What we collect, and why

Who we are

Laurel is a product of CopperPress. [FOR COUNSEL] — the registered entity name and address, the data controller identity, and a contact for data protection questions.

What this site collects

Two things, and they are worth separating.

If you book a demo

The form asks for your name, your publication, your email address, a phone number and roughly how big your market is. We also record the IP address and browser the request arrived from, which is there to tell a real enquiry from automated spam. It is stored so we can answer you and so the enquiry is not lost if the notification email fails; it is not added to a marketing list, it is not sold, and it is not passed to a third party for their own purposes. [FOR COUNSEL] — lawful basis, retention period, and how to ask for it to be deleted.

If you just read the site

These pages set no cookies of their own and load no fonts, scripts or images from another company — everything the page needs comes from this domain. Our hosting and network provider records the usual server-side request logs and may set its own operational cookies for security and traffic analysis. [FOR COUNSEL] — naming that provider, its role (processor), and whether a cookie notice is required in the jurisdictions we sell into.

If you write to us on the support page

Our support page is the one page on this site that differs from the paragraph above, in two ways worth naming. It sets a session cookie of ours, which exists to protect the form against forged submissions and to hand your words back to you if something goes wrong; and it loads Cloudflare's Turnstile — the only script on this website that comes from another company — which is there to tell a person apart from automated spam. Turnstile never decides whether you get help: a challenge that fails or never loads does not stop your message reaching us. The form asks for your name, your email address, what your question is about and the message itself, and we record the IP address and browser it arrived from. It is stored so we can answer you and so your message is not lost if the notification email fails; it is not added to a marketing list and it is not sold. [FOR COUNSEL] — lawful basis and retention period. Cloudflare's own role is answered under Bot and spam protection below.

Bot and spam protection

We use Cloudflare Turnstile to tell people apart from automated abuse. It runs in its invisible mode: on almost every visit it draws nothing at all and you will never know it ran, and it only asks you to do something if Cloudflare wants a closer look.

To make that judgement Cloudflare receives four things about the request: your IP address, a fingerprint of the encrypted connection your browser opened, the line your browser sends describing itself, and the public key identifying the form you are on together with the address of the page it sits on. Turnstile then hands your browser a single-use challenge token, and when you submit the form our server sends that token back to Cloudflare to be checked. The token records that a check happened and how it went. It is spent on that one submission and it is not an identifier for you.

Cloudflare does that check as our processor — on our instructions, for us. It also uses what it sees to improve how well Turnstile tells people from bots, and for that second purpose it is acting for itself rather than for us. Cloudflare states that Turnstile sets no cookies and does not look for them, and that what it collects is not used for advertising: not handing the problem to an advertising business is the reason it exists.

All of that is set out in the Cloudflare Turnstile Privacy Addendum, which forms part of this notice by reference.

Turnstile runs on the pages where automated abuse would do real damage: nominating, voting and registering to vote on a Best Of ballot we host, and our own support form. It runs nowhere else on this website. It is never a gate — a check that fails, or never loads at all, does not stop your vote, your nomination or your message reaching us. It is one signal among several that a person then reviews. The ballot surfaces now carry this disclosure themselves, on the publisher's own hostname, from the same source as the paragraphs above. [FOR COUNSEL] — where Cloudflare holds what it sees and which transfer mechanism covers it.

Payments

Card payments are processed by Stripe, and card details are entered on Stripe's own hosted pages. We never see, store or transmit a card number. CopperPress is the merchant of record. [FOR COUNSEL] — the processor relationship, what Stripe returns to us, and where that is held.

Contest data belongs to the publisher

If you voted or nominated in a Best Of contest, that contest is the publisher's, not ours. We run the software on their behalf; they decide what is collected and they answer for it. Their own privacy notice governs it, and the fastest route to a question about your vote or your email address is the publication that ran the contest. [FOR COUNSEL] — the controller/processor split with publishers, and how a voter request routed to us is handled.

Your rights

[FOR COUNSEL] — access, correction, erasure, portability and objection; the response window; how to complain to a supervisory authority; whether GDPR, UK GDPR, CCPA/CPRA or all three apply to how we sell.

Changes to this notice

[FOR COUNSEL] — how changes are announced and whether prior versions are kept available.