Privacy Notice
Last updated: September 20, 2026
This notice explains how BB Radar collects and uses personal data, who we share it with, how long we keep it, and the rights you have.
Who we are
BB Radar is operated by Bricks & Bytes Ltd, a company registered in England and Wales under company number 15661979, with its registered office at 85 Great Portland Street, London, W1W 7LT. Bricks & Bytes Ltd is the controller of the personal data described in this notice.
For anything about your personal data, contact us through our contact form at /contact.
What this notice covers
This notice covers bbradar.com. It does not cover the websites of the software vendors listed on BB Radar, which have their own privacy notices, or the wider Bricks & Bytes website at bricks-bytes.com.
What we collect and why
Browsing the site
When you visit BB Radar, our hosting provider receives the technical information every website receives: your IP address, your browser and device type, and the pages you request. We use this to deliver the site and keep it secure.
We measure site traffic with Plausible Analytics. Plausible does not use cookies and does not store anything on your device. It counts visits using your IP address and browser information, which it does not store in identifiable form. We use the results to understand which pages and features are used.
Lawful basis: our legitimate interests in running a secure, working website and understanding how it is used.
Watching a demo
Product demos are hosted by Cloudflare Stream. When a demo player loads, your browser connects to Cloudflare, which receives your IP address. If you press play, the player stores a small amount of data on your device so it can match video quality to your connection. See our Cookie Policy at /cookies for details.
Lawful basis: legitimate interests in showing you the demo you chose to view.
Submitting a listing
If you submit software for listing, we collect your company name, tagline, description, website address, and a contact email address. We use these to review the submission, contact you about it, and publish the listing if it is approved. The company details you submit are published on the site once approved. The contact email is not published.
Lawful basis: legitimate interests in operating the directory and responding to listing requests.
Contacting us
If you use our contact form, we collect your name, email address, the subject, and your message. We use these to reply to you. Please do not include sensitive personal information in your message.
Lawful basis: legitimate interests in responding to enquiries.
Paying for a listing
Paid listings are processed by Stripe. We send Stripe the billing contact email for the listing. You enter your payment details directly on Stripe's own checkout page, so your card details never reach us. Stripe sends us a record of each payment, which we keep for accounting purposes.
Lawful basis: performance of our contract with you, and our legal obligation to keep accounting and tax records.
Protecting our forms from abuse
Our forms are protected by Cloudflare Turnstile, which checks that a real person is using the form. Turnstile receives your IP address when the form loads and again when you submit it. When you submit a form, we also record your IP address in our security log, and we keep a scrambled, non-reversible version of it to limit repeated submissions.
Lawful basis: legitimate interests in preventing spam, fraud, and misuse.
People who appear in vendor listings
Vendor listings can include information about people at those companies, such as founders and team members: their name, job title, a short biography, a photo, and a link to their LinkedIn profile. Demo videos are recordings of product demonstrations and may show or name the people taking part.
We receive this information from the vendor, or collect it from the vendor's own public materials. We publish it so visitors can see who is behind each product.
Lawful basis: legitimate interests in presenting accurate information about listed software and the teams behind it.
If you appear in a listing or a demo and want your information changed or removed, contact us through our contact form at /contact.
Emails we send
We send transactional emails about submissions, revisions, payments, and replies to enquiries. These are sent through Resend. We do not send marketing emails from BB Radar.
Who we share data with
We use the following service providers to run BB Radar. Each processes personal data on our behalf, under a data processing agreement, and only on our instructions.
- Vercel hosts the website.
- Supabase provides our database, file storage, and administrator sign-in. Our database is hosted in London.
- Cloudflare provides form protection (Turnstile) and video hosting (Stream).
- Resend sends our emails.
- Plausible Analytics provides cookie-free site analytics.
- Stripe processes payments.
Stripe also acts as an independent controller for some purposes, including fraud prevention and meeting its own legal obligations. Stripe's use of data for those purposes is covered by Stripe's privacy policy at stripe.com/privacy.
We may also disclose personal data where required by law, or to protect our rights, our users, or the public.
We do not sell personal data.
International transfers
Some of our providers are based outside the UK, or use staff and facilities outside the UK, including in the United States and Singapore. Plausible Analytics processes data in the European Union, which the UK recognizes as providing adequate protection.
Where personal data is transferred outside the UK to a country without UK adequacy regulations, it is protected by the transfer safeguards in each provider's data processing agreement. These are the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or certification under the UK Extension to the EU-U.S. Data Privacy Framework, as applicable.
How long we keep data
- Security log IP addresses: 6 months, then removed from the log.
- Rate-limiting records: a short period, then deleted automatically.
- Listing submissions that are rejected or not completed: 12 months from the decision or last activity.
- Approved listings and billing contacts: for as long as the listing is live, then 6 years for accounting purposes.
- Contact form messages: 12 months after the enquiry is resolved.
- Payment records: 6 years from the end of the accounting period they fall in, as required for tax purposes.
- Photos of people in listings: deleted within 30 days of the listing being removed, or promptly on request.
- Names, job titles, and LinkedIn links of people in listings, and demo videos: kept while the listing is live, and removed with it.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct data that is wrong or incomplete
- ask us to delete your data
- ask us to restrict how we use your data
- object to our use of your data where we rely on legitimate interests
- ask for data you gave us in a portable format, where the processing is based on a contract
Some rights have limits. For example, we must keep payment records for as long as tax law requires, even if you ask us to delete them.
To use any of these rights, contact us through our contact form at /contact. We will respond within one month.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first through our contact form at /contact, using the subject "Data protection complaint," or by post to our registered office above. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk or by calling 0303 123 1113.
Changes to this notice
We will update this notice when our use of personal data changes. The date at the top shows when it was last updated.