Privacy Policy

Who we are

This website is operated by Elow Development, a sole trader based in the United Kingdom. We are the controller of the personal data described in this policy under UK GDPR and the Data Protection Act 2018. If you have any questions about this policy or how we handle your data, you can contact us at [email protected].

What data we collect

We aim to collect as little personal data as possible, and you can browse most of the site without an account. What we collect depends on how you use it.

Everyone who visits

• Server logs: your IP address, browser type and referring page are recorded in standard server logs for security and diagnostic purposes.
• Usage data: information about how you use the site, such as pages visited, through Google Analytics cookies (see Cookies below).
• Search terms and filter use: what you type into the search box, and anonymous totals of which filters, sorts and views are used (see Cookies below).
• Click records: when you click through to an operator, or click a featured or promotional card, we record the click with the page it was on and your IP address, and your account if you are signed in. We use this to count visits sent to operators, to work out affiliate commission and to measure featured placements.
• Security checks: when you sign up, log in or reset a password, a Cloudflare Turnstile check runs in your browser to tell people from bots, and at sign-up your IP address is checked with a third-party service to spot proxies and data-centre networks.

If you create an account

• Account details: your name, email address, a hashed (not readable) password, and whether you have verified your email. Only your hashed password is stored, never the password itself.
• Saved items: competitions you save, and operators you follow or hide (see Personalisation below).
• Saved searches and alerts: the searches you save, their filters, and your email settings (how and when alerts arrive, any pause).
• Entries you log: the competitions you tell us you entered, the number of tickets, the amount you paid and any winnings, plus any budget (amount and period) you set.
• Preferences: your default view, sort and filters, and your choices for "Did you enter?" prompts, weekly picks and news and offers emails.
• Take a break: the date a break you chose runs until.
• "Did you enter?" tracking: when you click through to an operator while signed in, we remember (for your browser session only) which competitions you clicked, so we can ask you later whether you entered. We do not put this in your account unless you tap to log an entry.
• Activity log: for signed-in users we keep a log of actions on the site: signing in and out, registering, changing your name, password or preferences, saving or deleting alerts, logging or removing entries, exporting your entries, creating or revoking an API token, clicking out to an operator, opting in or out of emails, and which main pages you view. Each entry records the time, your IP address and your browser type. We keep it for security, to investigate abuse and to support you when something goes wrong. It is not used to profile you for marketing.
• Email records: a record of the alert and account emails we send you (the kind, how many items, the time and the message reference), whether an address bounced or was reported as spam, and which campaign emails you have received.
• AI assistant connections: see "AI assistant connections (MCP)" below.

If you are an operator

• Contact and account details: your name, email address and the site you have claimed, and the details of how you proved you control it (the address a verification code went to, and when).
• Portal use: the pages you view in the portal and what you do there (such as exporting data, following rivals, or sending us feedback, a dispute or a re-evaluation request, and the message you wrote).
• Email preferences: which operator emails you receive.
• Featured placement purchases: your PayPal subscription reference, its status and dates, the competition you featured and any wording and artwork you uploaded. Payment is taken by PayPal, so we never see or store your card details.
• Interview material: any recording, photo or transcript you send us, and a record (IP address and browser type) when the interview guide is downloaded.

Operators we list

We list competition sites using information they publish, and some of it can relate to a person (for example a public contact email address, or a company name or director from the public register at Companies House). We use it to list the operator accurately and to contact it about its listing, the free operator portal or an interview.

How we use your data and why

UK GDPR says we must have a lawful basis for each use of personal data. Ours are:

• Contract (providing the service you asked for): running your account, saved items, entries, budgets, breaks and preferences; sending the alerts and reminders you set up; connecting your AI assistant; and, for operators, the portal and any featured placement you buy.
• Legitimate interests: keeping the site secure and preventing abuse, bots and scraping; fixing faults; the activity log; counting clicks and measuring featured placements and affiliate links; anonymous analytics and totals of filter use, so we can improve the site; sending service and product-update emails to people who already have an account; and contacting listed operators about their listing, the free portal or an interview. We have weighed these against your rights and expectations and keep what we collect to what is needed. You can object to any of them (see Your rights).
• Consent: News and offers emails, which you opt into explicitly and can withdraw at any time. We also ask for consent before weekly picks emails, which you switch on yourself in Preferences.
• Legal obligation: keeping accounting and payment records for operators who pay us, and responding to lawful requests.

We do not sell your personal data. We do not share it with third parties for their own marketing. We do not use automated decisions that have legal or similarly significant effects on you.

Emails we send

• Account and security emails (verification, password reset, a welcome email, notices about your account). Sent because they are part of your account. You cannot opt out while you have an account.
• Alerts and closing reminders you set up: saved search alerts, closing-soon reminders, saved competition notices and new competitions from operators you follow. They need your email to be verified, you choose which are on, and we cap how many are sent in a day. Stop them by switching the alert off, pausing, or taking a break.
• Weekly picks: a Monday suggestion based on your weekly budget. Off unless you switch it on in Preferences.
• Service and product updates: occasional emails to people who already have an account telling them about changes to the service, such as the launch of the free account features. We send these on the basis of legitimate interests and each one has an unsubscribe link.
• News and offers: occasional emails about new features and operator offers. Sent only if you have opted in. Switch them off in Preferences or with the unsubscribe link in any of these emails. Opting out of this does not stop your alerts or account emails.
• Operator emails (if you are an operator): a Monday weekly summary, rival alerts you choose, notices about your featured placement and your requests, and introductions to the free portal or interviews. The weekly summary and rival alerts have one-click unsubscribe links, and you can reply to any other operator email to ask us to stop.

We record which emails we sent. We may record when a link in an email is clicked, and our email provider may record when an email is opened or a link is clicked, so we can tell which emails are useful. Our email provider also tells us about delivery, bounces and spam reports so we stop emailing addresses that cannot receive them.

Personalisation

If you have an account, "Recommended" suggests competitions using what you have already told us: the operators you follow, the operators and kinds of prize in competitions you have saved or logged as entered, and the ticket price you usually pay. It is built only from data we already hold for your account, with no extra tracking, and the result is kept for a short time (about two hours) and refreshed when your follows, saves, entries or hidden operators change. Weekly picks and the suggestions in My entries use your budget and entries in the same way.

To avoid it, do not use the Recommended filter or switch weekly picks off in Preferences. You can also stop feeding it by unfollowing, unsaving, removing entries or hiding operators, or by deleting your account.

"Did you enter?" asks you, once, after you click through to an operator, whether you entered. You can switch it off in Preferences. It is also off during a break.

AI assistant connections (MCP)

If you connect an AI assistant (such as ChatGPT, Claude or Cursor) to CompWatch using the Model Context Protocol, that assistant sends your questions to us and receives live competition data in return. When you do this:

• Your questions and your account are shared with the AI provider you chose to connect. How that provider handles your data is governed by their own privacy policy, not ours.
• We record which tool was requested and the arguments passed, linked to your account, for security, abuse prevention and support.
• Access requires you to authenticate. We never receive your AI provider's password, and you can revoke a connection at any time by deleting its token from your account page.

The AI chat that used to be built into this site has been retired. The messages it stored have been exported to private storage and deleted from our systems. We keep that export for 30 days, so we can answer anyone who asks what we held about them, and then delete it.

Operators' Monday summary emails may start with a short recap written by an AI model from Anthropic. We send it only that operator's own summary figures for the week (such as its draws, sales and visits, and the names of competitions and tracked rival operators), not account details, and we check the result before it is sent.

Who we share data with

We use the following service providers (processors) to run the site. They may only use your data to provide their service to us.

• Hetzner: hosts our servers and the file storage for images, uploaded artwork and backups.
• Cloudflare: content delivery, security and the Turnstile bot check on sign-up, login and password forms.
• Brevo: delivers our emails.
• Google: Google Analytics (website usage, through cookies). We also read aggregate reports from Google Analytics and Search Console; these contain no personal data about you.
• PayPal: takes payment for operators' featured placements and for data licences, and for the Power Mode subscriptions that ended when it became free. PayPal is an independent controller of the payment details you give it.
• Stripe: took payment for a small number of early Power Mode subscriptions, which ended when Power Mode became free. It still holds those payment records. We do not take new payments through Stripe.
• Sentry: error tracking. When something goes wrong, the error report may include your IP address, the page, and your account if you were signed in.
• Anthropic: writes the short recap at the top of operators' weekly summary emails, from the operator's own figures only (see above).
• ProxyCheck.io: at sign-up, your IP address is sent to this service to check whether it belongs to a proxy or data-centre network.

We also look up public information, such as company details from Companies House and review ratings shown on Trustpilot's public widget. These lookups do not involve any personal data about you. If you click through to a competition site, that site receives your visit and its own privacy policy applies. We may disclose data if the law requires it or to protect our rights or others' safety.

Sending data outside the UK

Our servers are hosted by Hetzner in the United States, and some of the other providers above (including Google, Cloudflare, Sentry, PayPal, Stripe, Anthropic and Brevo) are based in or process data in countries outside the UK, including the United States and the European Economic Area. Where that happens we rely on a recognised safeguard, such as a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework), the UK International Data Transfer Addendum, or standard contractual clauses. Contact us if you would like more detail.

Cookies

This site uses essential cookies required for the site to function (such as session cookies). We also use Google Analytics to understand how visitors use the site. Google Analytics sets cookies to collect anonymous usage data such as pages visited and time on site. We do not use third-party advertising cookies.

To improve the filters and search, we also count, in totals only, which filters, sorts and views are used on the competition lists, and keep the searches typed into the search box. A made-up code held in your browser tab (not a cookie, and never linked to your account) is used for a day to count each visit once. Searches are deleted after 180 days, and the network address stored with one is cleared after 30 (a shortened network prefix, and your account if you were signed in, stay with the search until it is deleted).

Third-party links

This site contains links to third-party competition websites. When you click a link to visit an external site, that site's own privacy policy applies. We are not responsible for the privacy practices of other websites.

Data retention

• Your account: kept until you delete it. You can do this yourself on the Security tab of your account, and it takes effect straight away.
• What deleting your account erases: your name, email address, hashed password, saved items, follows, hidden operators, saved searches and alerts, logged entries, budget, preferences, take-a-break date, email settings, sign-in sessions, API and AI assistant connection tokens, and your activity log entries. If you are an operator, your claim on the listing is released and the records of how you proved you control it are removed.
• What stays after you delete your account:
  • A scrambled one-way hash of your email address, with no name, kept for 30 days so the same address cannot sign straight back up to get round a limit or a ban.
  • If you ever had a paid subscription with us, the payment reference (not your name or email), kept for 6 years for accounting.
  • Records that belong to the business rather than to you, which are kept but no longer linked to your account: click records, searches (until their own deletion dates below), and, for operators, the feedback, dispute and re-evaluation messages you sent from the portal, which stay with the operator's listing.
  • A log line that an account was erased, with no detail about who.
• Before you can delete your account: if you have an active data licence, an active PayPal subscription, or (as an operator) an active featured placement subscription, that has to be ended first, so we do not leave a payment running with nobody able to cancel it. For a featured placement, cancel on the Advertise page of the portal. For the others, email us and we will do it with you.
• Other people's records and accounts we close: deleting your account does not remove anything held by the providers above under their own policies (for example PayPal's records of a payment). If we close an account because it broke our terms, we may keep the minimum needed to stop it coming back, for as long as that remains necessary.
• Searches: deleted after 180 days, and the IP address stored with one is cleared after 30.
• Server logs: up to 60 days.
• Activity log: deleted 12 months after each entry is made. When your account is deleted, your entries are deleted straight away.
• Click records: the records of clicks to operators and on featured and promotional cards, including the IP address on them, are not yet deleted on a fixed schedule, because operators' featured-placement reports and our visit counts are built from them and we are still working out how long they are needed. They are never used to profile you. If you delete your account they are unlinked from it. To ask us to remove the IP address from records about you, email us.
• Email records: the log of alert and account emails we sent you is deleted after 12 months. The record that a one-off announcement was sent to your account loses your email address after 12 months and is deleted with your account.
• Interview guide downloads: the IP address and browser type are cleared after 90 days.
• Retired AI chat: the old chat messages have been deleted. The export we made first is deleted 30 days after it was made.
• Operators: portal and placement records are kept while your listing is claimed. Records of payments (PayPal references and dates) are kept for at least six years for accounting and tax reasons. Interview recordings are kept until you ask us to take them down.
• Backups: we keep encrypted backups of our database so we can recover from a failure. Most are replaced within 30 days, but a reduced set is kept for longer: weekly copies for about 8 weeks, monthly copies for about 4 months and yearly copies for up to 2 years. Data you delete therefore stays in those backups until they expire, which can be up to 2 years. We only restore a backup to recover from a failure, and if we ever restore one we will delete again anything that had been deleted since it was taken.

Your rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you, and get a copy (you can also export your logged entries as a CSV file from My entries).
• Request correction or deletion of your data.
• Ask us to restrict how we use your data, or object to a use that relies on legitimate interests, including profiling.
• Ask for the data you gave us in a portable format.
• Withdraw consent for email communications at any time.
• Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been mishandled.

To exercise any of these rights, email [email protected]. We will normally reply within one month. We may need to check who you are first.

Age

This site is for people aged 18 and over. We do not check anyone's age, it is not aimed at anyone under 18, and we do not knowingly collect data from children. If you think a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with an updated revision date.