Privacy Policy

1. Who controls your data

The operator of Global Emergency Alerts is the data controller for the personal data covered by this policy. This policy is written with UK GDPR and the Data Protection Act 2018 in mind. If you access the service from outside the UK, local privacy laws may also apply. We can be contacted using the support email below for privacy questions, rights requests and service-data queries.

2. What data we collect

Subscription and payment data

• Email address used for receipts, billing notices, support replies and essential service communications.
• Payment and subscription references made available by the payment processor, such as customer or subscription identifiers and renewal status.
• Limited billing metadata shown in the processor dashboard. We do not store your full card number or card security code.

Push notification technical data

• Push subscription endpoint, browser/device keys and OneSignal identifiers needed to send web push alerts.
• Device-linking and entitlement records used to connect a paid subscription to enabled browsers or devices.
• Basic technical indicators and delivery logs used to diagnose notification issues.

Contact and support data

• Information you send by email or website contact form, including your name, email address and message content.

Website and security data

• IP address, request logs and security records used to protect the website and reduce abuse.
• Cookie or analytics data where those tools are enabled, including basic usage and performance information from analytics services where permitted.
• We do not intentionally collect precise GPS location, contact lists, photos, microphone access, camera access or private files as part of the standard alert subscription service.

3. How we use your data

• To provide the service and send qualifying alerts by web push.
• To process payments and manage subscriptions, renewals and cancellations.
• To provide customer support and investigate delivery or technical issues.
• To maintain security, prevent abuse and keep operational records.
• To understand basic website performance and page usage where analytics are enabled.
• To comply with legal, tax, accounting or regulatory obligations.

4. Lawful bases

• Contract: where processing is necessary to provide your subscription and related support.
• Legitimate interests: where processing is reasonably necessary for diagnostics, security, fraud prevention and service administration.
• Legal obligation: where records or disclosures are required for compliance reasons.
• Consent: where consent is required, such as allowing browser notifications or enabling non-essential cookies or analytics.
• Vital interests / public interest: may apply only in exceptional circumstances if we ever need to process or disclose limited information to help protect someone from serious harm, where the law allows or requires it.

5. Who we share data with

We share personal data only where reasonably necessary to run the service, including with:

• Payment providers such as Stripe for payments, subscription management, customer portal access and fraud checks.
• Cloudflare for hosting/API logic, content delivery, performance, website security and limited operational records, including Cloudflare Worker/KV data used to manage alert entitlement and device-linking workflows.
• OneSignal and browser/platform push infrastructure used to manage web push subscriptions and route notifications to enabled browsers or devices.
• Push infrastructure providers used by browsers or platforms to route notifications, such as Apple, Google or Mozilla services.
• Email or support providers such as Resend or mailbox providers if used for essential service emails, receipts, support handling or operational notifications.
• Analytics providers such as Google Analytics where enabled, to understand basic site usage, page performance and visitor behaviour in aggregated or pseudonymous form where possible.

We do not sell personal data, and the service is not designed around advertising profiles or selling user behaviour to advertisers.

6. International transfers

Some providers may process data outside the UK. This may include providers involved in payments, push notifications, hosting, analytics, email delivery and security. Where required, lawful safeguards may be used, such as adequacy decisions, standard contractual clauses or other permitted transfer mechanisms.

7. Retention

• Billing records: retained as required for accounting, tax and legal obligations.
• Push subscription data: retained while active or until alerts are disabled, expire or are removed from the system.
• Security logs: retained for a limited period needed for protection, troubleshooting and abuse prevention.
• Support messages: retained for as long as reasonably needed to answer the enquiry, maintain records and deal with follow-up issues.
• Analytics records: retained according to the settings of the analytics provider and only for as long as reasonably useful for website performance and service improvement.

8. Cookies

We may use essential cookies or similar technologies for site functionality, payment flow, security and abuse prevention. We may also use analytics tools such as Google Analytics to understand page visits, traffic sources and basic site performance.

If non-essential cookies, analytics or marketing-related technologies require consent in your location, consent will be requested where required by law.

You can control cookies in your browser settings. Notification permissions are managed separately through your browser or device settings.

9. Your rights

Depending on the circumstances, you may have rights to:

• access, correct or delete certain personal data;
• request restriction of certain processing;
• object to certain uses based on legitimate interests;
• request portability where relevant rights apply; and
• withdraw consent where processing depends on consent.

To raise a privacy question or rights request, contact [email protected].

10. Push notifications

• Push notifications are delivered using browser/device permissions and supporting push services such as OneSignal and platform push infrastructure.
• We use push identifiers and entitlement records to decide whether a subscribed user should receive customer alerts on enabled devices.
• You can enable or disable notifications at any time in your browser or device settings.
• If notifications are disabled, alerts will not be delivered to that browser or device.
• Some platforms, including iOS Safari, may require adding the site to the Home Screen before web push works correctly.

11. Security

We use reasonable measures to protect data, including HTTPS, access controls, security tooling, Cloudflare protections, limited administrative access and least-privilege handling of credentials. No online service can be guaranteed completely secure.

12. Children

The service is not intended for children, and we do not knowingly collect personal data from children.

13. Complaints

You can complain to the UK Information Commissioner's Office if you are unhappy with how your data is handled. We recommend contacting us first so we can try to resolve the issue directly.

14. Changes to this policy

We may update this Privacy Policy from time to time. When that happens, the Last updated date on this page will be changed.