§1 Who We Are

Your data is controlled by Todwright Ltd, a company registered in England & Wales, company number 17362759, registered office Unit 82A, James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE. Data-protection registration with the UK regulator (the Information Commissioner's Office): ZC210393. We collect the minimum needed to run AnthroList, never sell your data, and honour your data rights (§7).

§2 What We Collect, and Why

To run your account: your username, an encrypted email address, a one-way password hash, and your account settings (including content-filter preferences).

What you publish: your avatar and banner images, reviews, ratings, comments, and any catalog entries you submit are stored and, unless otherwise noted, public by design -- you chose to post them.

Your watchlist and ratings are stored against your account so we can show them back to you; ratings and favourite counts are aggregated and shown publicly (star averages, watchlist counts) without identifying who contributed them, unless you are viewing your own account.

To keep the site safe (our legitimate interest): session data, moderation reports you file or that are filed against your content, and the resulting ticket records. Short-lived infrastructure logs may contain IP addresses and are kept only as long as operationally necessary.

§3 Legal Basis

We process your account data to perform our contract with you (running the account you registered for), and process safety/moderation data under our legitimate interest in keeping the service usable and lawful. Where content you post reveals something the law treats as sensitive, that is your own choice to make it public; we do not ask for or require any such disclosure.

§4 What We Do Not Do

No advertising trackers and no third-party analytics run on AnthroList today. We do not sell your data to anyone. If and when an affiliate programme (§5) goes live, clicking one of those outbound links shares your click with that programme's own operator (for example, Amazon) under their own privacy policy, outside our control -- we will update this section and the relevant Cookie notice when that happens, not retroactively describe it as already true.

§5 Sharing

We never sell your data. Our hosting and infrastructure providers process data on our behalf under a processor arrangement, for infrastructure purposes only. We disclose data to UK authorities when lawfully compelled, or to report serious harm (anything touching a child's safety above all). Where you follow an affiliate link (Terms §9), the destination site's own privacy practices apply to what happens after you leave AnthroList.

§6 Retention & Erasure

Account data is kept while your account is active. You may delete your account at any time via account settings. Deleting your account removes your public profile, avatar, banner, reviews, comments, and ratings from public view. Catalog entries you submitted that have already been published remain part of the catalog (removing your account does not un-publish a work others rely on), but are no longer attributed to your account.

Records of your acceptance of these Terms and this Privacy Policy are kept as an append-only consent record (never edited, never deleted while your account exists) as our proof of consent under UK GDPR Article 7. Moderation and safety records relating to sanctioned accounts may be retained pseudonymised after account deletion, consistent with our legitimate interest in preventing ban evasion and our record-keeping obligations.

§7 Your Rights

You have the right to access, correct, erase (subject to §6), restrict, port, and object to our processing of your data, and to withdraw consent where consent is the basis for processing. All free, answered within one calendar month. Contact us via the registered office address in §1, or the account support desk. You may also complain to the UK regulator, the Information Commissioner's Office (ico.org.uk), at any time -- we would welcome the chance to put things right first, but you do not need our permission to complain.

§8 Cookies

AnthroList currently sets one cookie: a session cookie that keeps you signed in. It is strictly necessary for the service to function and is not used for advertising or tracking. If we add analytics or affiliate-tracking cookies in future, we will update this section and, where the law requires, ask for your consent before setting them.

§9 Children

AnthroList accounts require you to be 18 or older (Terms §2). If we learn an account belongs to someone under 18, we close it and delete the associated data, save what the law requires us to keep.

§10 Changes to This Policy

We may update this Privacy Policy from time to time. A substantive change requires fresh acceptance before you can keep using an account. It is your responsibility to review updates when prompted.