Privacy & Cookies Policy

HauntSeek is a trading name of The Lady In The Bay Window Ltd, a company registered in England and Wales under company number 16417829, whose registered office is at 158 Hemper Lane, Sheffield, S8 7FE.

That company is the controller of personal information described in this policy. Contact us at hello@hauntseek.co.uk.

This policy covers visitors, account holders, paid members, event operator contacts and applicants, and people who correspond with HauntSeek.

• Account and profile: email, authentication information, display name, home region, marketing preference and account status.
• Search and location: searches, entered postcode/town/city and optional browser geolocation used for a location search.
• Usage and referrals: event views, outbound clicks, referral/session identifiers, user agent, referrer and related attribution or anti-bot information.
• My HauntSeek: saved events, Passport entries/stamps, journals, private photos, EVP/audio, uploaded video, external video links, sharing selections and ratings if that feature is enabled.
• Membership: plan, subscription status, renewal dates and payment-provider customer/subscription references.
• Operators and communications: partner application details, business/contact information, permissions, signatures, correspondence and enquiries.

• Provide accounts, searches, private member features and paid membership — performance of our contract or steps you request before it.
• Operate referrals, maintain event information, answer enquiries, improve the service and prevent abuse — our legitimate interests, balanced against your rights.
• Send requested service, account, security and subscription messages — contract, legitimate interests or legal obligation as applicable.
• Process optional measurement and Google Analytics — consent, which may be withdrawn.
• Meet tax, accounting, legal, safety and dispute obligations — legal obligation or legitimate interests.
• Send optional marketing only where permitted and according to your preference — consent or another lawful basis permitted by law.

HauntSeek does not ask members to provide special-category or other sensitive personal information for ordinary use. Members control their own free-text journals and evidence, however, so that material could contain sensitive information. Avoid including sensitive personal information that is not necessary for your investigation record.

Journals and investigation evidence are private by default and are not intended to be available to other members or the public. Our systems and authorised providers may technically process content where necessary to store, transcode, secure, display it back to you, maintain the service, investigate misuse or comply with law.

If you deliberately create a stamp or investigation share card, only the supported information or photo you select is placed on that card. Unselected content remains private. EVP/audio cannot currently be included on share cards.

Stripe receives and processes payment details. HauntSeek keeps the plan, subscription status, dates and customer/subscription references needed to provide and administer membership. We do not receive or store full payment-card details. Deleting a HauntSeek account does not currently cancel an active Stripe subscription; paid members should cancel through Billing first.

For event operators who subscribe to the Independent Partner Plan, we process the business contact name and email address, the operator business name, the chosen plan and event limit, subscription status and dates (start, renewal, scheduled changes, cancellation requests and reversals, and end), payment-problem flags, and a history of plan events.

Payments are processed by Stripe. HauntSeek receives Stripe customer, subscription, price and invoice identifiers but never receives or stores full payment-card details. When an operator chooses to update payment details, HauntSeek creates a short-lived Stripe page for that request only; its address is not stored or emailed.

Manage your plan links are unique, expire after 30 days and are stored only as a one-way cryptographic hash. If an operator asks for a replacement link, we check the email address entered against the address held for the plan and record the request; we do not reveal whether an address is held.

Purposes and lawful basis: providing and administering the subscription (performance of a contract), keeping accounting and tax records (legal obligation), and preventing misuse and keeping the service secure (legitimate interests). Plan emails about confirmations, payment problems, plan changes, cancellation and replacement links are service messages, not marketing.

Retention: subscription, invoice and billing-history records are kept for six years after the end of the financial year to which they relate, then deleted. Expired Manage-link hashes have no further use and may be removed at any time.

• Authentication storage: essential Supabase sign-in/session information keeps accounts secure and signed in.
• hauntseek-cookie-consent: remembers whether you accepted measurement or chose essential only.
• hs_session_id: an optional random measurement identifier created only after analytics consent.
• hs_post_auth: temporary session storage used to return you to the intended HauntSeek page after sign-in.
• OAuth: essential authentication technology may be used when signing in with Google.
• Google Analytics: loaded only after analytics consent to measure site use.
• Meta Pixel (Facebook): an advertising measurement cookie loaded only after you click Accept, used to measure visits from our Facebook/Instagram ads.

Advertising measurement (Meta Pixel) is used only with your consent. Choosing Essential only means HauntSeek will not intentionally start further optional analytics measurement and removes the HauntSeek measurement session ID (hs_session_id). If Google Analytics was previously accepted during the current browser session or on that device, Google-related analytics storage already created may remain until it expires or is removed through browser controls. Google Analytics is initially loaded only after analytics consent. You can reset your choice by clearing this site’s browser data.

We do not sell personal information. We use providers only as needed to operate the service:

• Lovable for managed application, hosting and email infrastructure;
• Supabase for database, authentication and storage services;
• Stripe for subscription payment processing and billing management;
• Cloudflare, including Cloudflare Stream, for delivery and eligible private uploaded-video processing;
• Google OAuth for optional Google sign-in;
• Google Analytics only where measurement consent has been given;
• Meta Platforms (Facebook Pixel) for advertising measurement only where consent has been given.

Event operators may receive aggregate or minimised referral information. When you follow a booking link, the operator’s own privacy policy applies. We may also disclose information where required by law, to protect rights or safety, or during a lawful business reorganisation.

Some providers may process personal information outside the UK. Where UK data-protection law requires it, appropriate safeguards are used, such as an applicable adequacy decision or approved contractual protections. We do not rely here on an unverified claim about a particular processing country or contract.

We aim to keep personal information only for as long as reasonably necessary for the purposes for which it is held, taking account of legal, accounting, fraud-prevention, security and dispute requirements. Retention periods may vary according to the type of information and the reason it is held.

Usage/referral records, partner applications and correspondence do not currently have an automated 24-month deletion process; they are kept according to this criteria-based approach and operational needs. Account and private member content remains until removed through the service or the account is deleted, subject to the exceptions below. When a qualifying paid plan ends, uploaded video is held for the implemented 30-day grace period and then eligible Cloudflare Stream footage is automatically deleted. Necessary subscription, transaction and accounting records may be kept for legally required periods.

The in-product deletion process removes the member account and associated private My HauntSeek information according to the implemented process. Anonymous or aggregated operational records that no longer identify the member may remain. Information may also be retained independently where necessary for legal, accounting, fraud-prevention, security or dispute purposes, including records held by payment providers. Account deletion does not currently cancel an active Stripe subscription, so paid members should cancel through Billing first.

We use HTTPS, server-side validation, access controls, private member-scoped data rules, short-lived media access links and provider ownership checks where applicable. No online service can guarantee absolute security. If a personal-data breach occurs, we will respond and notify affected people or the ICO where legally required.

Depending on the circumstances, you may have rights to access, correct or erase personal information; restrict or object to processing; receive portable data; and withdraw consent without affecting earlier lawful processing. Contact hello@hauntseek.co.uk. We normally respond within one month. You may complain to the Information Commissioner’s Office at ico.org.uk.

My HauntSeek accounts and paid memberships are intended for adults aged 18 or over. Event operators may set different event-specific age limits. We do not knowingly create accounts for children; contact us if you believe a child has provided personal information.

We may update this policy as the service or law changes. We will update the fixed date above and give appropriate notice of material changes. Privacy questions and rights requests can be sent to hello@hauntseek.co.uk.

HauntSeek is a trading name of The Lady In The Bay Window Ltd, a company registered in England and Wales under company number 16417829, whose registered office is at 158 Hemper Lane, Sheffield, S8 7FE.