Legal
Privacy notice
Last updated
This notice explains what personal data HotWhatHow collects, why, how long we keep it and the choices you have. It is generated from the same list the website's code is checked against, so it describes what the site actually does.
Your rights
Under UK data protection law (UK GDPR and the Data Protection Act 2018) you can ask us to:
- tell you what personal data we hold about you and give you a copy,
- correct it, or delete it,
- stop or restrict using it, or object to how we use it (including withdrawing consent for price alerts, analytics or affiliate & marketing cookies at any time),
- send it to you in a portable format.
Use the contact form and choose "Privacy / my data". We reply within one month. If you are unhappy with our answer you can complain to the Information Commissioner's Office (ico.org.uk · 0303 123 1113).
Children
HotWhatHow is not aimed at children under 13 and we do not knowingly collect their data.
Changes
When this notice changes we update the date at the top. Significant changes will be shown on the site before they take effect.
Who we are
HotWhatHow (hotwhathow.com) is run by MeWeBe, the data controller for the personal data described here. Contact us about privacy through the contact form (topic “Privacy / my data”).
What we collect, why, and for how long
Clicks to retailers
Product, offer, retailer network, where on the page you clicked, the page path you came from (no query string), the time, and a random click reference that the network reports back if a sale follows. Not your IP address and not your user-agent: only a one-way fingerprint of the browser type that changes every day, used to stop automated click loops.
- Why
- To get paid by affiliate networks, and to show which deals are useful (counts only).
- Lawful basis
- Legitimate interests
- How long
- Fingerprint removed after 7 days; click rows deleted after 395 days (13 months — networks confirm sales for up to a year). Daily totals are kept without any identifier.
Price-drop alerts
Your e-mail address, the product and your target price (if any), and when you confirmed, were last e-mailed or unsubscribed.
- Why
- To send the alerts you asked for. Nothing is sent until you confirm by e-mail.
- Lawful basis
- Consent (double opt-in) — withdraw with the one-click unsubscribe link
- How long
- Unconfirmed requests are deleted when the confirmation link expires; unsubscribed alerts 30 days after you unsubscribe.
Messages you send us
Your name, e-mail address, topic and message from the contact form.
- Why
- To reply to you and fix the issue you report.
- Lawful basis
- Legitimate interests
- How long
- Deleted 365 days after you send them (sooner on request).
Web-server access logs
IP address, browser user-agent, page requested, response code and time — written by the web server in front of the app, not by the app itself (the app never stores IP addresses).
- Why
- Security, abuse prevention and fixing faults.
- Lawful basis
- Legitimate interests
- How long
- 14 days
Staff accounts (admin only)
E-mail, password hash (argon2id), optional encrypted 2-factor secret, session records (hashed token, hashed browser type), hashed sign-in attempts, and an audit log of changes.
- Why
- To secure the admin area and keep a record of who changed what.
- Lawful basis
- Legitimate interests
- How long
- Sessions until they expire; sign-in attempts for a short lockout window; the audit log while the account exists.
Who else handles data
These organisations process data for us (processors, under contract) or receive it when you choose to go to them (independent controllers, under their own privacy policies). “In use now” reflects how the site is configured today.
| Organisation | What for · what data | Where | In use now |
|---|---|---|---|
| Hetzner Online GmbH (server hosting)Processor | Runs the web server and database that power the site. Everything the site stores (see “What we collect”), plus web-server access logs (IP address, browser user-agent, page requested, time). | European Union (Germany / Finland data centres) | YesAlways |
| Cloudflare, Inc.Processor | DNS, TLS encryption, caching and protection against attacks. Your IP address and request details while they pass through Cloudflare's network; the Cloudflare security cookies listed below. | Global network (UK GDPR transfer safeguards: UK International Data Transfer Addendum / Data Privacy Framework) | YesAlways |
| Our e-mail delivery provider (SMTP)Processor | Sends price-alert confirmations and alerts, and forwards contact-form messages to us. Your e-mail address and the content of the e-mail (product, price, your message). | As set out by the provider | NoOnly when e-mail is switched on |
| Anthropic, PBC (AI text generation)Processor | Drafts product summaries and guides from specifications and retailer data; an editor reviews every draft. No visitor data — only product specifications, category information and price statistics. | United States | NoOnly when the AI drafting tool is configured |
| Plausible AnalyticsProcessor | Privacy-friendly page-view statistics. Pages viewed, referrer, browser type and country (no cookies; your IP address is not stored by them). | European Union | NoOnly if enabled AND you choose “Allow analytics” |
| Google Analytics 4 (Google Ireland Ltd / Google LLC)Processor | Page-view and usage statistics. Pages viewed, device and browser information, approximate location, the _ga identifiers. IP addresses are not logged or stored by GA4. | EU and United States (Data Privacy Framework) | NoOnly if enabled AND you choose “Allow analytics” |
| Skimlinks — affiliate link scriptIndependent controller | Its JavaScript on our pages turns retailer links into tracked affiliate links and records clicks, so we earn commission. Pages viewed and links clicked, your IP address and browser details as seen by Skimlinks, and the Skimlinks cookies listed on the cookie policy. | As set out in Skimlinks' privacy policy | YesOnly if enabled AND you choose “Affiliate & marketing” |
| Affiliate networks and retailers (e.g. Awin, CJ, Rakuten, impact.com, eBay Partner Network, Amazon Associates, and the sub-affiliate services Skimlinks and Sovrn Commerce)Independent controller | Pay us a commission when you buy after clicking “View deal”. We pass only a random click reference. Once you are on their site, the network and retailer use their own cookies under their own privacy policies. | As set out by each network / retailer | YesWhen you click through to a retailer |
Cookies and browser storage
Full details, and the button to change your choice, are on the cookie policy.
| Name | Type · set by | Purpose | How long |
|---|---|---|---|
| hwh_consentAll visitors | Cookie · first-partyHotWhatHow | Strictly necessary. Remembers your cookie choice (essential only, or which optional categories you allowed: analytics, affiliate & marketing) so we do not ask on every page. Value: v1:essential, v1:analytics, v1:affiliate or v1:analytics+affiliate — nothing else. | 180 days, then we ask again |
| hwh_themeAll visitors | Cookie · first-partyHotWhatHow | Strictly necessary. Remembers the colour theme you picked with the sun/moon button (value: light or dark — nothing else), so pages load in that theme. Only set when you press the button; without it the site is white. Under PECR this is strictly necessary to provide the setting you asked for, so it needs no consent. | 1 year (choosing again renews it) |
| hwh_regionAll visitors | Cookie · first-partyHotWhatHow | Strictly necessary. Remembers the shopping region you picked with the region switcher or the “Shopping from …?” prompt (value: uk or us — nothing else), so we show you that region’s retailers and prices and take you to the same page in your region. Only set when you choose a region; we never set it from your location. Under PECR this is strictly necessary to provide the setting you asked for, so it needs no consent. | 1 year (choosing again renews it) |
| hwh:recent-searchesAll visitors | Local storage · first-partyHotWhatHow | Functional. Your last five searches, shown when you open the search box. Stays in your browser — it is never sent to us. Cleared with “Clear recent searches” or by clearing site data. | Until you clear it |
| __Host-hwh_adminStaff only | Cookie · first-partyHotWhatHow | Strictly necessary. Staff sign-in session for the admin area only (random token; we store only its hash). HttpOnly, Secure, SameSite=Lax. Never set for visitors. Named hwh_admin on non-https development machines. | Ends at sign-out, after 2 h idle or 12 h at most (configurable) |
| Skimlinks cookies (skimresources.com)Only after you allow “Affiliate & marketing” | Cookie · third-partySkimlinks — our affiliate partner, only if its script is enabled | Affiliate & marketing (opt-in). Set by the Skimlinks script on Skimlinks' own domains (skimresources.com, redirectingat.com) to record that you clicked a retailer link from HotWhatHow, so the retailer's commission can be attributed to us, and to count link clicks. Names and contents are decided by Skimlinks — see their privacy and cookie policy. Normally only after you allow “Affiliate & marketing”; withdrawing consent stops the script on our pages (clear their cookies in your browser).Needs your consent | As set by Skimlinks (see their cookie policy) |
| __cf_bmOnly when Cloudflare's protection is active | Cookie · third-partyCloudflare (our CDN / security provider) | Strictly necessary. Set by Cloudflare's bot protection, when it is active, to tell people from automated traffic. Not used by us for anything else. | 30 minutes |
| cf_clearanceOnly when Cloudflare's protection is active | Cookie · third-partyCloudflare (our CDN / security provider) | Strictly necessary. Set only if Cloudflare shows you a security check, to remember that you passed it. | Up to 30 minutes (Cloudflare setting) |
What we never do
- Store your IP address or full user-agent string in our database or application logs.
- Allow cross-site tracking cookies before you choose “Affiliate & marketing”.
- Sell personal data or build advertising profiles.
- Load analytics before you opt in to analytics (none are enabled by default).
- Hot-link product images from retailers — images are fetched by our server, so retailers do not see your visit.