Privacy Policy

Who we are

Peculiar Systems is an independent software studio — a small team building oddly specific products. We are the data controller for the personal data described in this policy. For anything here, write to contact@peculiar.systems — a person reads it and answers — or by post:

What we collect, and when

• Email address — only when you submit it in a form on one of our pages (product updates, a free sample, beta access, a quote request). Every signup is double opt-in: nothing is stored as active until you confirm from your inbox.
• What you type into a brief or request field — e.g. the list you want ListDrop to build, a link to your app for ShipShots, or the shop address you want ShopOffen to check.
• Documents you send us for a review engagement (e.g. DryRun pre-audits) — driver and vehicle files you choose to share, which may contain personal data of your drivers. We use them only to produce your report, share them with no one, and delete them within 30 days of delivering the report (email us to delete sooner).
• Documents sent to our processing API (InvoiceIn) — held in memory for the duration of the request and discarded; we keep no copy. They may contain business contact data of the sender and receiver (names, addresses, VAT and bank identifiers), which we do not store, analyse or share. Request logs record the timestamp, API-key prefix, document format and size — never the document itself.
• Messages you send us on WhatsApp — your phone number, profile name and what you write, if you choose to contact us there. WhatsApp is run by Meta under its own terms and privacy policy; we use the conversation only to reply to you and never add your number to a mailing or outreach list.
• Basic technical data — IP address and the page a signup came from, stored with the signup for abuse prevention; for the API, the IP address is counted per day to enforce the no-key demo quota. For a ShopOffen check, the shop address and your IP address are stored with the request to enforce the daily limit; the request and its report are deleted after 30 days. ShopOffen asks for no email address.
• Anonymous visit counts. Our host, Cloudflare, counts page views with Cloudflare Web Analytics: a small script reports the page address, the page you came from, your browser type, your country and how fast the page loaded. It sets no cookies, stores nothing in your browser and does not identify or follow you across sites.
• Nothing else. No tracking cookies, no advertising pixels, no other analytics. The only thing our pages keep in your browser is a functional preference (like your language choice), stored locally and never sent to us.

Why we use it (and the legal bases)

• To deliver what you asked for — samples, reports, quotes, product updates you signed up to receive (consent / performance of a contract).
• Transactional email — confirmations and, for subscribers, the feed you're paying for (performance of a contract).
• Anonymous visit counts — to see which pages people actually read (legitimate interest).
• Business-to-business outreach — we occasionally write one-time notes to companies whose public websites indicate our products are relevant to their business, using contact details those companies publish themselves (legitimate interest under UK PECR / GDPR Art. 6(1)(f)). We identify ourselves, we don't write twice to the uninterested, and any reply asking us to stop is honored immediately.

Where it lives

Our infrastructure runs on Cloudflare (hosting, database, network edge and the cookieless visit counter) and Resend (email delivery); the InvoiceIn processing API and the ShopOffen scanner run on a virtual server rented from Hetzner Online GmbH (Germany), reachable only through Cloudflare's network. Cloudflare, Resend and Hetzner act as processors on our behalf; both are covered by standard contractual clauses for international transfers. We do not sell, rent, or share your personal data with anyone else.

About the data inside our products

FirstFile and PreOpen compile public business records — company registrations and food-business registrations published by government registries (the Colorado Secretary of State, Companies House, the UK Food Standards Agency). These records concern businesses, are already public by law, and are redistributed under those registries' open-data terms. If a record concerns you personally as a registered agent or director and you'd like it excluded from our feeds, email us and we'll suppress it.

How long we keep it

Until you leave. Unsubscribing marks your address inactive; asking us to delete removes it entirely. Signup logs are kept up to 12 months for abuse prevention, then removed.

Your rights

Wherever you are — and in the UK/EU under GDPR specifically — you can ask what we hold about you, have it corrected, have it deleted, or object to our use of it. One email to contact@peculiar.systems does any of these; every marketing email also carries a one-click unsubscribe link. If you're in the UK/EU and unhappy with our answer, you may complain to your local supervisory authority.

Changes

If this policy changes materially, the effective date above changes with it, and active subscribers get a note.