Privacy Policy

Last updated: 31 August 2026

This policy explains what personal data bycomposition collects, why, and the choices you have. We keep what we collect to the minimum needed to run the service.

Who we are

bycomposition Limited (“we”, “us”), a company registered in England and Wales (Company No. 17169647), is the data controller for the personal data described here. For any privacy question or request, contact us at francesca@bycomposition.com.

What we collect and why

Account information — if you sign in with Google, we receive and store your email address, name, and profile picture from Google. We use this only to sign you in and to save your favourites. Lawful basis: performance of a contract (providing your account).

Favourites — the items you save are stored against your account so you can find them again. Lawful basis: performance of a contract.

Searches — we log the search terms entered on the site, together with the number of results and, if you are signed in, your account. We use this to understand demand and improve which products we list (for example, spotting searches that return nothing). Lawful basis: legitimate interests (improving our service); searches by signed-out visitors are not linked to an identity.

Usage & interactions — to understand what’s popular and improve our selection, we record which products are viewed and clicked through to retailers, along with the search that led there. This is stored with a hashed IP address (never your raw IP) and is not linked to your identity unless you are signed in. Lawful basis: legitimate interests.

Analytics — we also use a privacy-first, self-hosted analytics tool (Umami) to count page views. It does not use tracking cookies, respects “Do Not Track”, and does not collect data that identifies you.

Technical logs — our server keeps standard access logs (including IP address) for security and to keep the site running. Lawful basis: legitimate interests (security).

Cookies

When you sign in we set a single essential cookie to keep you logged in. We do not use advertising or third-party tracking cookies. Our analytics is cookieless.

Who we share it with

We do not sell your personal data. We share it only with the providers that run the service on our behalf: Google (only to sign you in), and our EU-based hosting provider (Hetzner, in Germany/Finland), which stores the database on our instructions. When you click through to a retailer, that is an external site with its own privacy policy — we do not pass your personal data to them.

How long we keep it

We keep your account data for as long as your account is active. Search logs are retained on a rolling basis to inform our selection and are not needed once that purpose is served. You can ask us to delete your data at any time.

Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, or object to our use of your personal data, and to data portability. To exercise any of these, email francesca@bycomposition.com and we will respond within one month. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk).

Changes

We may update this policy; the date at the top shows when it last changed. Material changes will be made clear on this page.