Privacy notice

Who runs this

VeganArchive is operated by an individual (the "archivist") based in the United Kingdom. The site has no employees and no investors. The archivist is the data controller for the purposes of UK GDPR and the Data Protection Act 2018.

For any data request — access, deletion, correction, complaint — write to [email protected]. A real person reads that inbox.

What we collect

Four small streams, all listed in plain language below.

The newsletter

If you subscribe to The Acquisitions List, we store your email address and your first name (when you give one). We also note which page of the site you signed up on, so we can see which entry points are useful. Sign-up is double opt-in: you receive a confirmation email, and until you click the link and confirm, the signup is "pending" and you receive no further mail. Unconfirmed sign-ups are deleted within three days. Sign-ups that are plainly automated (bots) are removed from the list, or never stored at all. You can unsubscribe from any issue we send — the link is at the bottom of every one — and that is the end of the relationship: we mark your address unsubscribed and send nothing further. We keep the address only so an old unsubscribe link still works; ask and we will delete it outright.

The request form

If you file a missing product via /submit, we store the email address you give us, the brand and product you named, and any note you added. We also store a one-way hash of your IP address — not the IP itself — so we can flag obvious spam floods without keeping anything that identifies you on a network.

We use your email address only to confirm we received your request and to write back about it if we need to. We do not add request submitters to the newsletter, and we do not use the email for anything else.

Searches that find nothing

When a search on this site finds nothing, or an address has no page, we may keep the words that were searched, but never your IP address or anything else about you, for up to 180 days to help decide which brands to ask next. Anything that looks like an email address, a long number or a link is dropped before it is stored.

Visit counts

Cloudflare Web Analytics counts which pages are read, the site you came from, and your country, device type, browser and operating system. It uses no cookies, doesn't fingerprint your browser and doesn't identify you. We only ever see totals.

What we do not collect

• No tracking cookies. No advertising pixels.
• No third-party social embeds (no Facebook, no Twitter, no TikTok loaders).
• No browser fingerprinting.
• No account system, so no passwords or session data.
• No location data beyond what Cloudflare needs to route a request, and the country Web Analytics counts in totals.

Who else sees the data

We use three operational services. Each sees a small slice of the archive, listed below. We do not sell or share data with anyone else.

Cloudflare

Hosts the site and routes our email. Sees the standard HTTP request metadata any host sees (IP, user agent, time). Cloudflare may also set a minimal session cookie for security purposes (DDoS protection). It also runs Web Analytics, our visit counter, which uses no cookies and reports totals to us, never individual visitors. Their own privacy policy covers this in detail.

Resend

Delivers our outbound email — the outreach to companies, the newsletter, and the confirmation/notification mails. Resend sees the recipient address and the message body, the same as any email provider. Their policy is here.

Anthropic

Reads the body of company replies for the parser that extracts a suggested verdict (we then read it ourselves before publishing). Anthropic never sees newsletter subscribers, request submitters, or any reader of the public site — only the contents of email replies from companies, plus the brand name when we use the research tool. Their policy is here.

Cookies

We set no cookies of our own. We use no analytics that set cookies. Cloudflare may set a brief technical cookie for security (__cf_bm and similar) — it expires quickly and contains nothing about you personally. There is no consent banner because there is nothing to consent to.

How long we keep things

• Newsletter rows. Until you unsubscribe. After that we keep only the address, marked unsubscribed, until you ask us to delete it. Unconfirmed sign-ups are deleted within three days.
• Request submissions. While the case file is in the archive. If the case is closed we keep the request linked to it for continuity (we may need to write back), but the request can be deleted on demand.
• IP hashes (request spam protection). Kept indefinitely because they are one-way hashes and contain no original IP. They cannot be reversed back to you.
• Searches that found nothing. The words searched, counted by day. Deleted after 180 days.
• Email threads with companies. Kept indefinitely — these are the receipts, and the receipts are the point of the archive. Personal names in company replies are redacted on public pages by default.

Your rights under UK GDPR

You have the following rights with respect to any personal data we hold about you:

• Access. Ask what we hold and we will send you a copy.
• Rectification. Ask us to correct something that is wrong.
• Erasure. Ask us to delete what we hold. We will, unless we are legally required to keep it (we are usually not).
• Restriction. Ask us to keep but stop processing something while a question is resolved.
• Portability. Ask for an export of your data in a machine-readable format. For an email subscriber this is one CSV row; for a request submitter it is the same.
• Objection. Object to a particular use. If we cannot continue without your consent, we will stop.
• Withdraw consent. Where we rely on your consent (newsletter), you can withdraw it at any time by unsubscribing or writing to us.

Write to [email protected] and we will respond within one calendar month. We do not charge for any of these requests.

If you are not happy with how we handled a request, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. We would always prefer the chance to put it right ourselves first, but the route is there.

Lawful basis

For the curious: we rely on these lawful bases under UK GDPR Article 6.

• Consent for the newsletter (you confirm a double-opt-in before we send anything).
• Legitimate interest for the request form (we need your email to write back about the case you filed).
• Legitimate interest for the IP-hash spam protection on requests (we keep the archive working without processing identifying data).
• Legitimate interest for visit counts (knowing which pages are read, in totals, without cookies and without identifying anyone).

If this changes

We will update the "last updated" date at the top of this page and link to the previous version. If a change is material — new category of data, new processor — we will say so in the next newsletter issue.