PRIVACY CENTRE
What we hold, why, and how long for.
Under 18?
There’s a version of this written properly for you, without the legal language.
Read that instead →The short version
- ✓ We don’t sell data and we don’t show you advertising
- ✓ You can download everything we hold, in one tap, from Settings
- ✓ You can delete your account in-app — 14 days to change your mind, then it’s gone
- ✓ Under-18s need a guardian to confirm, and the guardian can withdraw at any time
- ✓ We collect a delivery address only when we’re sending you something, and delete it 30 days later
What we do with your data
Account creation and identity
Operate the competition and enforce one account per person
Why we’re allowed to: Performing our contract with you — Necessary to provide the service the person signed up for
What’s involved: name, handle, email, phone, city, country, avatar
How long: Until deletion is requested, then 14 days, then anonymised
Who else sees it: Supabase (EU)
Leaving the UK: None — database hosted in London (eu-west-2)
Under-18s: 13-17s permitted with verified guardian consent
Video entries and publication
Run the competition and publish approved entries
Why we’re allowed to: Performing our contract with you — Entering is voluntary; publication is the point of entering and is stated before submission
What’s involved: video, audio, likeness, handle, transcript
How long: Masters purged 90 days after publication; published clips remain public
Who else sees it: YouTube (publication), Supabase Storage (EU)
Leaving the UK: YouTube (US) — publication is the intended purpose and is user-initiated
Under-18s: Guardian consent required before a minor may enter; withdrawal removes pending entries
Points ledger and standings
Score the competition, decide prizes, produce verifiable records
Why we’re allowed to: Performing our contract with you — Core to the competition being fair and checkable
What’s involved: handle, points, timestamps, category
How long: Retained for the life of the competition; anonymised on account deletion
Who else sees it: public (ledger and leaderboards)
Under-18s: Same as adults; no behavioural profiling for advertising
Identity verification for prize eligibility
Confirm a prize winner is who they say, for prizes over £100
Why we’re allowed to: A legal obligation — Fraud prevention and prize integrity; also legitimate interests
What’s involved: verification outcome, provider reference, year of birth
How long: Outcome retained 24 months; we never receive or store documents
Who else sees it: Stripe Identity (US)
Leaving the UK: Stripe Identity (US) — Standard Contractual Clauses; documents never reach us
Under-18s: Under-18s are not asked to verify; guardian handles prize claims
Prize fulfilment
Send prizes that have been won
Why we’re allowed to: Performing our contract with you — Necessary to deliver what was won
What’s involved: name, postal address, email
How long: Delivery details auto-deleted 30 days after delivery
Who else sees it: couriers
Under-18s: Guardian involved for minors
Safety, moderation and reports
Keep the competition safe and lawful
Why we’re allowed to: Our legitimate interests — Protecting users, especially minors, outweighs minimal privacy impact
What’s involved: reports, moderation decisions, ban reasons, device signals
How long: Reports retained 24 months; ban records retained while the ban stands
Who else sees it: Supabase (EU)
Under-18s: Child safety is the primary driver of this processing
Talent scoring and scout referrals
Identify consistent performers and, with consent, introduce them to licensed partners
Why we’re allowed to: Our legitimate interests — Scoring uses only competition performance; NO referral without separate written consent
What’s involved: performance scores, consistency, placings
How long: Scores recomputed continuously; referral records retained 24 months
Who else sees it: licensed partners — only with explicit consent
Under-18s: Referrals involving minors require guardian consent in addition to the player's
Transcription and AI metadata
Generate captions for accessibility and suggest titles, tags and descriptions
Why we’re allowed to: Our legitimate interests — Improves accessibility and reach; suggestions are never applied without the creator accepting them
What’s involved: audio, transcript
How long: Transcripts retained with the entry; deleted with the entry
Who else sees it: Groq or OpenAI (US), Anthropic (US)
Leaving the UK: Groq/OpenAI/Anthropic (US) — Standard Contractual Clauses; no training on our data under their API terms
Under-18s: Applies to minors' clips too — flagged for the DPIA
Email and push notifications
Send the newsletter and service notifications
Why we’re allowed to: Your consent — Marketing email requires opt-in; service notifications are contractual
What’s involved: email, push subscription, opt-in state
How long: Until unsubscribe; suppression list kept indefinitely to honour the unsubscribe
Who else sees it: Resend (US)
Leaving the UK: Resend (US) — Standard Contractual Clauses
Under-18s: Marketing email restricted to 16+ at the database query level
Clout Pass subscriptions
Take payment for the optional membership
Why we’re allowed to: Performing our contract with you — Necessary to provide the subscription
What’s involved: customer id, subscription state, amounts
How long: Billing records retained 7 years (tax law)
Who else sees it: Stripe (US)
Leaving the UK: Stripe (US) — Standard Contractual Clauses
Under-18s: Pass is available to any account; grants no competitive advantage
Companies that process data for us
Supabase
Database, authentication and file storage
United Kingdom (London) · Data stays in the UK/EU
Vercel
Application hosting
EU region; company US · Standard Contractual Clauses
YouTube / Google
Publication of approved entries
United States · User-initiated publication; their terms apply
Anthropic (only if enabled)
AI agents and metadata suggestions
United States · Standard Contractual Clauses; no training on API data
Groq (only if enabled)
Speech-to-text for captions
United States · Standard Contractual Clauses
OpenAI (only if enabled)
Speech-to-text (alternative provider)
United States · Standard Contractual Clauses
Stripe (only if enabled)
Payments and identity verification
United States · Standard Contractual Clauses; PCI DSS Level 1
Resend (only if enabled)
Transactional and marketing email
United States · Standard Contractual Clauses
How long we keep things
Master video files deleted 90 days after publicationautomatic
Account anonymised 14 days after deletion requestautomatic
Delivery details deleted 30 days after deliveryautomatic
Invite emails not retained after sendingautomatic
Hashed visitor records, 90 daysscheduled
Moderation reports, 24 monthsscheduled
Verification outcomes, 24 monthsscheduled
Billing records, 7 years (tax law)scheduled
Fraud signals, 12 monthsscheduled
purge rejected after 30dscheduled
purge delivery after 5yscheduled
purge minor mediascheduled
purge on withdrawalscheduled
never retainscheduled
purge address after 90dscheduled
purge scores after 1yscheduled
never purgescheduled
purge master after 3yscheduled
purge unconfirmed after 30dscheduled
purge on launch + 12mscheduled
Your rights
Three of these you can exercise yourself, right now, without asking us or waiting:
- 📦 See and download your data — Settings → Download my data
- 🗑️ Delete your account — Settings → Delete my account
- ✉️ Stop marketing email — Settings, or one tap in any email
For correction, restriction, objection, or anything else, email us and we’ll respond within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk — we’d rather you came to us first, but it’s your right either way.
This page is generated from our actual processing records, so it can’t drift out of date the way a hand-written policy does.