Privacy

Shorenet Ltd, registered in England and Wales, company number 17010026. Registered office: 71-75 Shelton Street, London WC2H 9JQ.

We are the controller of the personal data this page describes. For anything on this page, email privacy@shorenet.co.uk.

This site sets no cookies, runs no scripts and uses no analytics. It loads nothing from any other company.

Our hosting provider, Cloudflare, sees your IP address in order to deliver each page. We do not keep a log of who visits.

Our lawful basis for this is legitimate interests: delivering the pages you ask for, and keeping the site secure.

The Sea trials servers at lab.shorenet.co.uk and its subdomains run on one machine, which Vultr hosts for us in London. That machine logs a fixed list of fields per request, with your IP address shortened to its first three parts (IPv4, a /24) or its first 48 bits (IPv6). It does not log request bodies, URLs, headers or cookies.

These logs stay on that Vultr machine and are deleted after 7 days.

One Sea trials server, lab-cf.shorenet.co.uk, runs on Cloudflare rather than on that machine, so Cloudflare sees your full IP address on those requests and logs them under its own terms, and the seven days above do not apply to them. Our own code there records the same shortened address and the same fixed list of fields, but the record goes to Cloudflare's logging rather than to the Vultr machine.

Our lawful basis for these logs is legitimate interests: keeping public test servers usable, by spotting and stopping abuse.

If you give us your email address on the Keep in touch page, we store that address in a database that Cloudflare hosts for us. It is not held by a mailing-list company, and it is not used for anything but the message described below. Rather than claim it is the only thing we hold, here is the whole of what sits beside it: a one-way hash of the confirmation link we email you, a random name for the row (so the unsubscribe link in your email can be checked without carrying your address), the date you asked and the date you confirmed, and, in a separate table, the two rate-limiting values described further down. There is no name, no company, no referrer, no browser, and no record of where you came from.

To send those messages we use an email delivery company, Resend, who handle the address on our behalf for that purpose only, under a data processing agreement. Resend is a United States company, so the address is transferred outside the UK, and the safeguard for that in Resend's agreement is the UK Addendum to the European Commission's standard contractual clauses (its section 6.4). You can read the agreement at resend.com/legal/dpa, or ask us for a copy at privacy@shorenet.co.uk. They are listed with our other processors below.

We use it for one thing: to tell you once Shorenet Inspector is ready. We will not send you anything else, and we will not give or sell the address to anyone.

Our lawful basis is your consent. You give it by ticking the box on the form and then confirming your address. You can withdraw it at any time, with the link in any message we send or by emailing privacy@shorenet.co.uk, and withdrawing deletes your address. You do not have to give us your address: if you do not, the only difference is that we cannot tell you when Shorenet Inspector is ready.

You confirm it first. We send a message asking you to confirm the address: you follow the link and press the button on the page, and until you do the only thing we can send you is that same request again. Anyone can type your address into the form, so that request can be repeated without you: at most three times in each hour we count. We count from the first request rather than by the clock, and the count is tied to the date as well, so a run of requests around midnight can fit in more than three within sixty minutes. The button is there because mail providers and security scanners follow links on their own, and a scanner is not you. If you never do, the link stops working a week after your last request, so the address can never be added to anything. A scheduled job that runs every hour then deletes it, so an address that is never confirmed is gone within a week and an hour of the last request for it.

How long we keep it. Once you confirm, we keep your address until you unsubscribe.

Leaving takes a link and a button. Every message carries a link to remove your address, and the page it opens asks you to press a button, for the same reason: a scanner following the link must not be able to remove an address you still want. It is deleted outright rather than kept on a list of people not to contact: we only ever held the address to send one announcement, so there is nothing left to suppress. You can also email privacy@shorenet.co.uk and we will do it by hand.

The form does not store your IP address, but it does have to count requests. The form has to be rate-limited or it could be used to send mail to other people, and counting requests means holding something that stands for the requester. What we hold is two short-lived keyed values, under a secret only this site holds: one derived from your connection and the date, and one derived from your email address and the date, which is what stops the form being used to send one person message after message. We are deliberately not going to call either anonymous: anyone holding the secret could test a guessed value against them. That is why each is tied to a single day, and why each is deleted once its hour is up: by the form when it is next used, and otherwise by the same hourly job, so within two hours of the request that created it. Neither is stored next to the email address you gave, and we do not use them to work out where you are. When you unsubscribe, the one derived from your address goes with your address. Our lawful basis for these two values is legitimate interests: preventing abuse of the form.

Cloudflare hosts this site, the database holding the Keep in touch addresses and the two rate-limiting values, the hourly job that deletes them, and the Sea trials server at lab-cf.shorenet.co.uk. Cloudflare holds that database as our processor, on our behalf. Resend delivers the messages the Keep in touch form causes: the request to confirm, and the single announcement itself. Vultr hosts, in London, the one machine that runs the Sea trials servers at lab.shorenet.co.uk.

Under UK data protection law you have the right to ask for a copy of what we hold about you, to have it corrected, to have it deleted, to have our use of it restricted, to object to our using it where our basis is legitimate interests, and to receive what you gave us in a portable form. Where our basis is your consent, you can withdraw it at any time, as described above; that does not affect anything we did with it before. To use any of these rights, email privacy@shorenet.co.uk.

We make no decision about you with legal or similarly significant effects by automated means alone.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office: ico.org.uk, or 0303 123 1113.