Who is responsible
Andrew Hodgson, operator of wheresthevinyl.com, is responsible for the personal data described here. Use the contact and reports page to ask a privacy question, exercise a data-protection right, or request removal of your data, or email andrew@radiowaves.info if you cannot sign in.
Data we process
When you sign in, Firebase Authentication processes your account identifier, display name, email address, profile image if supplied by your sign-in provider, provider details, and sign-in security information. The directory stores shops you save, shops you submit, reviews you publish, and support or privacy requests you send. Reviews display the public name you chose when publishing them; email addresses are not displayed.
Technical services may also process IP addresses, device and browser information, security events, and diagnostic logs. Google Analytics runs only when a measurement ID is present in the deployed Firebase configuration.
Why we use it
We use account and contribution data to provide the directory, keep saved shops private to you, publish your chosen review name and review, moderate contributions, prevent abuse, answer requests, secure the service, and diagnose failures. We process this data to provide the service you request and for the legitimate interests of operating a safe, accurate directory. Where consent is required for optional analytics, it must be obtained before that processing is enabled.
Who receives it
Google Firebase provides authentication, database, hosting, security, and optional analytics services. Your chosen identity provider processes sign-in according to its own notice. Google Maps receives information when you choose a directions link. Moderators can access pending contributions, reports, and the information needed to investigate them. We do not sell personal data.
Retention and deletion
Account data is kept while the account is active. Saved shops and reviews are deleted when an account-deletion request is completed. Factual shop records may be retained after contributor identity is removed because they form part of the directory. Resolved support and moderation requests are retained for 24 months, unless they must be kept longer to meet a legal obligation or defend the service from abuse. Operational backups expire after 30 days.
Your choices and rights
You can edit or delete your own review and remove saved shops in the app. You may also ask for access, correction, deletion, restriction, objection, or a portable copy where the relevant law provides that right. Use the private request route; the operator will verify identity before disclosing or deleting account data. You may complain to the UK Information Commissioner’s Office if you believe a data-protection concern has not been resolved.
International processing and security
Service providers may process data outside the United Kingdom under their applicable transfer safeguards. Access is controlled by Firebase Authentication and Firestore rules. Moderator access is provisioned separately and cannot be granted by an ordinary account. No internet service can guarantee absolute security.
Changes
Material changes will be reflected on this page with a new update date. If a change affects how existing account data is used, additional notice will be given where required.