Privacy notice
Last updated 2 October 2026
This notice explains what personal data we collect when you use surefer.co.uk, why we use it, who we share it with, how long we keep it and the rights you have. We collect as little as we can: visitors don’t need an account, and we don’t use advertising or analytics cookies.
1. Who we are
Surefer is run by Stockulate Ltd (company number 15893175), 12 Lansbury Road, Sutton-in-Ashfield, Nottinghamshire, NG17 5DL, United Kingdom. We are the controller of your personal data, which means we decide how it’s used. Contact us about anything in this notice at hello@surefer.co.uk.
2. What we collect and why
If you visit without an account
| What | Why | Lawful basis |
|---|---|---|
| A random code in a cookie, set only when you ask for a referral. We store only a one-way hash of it, never the code itself. | To keep the same referral for you for 30 minutes, so asking again doesn’t use up other members’ turns, and to make sure only your browser can open the referral you were given. | Legitimate interests: running a fair rotation and preventing misuse. |
| Which referral you were shown, and whether you opened the link or copied the code, linked to that hashed code. | To run the rotation, show members how many times their referral was used, and spot abuse. | Legitimate interests: running the service and preventing misuse. |
| Anything you write in a report about a referral. | To fix broken or misleading referrals and deal with illegal content. | Legitimate interests: keeping listings accurate and safe; legal obligation where the law requires us to act. |
We can’t tell who you are from this information, and we don’t try to. Please don’t include personal details in a report.
If you create an account
| What | Why | Lawful basis |
|---|---|---|
| Email address, password (stored only in scrambled form) and display name. | To create and secure your account and send you service emails, such as confirmation and password reset emails. | Contract: providing the account you asked for. |
| Your referral links and codes, and the programmes you add them to. | To review them and share them with visitors through the rotation. | Contract. |
| How often your referrals were selected, opened and copied. | To show you your figures in your dashboard. | Contract. |
| Brand suggestions you send us. | To consider adding the programme. | Legitimate interests: improving the directory. |
| Moderation records, such as why a referral was rejected or an account suspended. | To apply our terms consistently and handle appeals. | Legitimate interests: keeping Surefer safe and fair; legal obligation for online safety duties. |
If you become a paid member
| What | Why | Lawful basis |
|---|---|---|
| Your Stripe customer and subscription references, subscription status and the date your paid period ends. Stripe holds your card details; we never see them. | To take payments, apply your paid benefits and handle cancellations and refunds. | Contract. |
| Records of payments and refunds. | To keep accounting records. | Legal obligation: tax and company law. |
Emails you send us
If you email us, we use your email address and what you tell us to reply and to resolve your request (legitimate interests, or contract if it’s about your account).
3. What visitors can see about members
When a visitor receives your referral, they see your display name, your referral link or code and whether you’re a paid member. Public offer pages show only how many free and paid members share each offer, never names. We don’t show your email address to anyone. We don’t give visitors’ details to members: members see only totals.
4. Who we share data with
We use these service providers to run Surefer. They act on our instructions and must keep your data secure.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database and account login | Data stored in Ireland (EU). Supabase Inc is based in the US. |
| Vercel | Website hosting | Our servers run in Dublin, Ireland, with pages delivered from a global network. Vercel Inc is based in the US. |
| Resend | Sending account emails | US |
| Stripe | Payments for paid membership | UK, EU and US |
Stripe also uses payment data for its own purposes, such as preventing fraud and meeting its legal obligations. For that, Stripe is a separate controller; see Stripe’s privacy policy.
We may also share personal data:
- with professional advisers, such as lawyers and accountants, when we need their help;
- with the police, regulators or others when the law requires it, or to protect people from harm or fraud;
- with a buyer if we sell the business, who would have to treat it in line with this notice.
Brands: we don’t send your personal data to the brands we list. When you open a member’s link or use their code, you deal with the brand directly and its own privacy policy applies. The brand will see that you arrived from surefer.co.uk.
5. International transfers
Our database and servers are in Ireland, which UK law recognises as giving adequate protection. Some of our providers are US companies, so your data may be accessed from the US, for example for support. Where that happens, it’s protected by the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or by the UK International Data Transfer Addendum in the provider’s data processing terms. Email us if you’d like more detail.
6. How long we keep data
| Data | How long |
|---|---|
| Visitor cookie | 24 hours |
| Referral selection records | The link to the hashed visitor code is deleted after 90 days. The remaining counts stay with the member’s referral until it’s deleted. |
| Reports about referrals | The link to the hashed visitor code is deleted after 90 days. The report itself is deleted 12 months after it’s closed. |
| Your account, display name and referrals | Until you close your account. We delete them within 30 days of closure. |
| Referrals you remove | Deleted 12 months after you remove them. |
| Brand suggestions | Deleted 12 months after we’ve dealt with them. |
| Payment, subscription and moderation records | 6 years, to meet tax and legal obligations and deal with disputes. |
| Emails to us | 2 years after our last contact with you. |
| Security logs kept by our hosting and login providers, which can include IP addresses | Usually no longer than 30 days. Our login provider keeps a log of sign-ins to your account while it’s open. |
7. Your rights
You have the right to:
- get a copy of your personal data;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use your data, or object to our using it on the basis of legitimate interests;
- receive data you gave us in a format you can take elsewhere.
Some rights only apply in certain situations. To use any of them, email hello@surefer.co.uk from the address on your account, or tell us how to find your data if you don’t have one. We’ll reply within one month. It’s free unless a request is clearly unfounded or excessive. You can change your display name and remove referrals yourself in your dashboard.
8. Complaints
If you’re unhappy with how we’ve used your personal data, please tell us first: email hello@surefer.co.uk or see our complaints page. We’ll acknowledge your complaint within 30 days and tell you the outcome without undue delay.
You can also complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
9. Automated decisions
The rotation decides automatically which member’s referral a visitor receives, using published weights. It doesn’t make decisions about you with legal or similarly significant effects. We explain how it works on How the rotation works.
10. Cookies
We only use cookies that are needed for the site to work, so we don’t ask for consent. Our cookie notice lists them.
11. Children
Accounts are only for people aged 18 or over. We don’t knowingly collect data from children.
12. Security
We protect data with encryption in transit, access controls and the security features of our providers. Only the people who need it to run Surefer can access personal data.
13. Marketing
We don’t send marketing emails. If we start, we’ll only email you if you’ve agreed, and every email will let you unsubscribe.
14. Changes to this notice
We’ll update this notice if how we use personal data changes, and change the date at the top. If a change significantly affects members, we’ll email you first.