Privacy notice

Gustline is run by Will Roxby, a sole trader in England, trading as Gustline. Will Roxby is the controller of the personal data described on this page. That means Will Roxby decides how it is used and is responsible for looking after it.

Contact: hello@gustline.co.uk. A postal address is available on request.

We collect what you give us when you sign in and set up an event.

• Your email address. We use it to send you a one-time sign-in link and to contact you about your account. That includes a few reminders: if you haven’t added an event, if an event isn’t covered yet or if a pass is about to end. Every reminder has a link to stop them. There is no password.
• Event details. The event name, site name, the pin for your site, the dates and each structure with its rated gust limit.
• Alert recipients. Up to five email addresses and up to five UK mobile numbers for each event.
• The alert log. Every alert we send, with its time, level, forecast peak, the structures affected, who it went to and whether each text was delivered. Test texts are logged too.
• Payments. Stripe takes the payment. We keep the plan, the amount, the dates it covers and Stripe's reference for you. Gustline never sees or stores your card number.
• Messages you send us. If you email hello@gustline.co.uk we keep the conversation so we can help you.

We use this to run the service you signed up for: checking the Met Office forecast for your site, sending alerts and keeping the log for your wind management plan. Our lawful basis is contract. We also rely on legitimate interests to keep the service secure and working. We keep payment records because the law requires it.

The site check needs no account. We keep the place you checked, rounded to about 600 metres, and a one-way hash of your IP address for 90 days. We use them only to limit how many checks one connection can run, so the free checks stay within our Met Office allowance. We cannot turn the hash back into your IP address.

An event organiser using Gustline gave us your email address or mobile number so you get wind alerts for their event. We use it only to send those alerts and test texts, and to record whether they were delivered. We do not use it for marketing.

Our lawful basis is legitimate interests: yours, the organiser's and ours in keeping people safe around temporary structures. Organisers agree to add only people who have agreed to get alerts.

To stop getting alerts, ask the organiser to remove you, or email hello@gustline.co.uk and we will remove you from the event.

We email organisations that run outdoor events to tell them about Gustline. We only contact councils, other public bodies and limited companies, at contact addresses they publish themselves.

What we collect and where from

• The organisation's name, website, area and the events it runs.
• A business contact email address and the web page it is published on.
• Historic wind figures for the area, which we work out from public weather data.
• When we emailed, and whether the organisation replied, asked us to stop or the email bounced.

The sources are the GOV.UK list of local councils, the Companies House register and each organisation's own website. We only use an address published on the organisation's own website domain. We leave out personal free mail addresses, sole traders and addresses meant for other things, such as freedom of information, complaints or press.

A business address can still name a person, so we treat it as personal data. Our lawful basis is legitimate interests: telling organisations about a safety service that is relevant to the events they run.

How we contact you

We send one email and, if there is no reply, one follow-up a few working days later. We never send more than that. We read replies to hello@gustline.co.uk so that no one who has answered gets a follow-up.

Reply “stop” and we add your organisation to a suppression list so we never email it again. If an email bounces we add that address to the list. The list holds only the address or domain and the reason, and we keep it so that opt-outs are honoured.

We use these providers to run Gustline. Those that handle personal data process it for us under contract and only on our instructions. We do not sell personal data or share it for advertising.

• SupabaseDatabase and sign-in.London, UK
• RenderHosts the website and runs the scheduled forecast checks and outreach.Frankfurt, Germany
• ResendSends alert and sign-in emails.United States
• TwilioSends text alerts and tells us whether each one was delivered.United States
• StripeTakes payments, runs the Billing page and issues receipts and invoices.United States and EU
• Google WorkspaceThe hello@gustline.co.uk mailbox, outreach emails and replies.United States and EU
• MapboxThe map and place search in the app. Your browser connects to Mapbox directly, so Mapbox receives your IP address and what you type in the search box.United States
• Met Office DataHubForecasts. It receives only the coordinates of your site.UK
• Copernicus Climate Data StoreHistoric wind data (ERA5) used in outreach emails. We download data from it and send it no personal data.EU

We may also share data where the law requires it, for example with HMRC.

Will Roxby also runs other online services. They share one secure sign-in system.

Your Gustline account and its data are kept separate from any other service. We never share your data between services. We never use it to market our other services to you.

Your email address is how you sign in. If you change it, the change applies to signing in everywhere you use that address with us.

Our database is in London and our hosting is in Frankfurt. Some providers above are based in the United States and may process data there. Where data leaves the UK we rely on UK adequacy regulations or on standard contractual clauses with the UK addendum, which require the provider to protect it to UK standards.

• Account details: while your account is open. Delete it yourself from the Account page when signed in. If you ask us to close it instead, we delete them within 30 days.
• Events, recipients and the alert log: kept as records for your wind management plan until you delete the event (Edit event, then Delete) or close your account.
• Payment records: six years, as UK tax law requires.
• Outreach leads: deleted 12 months after we last contacted the organisation.
• The outreach suppression list: kept indefinitely, so we never email anyone who asked us to stop.
• Emails to hello@gustline.co.uk: kept while we need them to deal with your message.

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you
• correct anything that is wrong
• delete your data
• restrict how we use it
• give you your data in a format you can take elsewhere

You can also object to anything we do under legitimate interests, including outreach. Email hello@gustline.co.uk. We will reply within one month.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

The public pages and the site check set no cookies. We set cookies only to sign you in. They are strictly necessary, so we do not ask for consent. We do not use analytics, advertising or tracking cookies.

• A sign-in check, named sb- then a code ending -auth-token-code-verifier. Set when you ask for a sign-in link. The sign-in system uses it to finish signing you in.
• Your session, named sb- then a code ending -auth-token. Set when you sign in and kept for up to 400 days unless you sign out. A long session can be split across two or three cookies with the same name and a number on the end.

When the map loads in the app, Mapbox may store a small anonymous identifier in your browser to count map loads. We do not read it.

Data is encrypted in transit. Each account can only see its own events, and the database itself enforces that.

If we change how we use personal data we will update this page and the date at the top. If the change matters to customers we will email them. See also our Terms.