Privacy Policy
Last updated: 3 May 2026
Deadly Hub ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how long we keep it and the rights you have under the UK GDPR and the Data Protection Act 2018.
1. Who we are
Deadly Hub is operated from Belfast, Northern Ireland. We are the data controller for personal data collected through this website and our platform. Contact: our Facebook page.
2. What we collect and why
| Data | Why | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Quote requests (business name, contact name, email, phone, notes, modules selected) | To prepare and send you a price/proposal | (b) steps prior to a contract |
| Sales lead form (name, business, email, phone, use-case) | To follow up about your interest | (b) pre-contract / (a) consent for marketing |
| Partner sign-up (auth email, payout email/method, business name) | To run your partner account and pay commission | (b) contract |
| Referral attribution (partner code, hashed IP, referrer URL, user agent) | To credit the right partner for a sign-up | (a) consent (marketing cookie) |
| Sample orders / payments (name, email, address, order items) | To process the sample transaction | (b) contract |
| Server & security logs (IP, user agent, request metadata) | Security, fraud prevention, debugging | (f) legitimate interests |
| First-party analytics: page path, referrer host, country code (derived from request headers) and a daily-rotating SHA-256 hash of IP + user-agent. No cookie is set for analytics. | Understand which pages and traffic sources work, in aggregate. No cross-site tracking, no profiling, no advertising IDs. | (f) legitimate interests |
3. Cookies
The only non-essential cookie we set is the partner referral cookie (dh_ref), so the cookie banner asks for one consent only. We do not run Google Analytics, Google Tag Manager, advertising pixels, session-replay tools or any other third-party tracker. You can change your choice any time using the "Cookie preferences" link in the footer.
| Cookie | Purpose | Duration | Category |
|---|---|---|---|
dh_consent / dh_consent_v1 | Stores your cookie choices | 6 months | Strictly necessary |
dh_ref | Remembers which partner referred you so they get credit | 30 days | Marketing / referral |
dh_ref_tracked | Stops us logging the same referral click twice in one session | Session | Marketing / referral |
sb-*-auth-token | Keeps you signed in to your partner account | Up to 1 year | Strictly necessary |
We do not use Google Analytics or any third-party analytics cookies. Our own analytics are cookieless. We count page visits using an anonymised, daily-rotating hash that cannot be linked back to you across days or sites.
3a. Marketing & showcase forms
Deadly Hub is a feature showcase. Information you submit through the quote, sales lead, demo booking, or sample-shop checkout forms is sent only to the Deadly Hub team so we can follow up. We do not send automated marketing emails to visitors who try the showcase, and we do not add you to any mailing list without explicit opt-in.
4. Who we share data with (sub-processors)
We only share data with providers we need to run the service:
- Supabase: database, authentication and edge functions. Hosted in the EU.
- Email delivery: transactional email (confirmations, password resets, quotes).
- Google Fonts: web fonts only. We do not use Google Analytics.
Where data is transferred outside the UK / EEA, we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision.
5. How long we keep it
- Quote requests: 24 months from submission, then deleted.
- Sales lead enquiries: 12 months, then deleted.
- Partner accounts: for the life of the account, plus 6 years after closure for tax records.
- Referral click logs: 12 months.
- Sample orders & invoices: 6 years (UK tax requirement).
- Server / security logs: 30 days.
- First-party analytics page-view records: 90 days, then automatically deleted.
6. Your rights
Under UK GDPR you have the right to:
- access a copy of the personal data we hold about you;
- have inaccurate data corrected;
- request erasure ("right to be forgotten") where applicable;
- restrict or object to processing;
- port your data to another provider;
- withdraw consent at any time (without affecting prior processing);
- complain to the UK Information Commissioner's Office (ICO) at ico.org.uk (though we'd appreciate the chance to fix things first).
To exercise any of these rights, message us on our Facebook page. We aim to respond within 30 days.
7. Security
We use HTTPS everywhere, row-level security on our database, encrypted secrets management, and access controls on internal tooling. No system is perfectly secure. Please report concerns to our Facebook page.
8. Children
Deadly Hub is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we'll delete it.
9. Changes
We may update this policy. The "Last updated" date at the top tells you when. Material changes will be flagged on the site.
10. Related policies
See also our Terms of Service and Acceptable Use Policy.