Privacy policy

Controller

CSL Longstone Ltd trading as HostStack UK is the data controller.

CSL Longstone Ltd trading as HostStack UK. Company number 16970515, registered in England and Wales. Registered office: 102a Lancelot Road, Exeter, England, EX4 9BX. This is the registered office only; no trading address is stated.

Customer and privacy enquiries: admin@csl-longstone.com; telephone +44 7533 039068. Please do not reply to noreply@hoststack.uk, which is send-only.

What we collect

Contact form: your name, email address, subject and message, so we can reply (legitimate interests).

Accounts: your email address and sign-in details, so you can buy and re-download files securely (contract).

Error reports: if the site breaks in your browser, we record only a fixed error code and page route; no error message, stack trace or browser details are stored (legitimate interests).

Community measurement: we record community page paths and view dates and times, linked to your account ID when signed in. Staff use these records to count views and members returning on different days, alongside membership and posting totals. Signed-out views have no account ID. These records do not include IP addresses, device details or referrers, and this measurement adds no analytics cookies or browser storage. Account-linked view records are personal data, not anonymous statistics. We do not use them for advertising. Our hosting provider separately processes IP addresses and technical request logs to deliver and secure the site; it does not publish how long it keeps these logs.

Purchases: order details (product, price, date, payment references, your delivery choice and cancellation consent records) and your email address, so we can deliver your files and meet our legal and tax obligations (contract and legal obligation). Card details are handled by Stripe, not by us.

Community members

This section applies to the HostStack Community (version community-legal-v1.1, approved 15 October 2026, edits approved 16 October 2026). Community rules: hoststack.uk/community/rules.

2.1 What we collect when you use the community. Your display name; threads, replies and edits; reports you submit; complaints and appeals; dates and times of activity; moderation decisions about your account or content; and your existing account details (email address, which is never shown publicly).

2.2 What is public. When the community is live, your display name and visible posts can be seen by anyone, including people without an account, and may appear in search engines. Held, hidden and deleted posts are not public.

2.3 Why we use it and lawful basis. Owner operational default, 15 Oct 2026, subject to legal/privacy verification: contract for providing the community; legitimate interests for proportionate safety and spam prevention; legal obligation only for specifically identified duties. Not yet verified by a professional.

Providing the community and your profile — Proposed lawful basis: Contract

Pre-moderation, automated filtering and spam prevention — Proposed lawful basis: Legitimate interests (keeping the service safe and usable)

Handling reports, complaints and appeals — Proposed lawful basis: Legitimate interests; legal obligation where OSA duties apply

Keeping moderation records — Proposed lawful basis: Legal obligation / legitimate interests

Reporting suspected crimes — Proposed lawful basis: Legal obligation / legitimate interests

2.4 Automated filtering. Posts are automatically checked against a list of prohibited words and patterns. A match holds the post for human review; it does not by itself lead to a decision about your account. A person reviews every held post.

2.5 Who processes it. Our website, database and sign-in are provided by Lovable (Lovable Labs Sweden AB), which uses its own sub-processors (listed at trust.lovable.dev/subprocessors). Our main community database and its daily backups are held in the UK (London). Some processing happens elsewhere: pages and files are delivered through a global content delivery network, and some service requests may be processed in the United States. Lovable does not publish how long it keeps logs or backups. Where data leaves the UK, safeguards are described in Lovable's privacy policy (lovable.dev/privacy). We do not sell community data or use it for advertising.

2.6 How long we keep it. Owner provisional default, 15 Oct 2026, subject to privacy review: visible posts while your account is active or until you delete them; deleted and hidden posts, reports and moderation records for 12 months after the event, unless needed longer for a legal claim, an ongoing investigation or a report to authorities (documented exceptions). 12 months is provisional.

2.6A If you close your account. Owner decision 15 Oct 2026, subject to privacy review: we remove your display name and profile, and may keep threads and replies that other members rely on, shown as "Former member". Where practicable we also remove personal identifiers and personal details you quoted in your posts. This reduces, but does not guarantee, the chance of you being identified — for example, other members may recognise your writing or details. If removing your name would not effectively protect you, we will consider removing individual posts. You can ask us to erase your posts; we will honour valid erasure requests, except where we have a documented lawful reason to keep something (for example a legal claim, an investigation or a report to authorities). Moderation records are kept as set out in 2.6.

2.7 Your rights. Access, correction, erasure, restriction, objection and portability, via the Contact page. We verify identity manually before acting. Erasure may be limited where we must keep records for safety or legal reasons. You can complain to the Information Commissioner's Office (ICO).

How long we keep it

Order and payment records: 6 years after the end of the financial year of the sale, for company accounting and tax duties.

Accounts: until you ask us to delete your account; order records are then kept for the period above.

Contact messages: up to 12 months after the enquiry is resolved.

Error reports: up to 90 days.

Community page-view records are subject to manual retention review; no automatic deletion is currently implemented.

Deletion is carried out manually by us on review; it is not automatic. Our hosting provider's own log and backup retention is not published by that provider.

Service providers

Lovable (Lovable Labs Sweden AB) provides our website hosting, database, sign-in, file storage and account and order emails, using its own sub-processors (listed at trust.lovable.dev/subprocessors). It acts on our behalf as our service provider.

Stripe processes payments. Stripe receives your payment and billing details directly and is responsible for some of that processing under its own privacy policy (stripe.com/gb/privacy).

We do not sell personal data or use it for advertising.

Where data is processed

Our main database and its backups are held in the UK (London). Website pages are delivered through a global content delivery network, so technical request data may be processed outside the UK. Some provider services may be processed in the United States. Stripe processes data internationally. Where data leaves the UK, we rely on the safeguards described in each provider's published privacy terms (lovable.dev/privacy; stripe.com/gb/privacy). Contact us for more information.

Your rights

You can ask for access to, correction of or deletion of your data, object to processing, or complain to the Information Commissioner's Office (ico.org.uk).

Requests and privacy complaints

Email admin@csl-longstone.com with Privacy request or Privacy complaint. Depending on processing, you may request access, correction, erasure, restriction or portability, object to legitimate-interest processing, and withdraw consent without affecting previous lawful processing. Legal limits may apply, including required financial record retention.

Rights requests are normally answered within one month, subject to lawful extensions and necessary identity or clarification checks. Privacy complaints must be acknowledged within 30 days, investigated without undue delay, and followed by progress and outcome information. The owner must operate this process; it is not automated. You may complain to the ICO: https://ico.org.uk/make-a-complaint/.

Required data and payment decisions

Contact data is needed to reply; account/order data is needed for secure access and delivery. Stripe supplies billing and card-country data. Our UK-only rule rejects non-GB billing or card-issuer countries before capture. Contact us if the decision is wrong or you need review. No marketing profiles or newsletter are enabled; order consent is not marketing consent. Future marketing needs a documented PECR basis and clear opt-out.

Cookies

Customer and staff sign-in uses browser storage needed to maintain the requested session. Our application code does not deliberately add advertising trackers. We do not use advertising cookies. Google Analytics cookies (_ga, _ga_*) are set only if you choose “Accept analytics” in our cookie prompt. They record pages viewed, product views, checkout starts and completed purchases (order reference, product and price; never your name, email or payment details) so we can see which pages and campaigns lead to sales. Google processes this data for us and may transfer it outside the UK. Our lawful basis is your consent; you can withdraw it at any time using Cookie settings in the footer. Staff and admin pages are never measured. Non-essential storage/access technologies must meet the applicable PECR information and consent requirements; exemptions must be assessed, not assumed.