Privacy Policy
Last updated:
The short version
Balworth collects very little. No ads on the site, no advertising cookies, and we never sell your data. Exploring the map needs no account. We count visits anonymously, with no cookies and nothing that identifies you. If you allow analytics, we also see how people use the site, but never which places you look at on the map, and if you came from one of our Google ads we tell Google whether it led to a signup. If you subscribe, we hold your email address and a record of your subscription. Our providers keep short-lived technical logs, as every website's do. That is all of it.
1. Who we are
Balworth is a trading name of Muttlabs LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States. Muttlabs LLC is the data controller for the personal data described here.
Write to us at privacy@balworth.com about anything in this policy.
2. What we collect and why
- Your email address — only if you sign in. So we can send sign-in codes and know which subscription is yours. We process it to provide the service you asked for.
- Your subscription record — only if you subscribe. The Stripe customer and subscription identifiers, status, current period end, region, and the country used to work out any tax. We process it to provide the service and to meet our tax and accounting obligations.
- Technical logs. Our hosting and database providers keep short-lived server logs of requests, including IP addresses, for security, fault-finding and aggregate traffic statistics — how many people opened a page, and which search engines and crawlers fetched it. We do not use them to identify or profile you, and nothing is stored on your device to produce them. We process them for the legitimate purpose of keeping the service secure, working and understood.
- Payment details: never. Card data goes straight to Stripe and never reaches our servers. Stripe holds your payment details and billing history as an independent controller — see the Stripe Privacy Policy.
- Anonymous visit counts — for everyone. Which page was opened, which website or campaign link led there, and whether one of three steps happened: signing up, starting checkout or subscribing. We send these to PostHog from our own server, so your IP address never reaches them, and each count gets a fresh random label, so no two counts can be linked to each other or to you. Nothing is stored on your device to make them. We process them for the legitimate purpose of understanding which pages and campaigns bring people to Balworth.
- Analytics — only if you allow it. PostHog then records how you use the site: the pages you open, what you click, and a recording of how the page responded, with all text and everything you type hidden. If you sign in, it links this to your account by a random identifier, never by your email address. We never record which places you search or look at on the map: locations are removed from web addresses and all text is hidden before anything is sent. We process this with your consent, which you can withdraw at any time.
- Whether our ads work — only if you allow analytics, and only if you arrived by clicking one of our Google ads. Google adds a click reference to the web address; we keep it with your analytics, and if you then sign up or subscribe, we send Google that reference, which of the two happened and when. Nothing else goes to Google: not your email address, not what you looked at. We process this with your consent, as part of analytics.
- Nothing else. No advertising profiles, and we never give your email address to advertisers. We make no automated decisions about you.
3. Who processes it for us
A small number of providers, each bound by a written data processing agreement requiring them to act only on our instructions:
- Supabase — database and sign-in. Data stored in the EU (AWS eu-west-1, Ireland).
- Vercel — website and API hosting, United States, plus edge locations worldwide.
- Resend — sending sign-in codes and service emails, EU region.
- Stripe — payments, United States and globally; an independent controller for payment data and in part our processor.
- PostHog — anonymous visit counts for everyone, and analytics only if you allow it. Data stored in the EU (AWS eu-central-1, Frankfurt).
- Google (Google Ads) — only if you allow analytics and arrived from one of our ads: the ad's click reference and whether you signed up or subscribed, under Google's Ads Data Processing Terms.
We do not sell your data, we do not share it for anyone else's marketing, and we do not pass it to anyone else except where the law requires it.
4. Where it goes
Your account and subscription records are stored in Ireland, and analytics data in Germany. Muttlabs LLC is based in the United States, so the person who runs Balworth accesses that data from the United States, and Vercel, Stripe and Google are United States companies. Where personal data crosses a border we rely on the Standard Contractual Clauses (and the equivalent UK addendum), which our providers incorporate into their data processing agreements.
5. How long we keep it
| What | How long |
|---|---|
| Your account and email address | While your account exists, then deleted within 30 days of your asking |
| Sign-in codes and sessions | Codes expire within an hour; sessions end when you sign out |
| Subscription and payment records | Six years after your last payment — tax law requires it |
| Server and security logs | Up to 30 days |
| Anonymous visit counts | 12 months |
| Analytics, if you allow it | 12 months; session recordings one month |
| Support emails | Two years after the matter is closed |
6. Storage on your device
We set no advertising cookies. We use your browser's storage for up to three things:
- Strictly necessary: your sign-in session, and a record of the storage choice you made here. Without these, the thing you asked for cannot work, so they do not need your consent.
- Preferences, only with your consent: your chosen layers, places, map settings and options, so the map looks the same when you return. We store nothing in this category until you have agreed, and you can withdraw agreement at any time.
- Analytics, only with your consent: PostHog stores a random identifier in a cookie and in local storage (their names start with
ph_), so it can tell a returning visitor from a new one, plus the click reference if you came from one of our Google ads (kept for up to 90 days). Nothing is stored until you allow analytics, and switching it off deletes it. Anonymous visit counts need nothing stored at all.
Change your choice any time via Cookie settings in the footer of the home page or the account menu on the map. Signing out removes the session.
7. Third-party requests
Some content loads from third parties, which necessarily see your IP address in order to serve you: map tiles from the ONS (cdn.ons.gov.uk), our own database at Supabase, and — only when you search a postcode — the postcodes.io API. Fonts are served from balworth.com itself. None of these are used by us to track you.
If you allow analytics, your browser sends it to balworth.com/ingest, which passes it on to PostHog, so PostHog sees your IP address. Anonymous visit counts go through our own server instead, so PostHog never sees it.
8. Security
We keep personal data to a minimum. It is held with providers that encrypt it in transit and at rest. Sign-in is passwordless, so there are no passwords to steal. Access is limited to the one person who runs Balworth. If a personal data breach is likely to put your rights at risk, we will notify the relevant authority within 72 hours and tell you without undue delay where the law requires it.
9. Your rights
Whichever country you are in, you can ask us for a copy of your data, ask us to correct it, delete it, give you a portable copy, restrict what we do with it, or object to processing we do for our own legitimate purposes. Where we rely on your consent — preference storage and analytics — you can withdraw it at any time without affecting what we did before. Data protection law in your country may give you further rights; we honour those too.
To exercise any right, email privacy@balworth.com. We reply within one month, and there is no charge.
Deleting your account cancels any active subscription and removes your email address and preferences. We keep the minimum payment record that tax law requires, and it is not used for anything else.
If you are unhappy with how we handle your data you can complain to the data protection authority in your country — in the UK that is the Information Commissioner's Office, and every EU country has its own. We would rather you told us first, but you do not have to.
10. If you are in the United States
Balworth is operated by a Wyoming company and sold worldwide.
We do not sell your personal information, and we never have. We do not share it for cross-context behavioural advertising. We show no ads on Balworth; we advertise Balworth itself on Google, and only if you allow analytics do we tell Google whether one of those ads led to a signup. Analytics runs only if you switch it on, and you can switch it off at any time in Cookie settings. If you want a formal request recorded, email privacy@balworth.com and we will confirm in writing what we hold. We do not process sensitive personal information to infer characteristics about you, and we make no automated decisions with legal or similarly significant effects.
We are not currently subject to the California Consumer Privacy Act or the comprehensive privacy laws of other US states — we are well below every applicable threshold and we do not sell personal information. We will say so here if that changes. Whichever country you are in, you can ask for a copy of your data, ask us to correct it, or ask us to delete it, and we will not treat you differently for asking.
11. Children
Balworth is not directed at children and is not designed for under-18s. You must be 18 or over to subscribe. We do not knowingly collect personal data from children. If you believe a child has given us their details, email privacy@balworth.com and we will delete them.
12. Complaints about privacy
Email privacy@balworth.com. We acknowledge within two working days and answer within one month. If you are not satisfied, your national data protection authority is above.
13. Changes to this policy
The date at the top tells you when this policy last changed. If we make a change that materially affects how we use your data, we will email account holders before it takes effect.
14. Contact
Muttlabs LLC (trading as Balworth), 30 N Gould St Ste N, Sheridan, WY 82801, United States.
Privacy: privacy@balworth.com
Everything else: help@balworth.com