Legal

Privacy policy Draft

This is a draft for review, not legal advice. It should be checked against ICO guidance (and, if needed, a UK solicitor) before the official site goes live and before any accounts are created. Last updated: 13 November 2026.

Who we are

The controller is Ayub Azizi, trading as Happy Toons Studio, United Kingdom. Happy Toons Studio is a brand name and studio trading name, not a registered company. Tube Roadmap is a service of Happy Toons Studio. Contact: nazhadibrahem1998-dafpst@mail.grokbot.com. We do not publish a home address or telephone number.

What we collect

  • Account email and display name, and an 18-or-over confirmation
  • Order details and a verification flag after a completed paid order
  • Review text, and an optional review photo if you choose to upload one
  • Technical logs needed to run the site securely (for example an IP address in authentication logs, for a short period)
  • Newsletter signup email and the marketing consent you ticked, plus a record of the confirmation link (double opt-in) once that is live
  • Prize-promotion entries: the email you enter, your 18-or-over consent, the month of the entry, and the prize drawn (including a “no prize this time” outcome)

We do not collect your date of birth, home address, or phone number, and we ask you not to send them. Card payments are processed by SumUp. The checkout page shows the merchant name AVE MARKET LTD, the business behind Tube Roadmap. You enter card details on SumUp’s payment page, not on this site. We do not store payment card numbers.

Why we collect it, and the lawful bases

  • Contract: to create your account, take and deliver an order, and contact you about that work.
  • Legitimate interests: to keep the site secure, prevent fraud, and display genuine reviews from verified buyers.
  • Consent: to publish an optional review photo; for a prize-promotion entry and the email that confirms it; and for optional marketing email. Marketing email is off by default. Under UK PECR we only send marketing email if you have ticked an unticked consent box and, once signup is live, confirmed a follow-up email (double opt-in). A prize-promotion entry is not, by itself, consent for marketing.

Who we share data with

We do not sell your data. When accounts go live we expect to use a hosting and authentication processor — planned: Supabase, project region West Europe (London), eu-west-2 — and will name the processor in this policy once chosen. Static files may be served by Cloudflare Pages or GitHub Pages. Card payments are processed by SumUp; the merchant name shown at checkout is AVE MARKET LTD. Other processors (for example email delivery) will be listed here before they are used. We will sign a data processing agreement where required.

How long we keep it

Accounts are kept while they stay open. Reviews stay while they remain published, or until you ask us to remove them, unless we must keep a copy to handle a dispute. Security logs are kept for a short, stated period (we expect around 30 days unless we need longer to investigate abuse). Newsletter records are kept until you unsubscribe or withdraw consent, and then for a short period (we expect up to 24 months) so we can show that we respected that request. Prize-promotion entries are kept for 12 months after the prize expires (or after the draw, if there was no prize), unless we need them longer for a dispute. You can ask us to delete a photo or close an account by email.

Review photos

A published photo is personal data and is public. We only publish it if you tick the consent box. You can withdraw consent; the photo is then taken down. The text of your review can stay unless you also ask us to remove it.

Unsubscribing and withdrawing consent

You can unsubscribe from marketing email at any time by using the link in those emails (once they are being sent) or by emailing us at the address above. You can also withdraw consent for a prize-promotion entry, or for a review photo, by emailing us. Withdrawal does not affect a prize we have already confirmed, except that we may still need a contact address if you want us to deliver it. We will not send marketing email after you unsubscribe.

Your rights

Under UK GDPR you can ask for access, correction, deletion, restriction, objection, and (where applicable) data portability. To use these rights, email the address above. You can also complain to the Information Commissioner’s Office at ico.org.uk.

International transfers

Putting the database in London helps, but backups, logs, email delivery, optional Google sign-in, and a content delivery network can still move data outside the UK. We will record those processors and the safeguards used (for example the UK extension to the EU-US data bridge, or standard contractual clauses) before go-live.

Cookies

This draft site does not set analytics or marketing cookies. When accounts go live we will use a strictly necessary cookie or similar storage to keep you logged in. If we later add analytics or Google sign-in, we will update this policy and, where PECR requires it, ask for consent or provide a simple free way to object. See also the cookie note on each page.

This draft site does not use analytics or marketing cookies. A strictly necessary login cookie will be used only after accounts go live. See the privacy policy.