Terms and policies
Privacy
The short version: this service does not want to know anything about the person your list concerns, and there is nowhere on it to tell us.
Last written 9 September 2026
What is never collected. No name, date, relationship or address of the person your list concerns. There is no field for any of it anywhere on this site, and none of it is wanted. If you type something of that kind into your list, it is removed on our server before anything is written down — not afterwards.
No uploads. There is no way to upload a photograph, a scan, a letter, a certificate or a file of any kind to this service. That channel does not exist in the software. It is not a feature we left for later; documents of that kind should not be travelling through a website.
Never used for training. What you write is never used to train a model, ours or anybody else’s.
1. Who is responsible for your information
The company named on the legal information page is the controller of the personal data described here. That page also carries the postal address and telephone number. Questions about privacy go to support@assuredfd.shop, and are answered by a person.
2. Using the service without an account
You can complete one full use of Whatorder — both columns and the sheet you can send — without making an account and without giving us anything at all.
When you do that, the list you type stays in your own browser tab. The sorting runs in your browser. Nothing you typed is sent to us, and there is nothing for us to hold.
3. What is held when you do have an account
| What | Why | Lawful basis |
|---|---|---|
| Your email address and a sign-in credential | To let you back into your own account | Performance of a contract |
| The text of the lists you choose to save, after names, dates, addresses and similar have been stripped out on our server | So the columns and the sheet are there when you come back | Performance of a contract |
| Your plan, and the record of payments taken | To run the subscription and to meet tax record-keeping duties | Performance of a contract; legal obligation |
| Server logs: an abbreviated network address, timestamps, error traces | To keep the service running and to find faults | Legitimate interests in a working, secure service |
| Counts of page views, only if you accepted optional cookies | To see which pages are hard to use | Consent |
Card details are never held by us and never reach our servers. Payment is handled by a payment provider that is certified to PCI DSS Level 1, and we receive only a token, the amount, and whether the payment succeeded.
4. Stripping personal details before storage
When you ask us to save a list, the text passes through a stripping step on our server before it is written down. That step removes email addresses, telephone numbers, dates in every common form, years, postcodes, street lines, long reference numbers, words describing a family relationship, and words that look like personal names.
It is deliberately blunt and it will sometimes remove more than it needed to. We would rather hold too little than too much.
5. Who else sees anything
Nobody sees your lists except you. We do not sell personal data, we do not share it for anyone else’s purposes, and we do not use it for advertising. There is no advertising on this site and no third-party tracking of any kind.
The only outside parties involved at all are:
- the company that hosts the servers this site runs on;
- the payment provider, which handles card details so that we never do;
- the provider of the language model used for the optional sorting step, where you choose to use it. What is sent to it is the text of your list. It is not retained by them and it is not used for training.
Each is bound by a written contract that permits them to act only on our instructions.
6. Sending information outside the United Kingdom
Some of those providers are outside the United Kingdom. Where personal data is transferred out of the United Kingdom, we rely on adequacy regulations where they exist, and otherwise on the UK International Data Transfer Agreement, or on the UK Addendum to the European Commission’s Standard Contractual Clauses, together with a transfer risk assessment. A copy of the mechanism used for any given transfer is available on request.
7. How long anything is kept
- Lists you did not save: not kept at all. They never leave your browser tab.
- Lists you saved: until you erase them or close your account.
- Account details: until you close the account, and then removed within 30 days.
- Payment records: six years, because tax law requires it.
- Server logs: 30 days.
8. Erasing everything, in one action
There is a single control inside the account that erases everything held under it. It is a real deletion: the records are removed, not flagged as hidden and kept. Backups are overwritten on a rolling 30-day cycle, after which no copy survives anywhere.
The only thing that remains is the payment record, which we are required by tax law to keep, and which contains no part of anything you wrote.
9. Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to be told what we hold about you and to have a copy of it; to have it corrected; to have it erased; to restrict or object to what we do with it; to have it moved to another provider; and to withdraw consent at any time where we relied on consent.
Ask at support@assuredfd.shop. We answer within one month and there is no charge.
Complaining to the regulator
If you are not satisfied with how we have handled your personal data, you have the right to complain to the Information Commissioner’s Office, the United Kingdom’s supervisory authority, at ico.org.uk/make-a-complaint or on their helpline. You may complain to them without coming to us first, although we would rather have the chance to put it right.
If you live in California
Under the California Consumer Privacy Act you have the right to know what personal information is collected and how it is used, to have it deleted, to correct it, and not to be treated differently for exercising any of those rights. We do not sell or share personal information as those terms are defined by that Act, and we have not done so in the preceding twelve months. Requests go to the same address, and are answered on the same terms.
10. Children
This service is not for anyone under 18, and we do not knowingly hold personal data about anyone under 18. If you believe we have, write to us and it will be removed.
11. Keeping it safe
Everything travels over an encrypted connection and is encrypted where it is stored. Access is limited to the people who need it to run the service and is logged. If a breach ever occurred that was likely to result in a risk to your rights, we would tell the Information Commissioner within 72 hours and tell you without undue delay where the risk was high.
12. Cookies
The cookie page lists every cookie this site uses, what each one does, and how to change your choice.
