1. Who is responsible for your data
Proxiscout operates this directory and is the controller of the personal data described here. [TODO: legal entity name, registered address, and a privacy contact address; add a Data Protection Officer or EU/UK representative if you are required to appoint one]
A note specific to this site: when you contact a proxy, you leave Proxiscout. Anything you then send them — your name, your shipping address, your order details, your payment — is handled by that proxy under their own practices, not ours. We never see it. This policy covers only what happens on this site.
2. What we collect, and why
If you just browse
You can browse the directory and read listings without an account. Our server records standard technical data such as your IP address and the pages you request, which we use to keep the site running and secure. We also count how many times the contact and review forms are submitted from an IP address, so we can stop spam and abuse.
If you apply to be listed as a proxy
We collect your name, email address, postal address, the countries you cover, your rates, your payment methods, your contact handles, and a document proving your address. Most of this is published on your listing — that is the point of a directory, and you choose what to enter.
Your proof-of-address document is never published. It is stored outside the public web root, is not reachable by URL, and is only viewable by site administrators reviewing your application.
If you write a review
We collect the name you give, your email address, your rating and comments, and your proof of the transaction — a shipping-label photo or a tracking number and link. Your name, rating, and comments are published. Your email address and your proof are not: we use them to check the review is genuine and to contact you if it is disputed.
If you contact us
We receive your name, email address, and message so we can reply. Nothing from the contact form is published.
If you buy a Premium membership
Payment is handled by Stripe. Your card details go directly to Stripe and never reach our servers — we store only your subscription status and the identifiers Stripe gives us to keep your membership in sync.
3. Legal bases
Where the GDPR or UK GDPR applies, we rely on: performance of a contract (running your listing and your membership); legitimate interests (keeping the directory accurate and free of spam and fraud, and defending against abuse); consent (where you choose to publish information on your listing, which you can withdraw by editing or removing it); and legal obligation (keeping billing records).
[TODO: confirm which regimes apply given where you are established and who your users are]
4. Who else sees your data
We do not sell your personal data, and we do not share it for advertising. We share only what is necessary with:
- Anyone, for published listing content — your listing is public and search engines will index it.
- Stripe — payment processing for Premium memberships, under their own privacy policy.
- Google Fonts — the site loads fonts from Google, which means your browser contacts Google and discloses your IP address when a page loads. [TODO: self-host the fonts if you want to avoid this disclosure — it has been the subject of GDPR complaints in the EU]
- Our hosting and email providers — to store the site and deliver our emails. [TODO: name your host and transactional email provider, and note any transfer outside your region]
We may also disclose data where the law requires it, or to investigate fraud or abuse of the directory.
5. Cookies
We do not use advertising or tracking cookies, and we do not run third-party analytics. WordPress sets cookies when you log in, to keep you signed in and to secure forms. If you never log in, you will generally not receive a cookie from us.
[TODO: revisit this section if you add analytics or any embedded third-party content — you would then likely need a consent banner]
6. How long we keep it
Listings and their content are kept while your listing is live and for a period afterwards so we can handle disputes. Reviews are kept while the listing they concern exists, since removing them would misrepresent a proxy's history. Proof-of-address documents are kept only as long as needed to verify and defend a listing. Billing records are kept as long as tax and accounting law requires.
[TODO: commit to specific retention periods, e.g. "12 months after a listing is removed" — regulators expect numbers, not "as long as necessary"]
7. Your rights
Depending on where you live, you may have the right to access the data we hold about you, correct it, delete it, object to or restrict how we use it, receive it in a portable form, and withdraw consent. Proxies can exercise most of these directly from the dashboard by editing or removing their listing.
To make a request, contact us. We will respond within the time the applicable law allows. If you believe we have mishandled your data, you can complain to your local data protection authority.
One limit worth stating plainly: we may not be able to delete a review you wrote if doing so would misrepresent a proxy's track record to other shoppers, though we can remove your name from it.
8. Security
We take reasonable measures to protect your data: proof-of-address files are stored outside the public web root, payment details never touch our servers, and access to admin tools is restricted. No site can promise perfect security, and you send information to us at your own risk.
9. Children
This site is not intended for children, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes
If we change this policy we will update the date at the top of this page, and we will tell listed proxies by email if the change is significant.