Privacy notice
Last updated: 2 November 2026
1. Who we are
Which Niche? is a trading name of Jonathan Steele, a sole trader at Verwood, Reigate Hill, Reigate, Surrey, RH2 9PJ. We are the controller of the personal data described in this notice. For anything about your data, email [email protected].
2. What we collect, why, and our legal basis
| Data | Why we use it | Legal basis |
|---|---|---|
| Name and email address | To create and run your account and send you the cards and emails you signed up for | Contract |
| Your profile answers (budget, skills, hours, interests, preferences) | To match ideas to you | Contract |
| How you use the Service (cards viewed, saved and claimed; settings) | To run exposure caps and claims, keep the Service working and improve it | Contract and legitimate interests |
| Messages you send us | To reply and help you | Legitimate interests |
| Purchase records (plan, amount, date). Card details are handled by Paddle, never by us | To give you what you paid for and keep tax records | Contract and legal obligation |
| Marketing emails (only if you opt in) | To tell you about new features and offers | Consent, which you can withdraw any time |
| Basic technical data (IP address, browser type) in server logs | Security and preventing abuse | Legitimate interests |
3. People whose public reviews we analyse
Our cards are built from publicly available product reviews and comments. We remove usernames and other identifiers when we collect them, keep only short quotes with links to the original, and delete raw text we don't need. Our legal basis is legitimate interests: researching unmet customer needs. If you believe we hold something you wrote and want it removed, email us and we'll take it down.
4. Who we share data with
- Paddle (Paddle.com Market Ltd and its group companies), our Merchant of Record, which processes payments, tax and invoicing as an independent controller under its own privacy notice.
- Service providers who host and run the Service for us under contract: website hosting (Vercel), database and login (Supabase), email delivery, and AI processing (Anthropic) used to match ideas to your profile.
- Professional advisers, such as accountants and lawyers, where needed.
- Authorities, where the law requires it.
We never sell your personal data.
5. International transfers
Some providers process data outside the UK, mainly in the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses to protect it.
6. How long we keep it
- Account and profile data: while your account is open, then deleted within 30 days of closure.
- Purchase records: six years, for tax purposes.
- Support messages: up to two years after the conversation ends.
- Server logs: up to 90 days.
7. Your rights
Under UK and EU data protection law, you have the right to access your data, correct it, have it erased, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time. Email us to use any of these rights; we'll respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk) or your local data protection authority.
8. Security
We protect your data with encryption in transit, access controls and reputable hosting providers, and we give access only to people and systems that need it.
9. Cookies
We use only essential cookies, for example to keep you logged in. We don't use advertising or tracking cookies. If that changes, we'll update this notice and ask for your consent first.
10. Changes
We'll post any changes here and email you about significant ones.