
| Sign-in and posting limit counters | 30 days |
| A login record for an address entered at sign-in and never confirmed | Until the address's owner asks us to delete it |
| The action log | Your own entries: deleted with your account. Others: 6 years |
| Crash Test enquiries | 12 months after the enquiry's last status change |
| Payment records, refunds and disputes | 6 years from receipt of the payment |
| General email to hello@, corrections@, claims@ and security@, and messages sent through the contact form | 2 years after the last message |
| Legal notices, complaints and their evidence | 6 years after the matter closes |
| Rights requests and data protection complaints | 2 years after closure, or 6 years if a claim is threatened |
| Breach log | 6 years |
| Correction credits | While the log entry is published; removed on request |
When you delete your account, it is removed from our database at once. Your published contributions stay, detached from you: a live listing describes a product, not a person. Our providers’ own technical logs age out on their own schedules.
Cookies and browser storage
Two cookies, both strictly necessary, set only when you sign in. They hold your session so you stay signed in, and they are sent only to this site, over HTTPS. No consent banner is needed for them. The site itself sets no other cookie. The one exception we know of is Cloudflare Turnstile, the check on the sign-in and enquiry forms, which may use its own storage in your browser to do that check; we are confirming with our data protection officer exactly what it stores.
Two settings may be kept in your browser’s storage, each only after you choose it: the currency you picked for showing prices (lp-currency), and your choice not to be measured (l5-do-not-measure). Neither holds personal data, and both stay until you clear your browser’s storage.
While you fill in the listing form, what you have typed is kept in this tab’s session storage (launch500:listing-draft) so a reload or the wait for your code does not lose it: the product name, website, category, one-line description and the Garage handle. It never holds your email address, the code or any token. It is cleared once the listing is saved, and the browser clears it when you close the tab.
Measurement, and how to object
We do not measure visits today: no analytics runs on the site. If we switch on Cloudflare Web Analytics, this notice will say so first. You can already object: “Do not measure my visits” at the foot of any page is free, takes one click, and is remembered on that device, so it applies from the day any measurement starts. The statistics for a listing’s company in the table above, when they launch, honour that choice and your browser’s Global Privacy Control signal too.
Automatic decisions
Some things happen without a person deciding each one. A free listing goes live when you prove the domain, complete your page, and an automatic check finds that the site loads, names the product and is not parked; when that check fails, a member of our staff decides instead, and a Premium listing goes live only when a person at the Editorial Desk approves it. A listing is hidden when three different Crew members report it, until our staff look at it. Sign-in and posting limits refuse requests over a set rate. If one of these affects you and you think it is wrong, write to privacy@launch500.com (or use the contact form) and a person will review it.
Your rights
You have the right to access your data, to have it corrected, to have it erased, to restrict how we use it, to object to our using it (including where we rely on legitimate interests), to data portability, and to withdraw consent where we rely on it. Erasure has one limit: a published contribution stays, detached from you, as the retention schedule above describes.
You can download a copy of what we hold about you, correct your details and delete your account yourself, at any time, from your account page. For anything else, write to privacy@launch500.com (or use the contact form). It is free. We reply within one month, which we can extend by two further months for a complex request, and we tell you if we do. We may ask for proof of identity, in proportion to the request.
Complaints
Please complain to us first, at privacy@launch500.com (or use the contact form). We acknowledge a data protection complaint within 30 days, look into it, and tell you the outcome. You can also complain to the Information Commissioner’s Office: ico.org.uk, telephone 0303 123 1113.
Age
Launch500 is not designed for people under 16, and we do not knowingly collect their data. Accounts are for people aged 16 and over. This is our own policy, not an age check.
Do you have to give us data?
Only to use what needs it: an account needs an email address, and a buyer must give Stripe the details it asks for. Nobody has to give us anything to read the site.
Changes
Each version of this notice is dated, and the version history below says what changed.
Version history
- 2026-10-01: 6 Oct 2026: the retention lines for listings follow the listing flow (D33): an unpaid listing with its domain unproved lapses at 72 hours; one proved but not yet live and untouched by its Garage for 30 days is deleted; a paid listing is never deleted for lapsing, and its payment is refunded if the domain is still unproved 30 days on. The four ways of proving a domain, and that a Premium page goes live only on a person's approval, are stated.
- 2026-10-01: 6 Oct 2026: contributed articles open, so their row and their retention line no longer say "when it launches".
- 2026-10-01: 6 Oct 2026: the contact form keeps its own limits (keyed hashes in its own counters, never the sign-in ones); Resend's transfer safeguard is stated from its data processing agreement (standard contractual clauses with the UK Addendum, and the Data Privacy Framework with its UK Extension), with its 30-day keeping of sent emails and logs.
- 2026-10-01: 6 Oct 2026: adds the contact form: what it collects, that it is sent by email to our team through Resend and stored nowhere on the site, and that it is kept in the team's mailbox under the retention line for correspondence. Crash Cup votes and their burst-detection hashes are no longer marked as when it launches: Season 1 is open.
- 2026-10-01: 6 Oct 2026: the discussion thread under a Premium listing is live, so its two rows no longer say when it launches. Posts are checked automatically for slurs, strong swearing, sexual content and threats before they show; the check keeps no record of its own.
- 2026-10-01: 6 Oct 2026: adds a row and a retention line for the company questionnaire: a Garage's answers about its product, including any founders' names the company chooses to publish, are shown as the company's own statements and kept as long as the listing.
- 2026-10-01: 6 Oct 2026: the £49 paid listing is renamed the Premium listing. What it includes and costs did not change.
- 2026-10-01: 3 Oct 2026: adds a row and a retention line for each part of the product set: the paid Listing's profile, Crash Cup entries and Crash Test orders, and, marked as when it launches, the discussion thread, Crash Cup votes, the statistics for a listing's company and contributed articles.
- 2026-10-01: Adds the listing form's draft kept in the tab's session storage (launch500:listing-draft): what it holds, that it never holds an email address, code or token, and when it is cleared.
- 2026-10-01: Moved to /legal/privacy. Adds the ICO registration, the data protection officer, measurement, Turnstile, the Crash Test enquiry form, recipients and transfers, and complaints to us.
- 2026-09-30: First notice, published at /privacy.