Confidentiality & Privacy Policy

This Privacy and Confidentiality Policy sets out how CeliacRanking / CoeliacRanking("the Platform", "we", "us") collects, uses, stores, processes, and protects your personal data.

We are committed to maintaining the highest standards of confidentiality and data security in compliance with the UK General Data Protection Regulation (UK GDPR), the UK Data Protection Act 2018, the EU GDPR (Regulation 2016/679), and applicable international privacy frameworks.

Under GDPR Article 6, we process your personal data under the following lawful bases:

• Contractual Necessity: To create and manage your account, authenticate your sessions, and deliver core rating features.
• Legitimate Interests: To moderate reviews, prevent fraudulent manipulation of rankings, secure the application against abuse, and diagnose performance bottlenecks.
• Consent: For optional analytics cookies, preference storage, or location permissions. You may revoke consent at any time.
• Legal Obligation: Where necessary to comply with applicable statutory obligations or lawful law enforcement requests.

We strictly limit the use of personal data to:

• Operating, personalising, and optimising the Celiac Ranking web application.
• Attributing community reviews and safety scores to user profiles.
• Detecting spam, fraudulent reviews, coordinated rating attacks, and duplicate venue records.
• Responding to user support queries and communicating service updates.

We never sell, rent, or trade your personal data.

We disclose personal data only to trusted infrastructure providers acting as Data Processors under strict Data Processing Agreements (DPAs):

• Database & Authentication: Supabase Inc. (encrypted storage and OAuth identity management).
• Hosting & Edge Delivery: Cloud infrastructure and Content Delivery Networks (CDNs) for fast and secure global asset delivery.
• Legal Requirements: Disclosures strictly mandated by competent courts or law enforcement authorities.

International Transfers: Where data is processed outside the UK or European Economic Area (EEA), we ensure adequate protections through UK International Data Transfer Agreements (IDTAs), EU Standard Contractual Clauses (SCCs), or adequacy decisions.

Retention Periods:

• Active user accounts: Retained for the duration of registration.
• Account deletion: Upon account closure, personal contact details, login credentials and written review text are permanently deleted. Numeric star ratings and ranking lists you created are retained under the anonymised identifier "Past User" to safeguard community historical integrity.
• Server access logs: Rotated and purged every 30 to 90 days.

You possess enforceable legal rights regarding your personal information:

To exercise any of these statutory rights, please email our Data Protection contact at privacy@celiacranking.com. We respond to all verified requests within 30 days.