Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

Ok Try This Now! Ltd
Trading as: DZSpotter.com
Registered in England and Wales
Email: info@dzspotter.com

2. Data We Collect

We collect the following categories of personal data:

Account & authentication data

• Email address: required for account creation, login, and service communications.
• Display name: a name you choose, shown publicly on your profile, reviews, and edits.
• OAuth provider data: if you sign in with Google or another provider, we receive a profile identifier and email. We do not receive your Google password.

Profile data

• Jump count and licence number: optional self-reported fields, visible on your public profile if you choose to add them.
• Home dropzone: optional, shown on your public profile.
• Jump log: records of jumps you voluntarily log at dropzones.
• Social connections: the list of other users you have connected with.

Contributions and activity

• Reviews: star ratings, review text, and metadata you submit about dropzones or wind tunnels.
• Edit suggestions: proposed changes to dropzone listings, including your reason and source.
• Event submissions: event details you submit to the events calendar.
• Dropzone ownership claims: your name, email, phone, role, and message submitted when claiming a dropzone listing.
• New dropzone requests: information you provide when requesting a new listing to be added.

Gear Marketplace data

• Gear listings: item details, images, price, condition, and contact preferences you publish publicly.
• Seller identity: your display name is shown on all listings you create.

Payment data (listing boosts)

• Boost order records: when you purchase a listing boost, we record the listing ID, package selected, amount paid, currency, date, and payment reference. This is stored in our database for audit and customer service purposes.
• Payment card data: we do not collect, store, or process your card details. All card processing is handled entirely by Revolut Merchant Services. See Section 5 for details.

Messaging data

• Private messages: message content and timestamps sent between users are stored in our database. Messages are encrypted in transit (TLS).

Gear Recommender data

• Questionnaire answers: jump count, weight, height, licence, budget, disciplines, and gear preferences you enter into the Gear Recommender. These answers are sent to Anthropic's API to generate recommendations. Anthropic processes this data under their usage policies. We do not link your recommender answers to your account unless you are logged in.

Technical data

• IP address and browser data: collected automatically by our hosting provider (Vercel) for security, performance, and fraud prevention.
• Session cookies: used to keep you logged in. See our Cookie Policy for details.

3. How We Use Your Data

We use your personal data to:

• Provide and maintain the DZSpotter platform and all its features.
• Authenticate your account and keep you logged in.
• Display your public profile, contributions, and gear listings to other users.
• Enable private messaging and social connections between users.
• Process and review edit submissions, DZ requests, and ownership claims.
• Generate personalised gear recommendations via the Gear Recommender (Anthropic API).
• Process payments for listing boosts via Revolut Merchant Services and activate boosts upon successful payment.
• Send service notifications (e.g. edit approved/rejected, new message, connection request, boost activated).
• Maintain the security and integrity of the platform, detect fraud and abuse.
• Improve the service based on aggregate usage patterns.

Our lawful basis for processing is: contract performance (providing the service you signed up for, processing paid boost orders); legitimate interests (security, fraud prevention, platform improvement); and where applicable, your consent (e.g. optional profile fields).

4. Data Visibility: What is Public

5. Data Processors

We use the following third-party services to operate DZSpotter. Each acts as a data processor under appropriate contractual arrangements:

• Supabase: database, authentication, and file storage. Stores all user accounts, dropzone data, reviews, edits, listings, messages, notifications, and boost order records. Servers are located in the EU (Ireland, eu-west-1). Privacy policy: supabase.com/privacy.
• Vercel: web hosting and serverless functions. Processes request logs and serves the application globally. See vercel.com/legal/privacy-policy.
• Anthropic: AI language model provider. Gear Recommender answers are sent to Anthropic's API to generate personalised gear suggestions. We do not send identifying personal data (name, email, user ID) to Anthropic alongside recommender answers. See anthropic.com/privacy.
• Revolut Merchant Services: payment processing for listing boost purchases. When you purchase a listing boost, you are redirected to Revolut's secure checkout. Revolut collects and processes your payment card details directly. DZSpotter receives only a payment confirmation notification and transaction reference. We never see or store your card number, CVV, or expiry date. Revolut processes payment data as an independent controller under its own privacy policy: revolut.com/privacy-policy.

6. Data Sharing

We do not sell your personal data to any third party. We do not use your data for advertising targeting. We do not share your data with any party other than the processors listed above, except:

• Where required by law, court order, or regulatory authority.
• Where necessary to investigate fraud, abuse, or violations of these Terms.
• In the event of a merger or acquisition, where user data may be transferred to a successor entity subject to equivalent privacy protections.

7. Data Retention

We retain your account data for as long as your account is active or as needed to provide the service. If you delete your account:

• Your personal data (email, profile data, messages) is deleted within 30 days.
• Gear listings you created are deleted at the time of account deletion.
• Public contributions (approved edits, reviews) may remain in the directory attributed to "Deleted User" as part of the permanent public record. To request removal, contact us at info@dzspotter.com.
• Boost order records are retained for financial and audit purposes for up to 7 years in line with UK accounting requirements, even after account deletion.
• Dropzone ownership claims submitted by you are retained for audit purposes for up to 2 years.

Technical logs held by Vercel are typically retained for up to 30 days per Vercel's standard policy.

8. Your Rights (UK GDPR)

Under the UK GDPR, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your personal data ("right to be forgotten"), subject to our legal obligations to retain certain records (e.g. financial records).
• Restriction: request that we restrict processing of your data in certain circumstances.
• Portability: receive your personal data in a structured, machine-readable format.
• Object: object to processing based on legitimate interests.
• Automated decision-making: the Gear Recommender uses AI to generate suggestions; no automated decisions with legal or significant effect are made about you.

To exercise any of these rights, contact us at {biz.biz_email}. We will respond within one calendar month. We may request identity verification before processing requests.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.

9. Cookies

DZSpotter uses only essential cookies required for the service to function. We do not use advertising cookies, tracking pixels, or analytics cookies that identify individuals. For a full breakdown of cookies used, see our Cookie Policy.

View our full Cookie Policy →

10. International Transfers

Your data is primarily stored on Supabase servers in the EU (Ireland, eu-west-1). Where data is transferred outside the UK or EEA (e.g. via Vercel's global CDN, Anthropic's API servers in the USA, or Revolut's payment infrastructure), appropriate safeguards are in place including Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs) as required.

11. Children's Privacy

DZSpotter is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has registered, please contact us at {biz.biz_email} and we will delete the account promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be available at dzspotter.com/privacy. We will notify registered users of significant changes by email where reasonably practicable.

13. Contact

For any privacy-related enquiries, data subject requests, or to exercise your rights, contact:

Ok Try This Now! Ltd
Trading as: DZSpotter.com
Email: info@dzspotter.com
Registered in England and Wales

Terms & Conditions · Cookie Policy