Privacy Policy

City Path is operated by William Breach as a sole trader (not a registered company). For the purposes of UK data protection law, that is the controller of the personal data described below. A postal address for service is available on request from wb.citypath@gmail.com.

Questions about this policy, or any request about your data, should go to wb.citypath@gmail.com.

We collect as little as the service can run on. There is no advertising network, no third-party analytics and no tracking of you across other websites.

• Account details — your email address, an encrypted form of your password, and the dates your account was created and access was granted. We never see your password in readable form. Each time you sign in, a one-time code is emailed to you; it expires after ten minutes and is not kept.
• Licence records — the amount invoiced, the date and our invoice reference. These are kept in our own business records, not on this website.
• Payment details — none. Licences are invoiced and settled by bank transfer, so City Path never receives, stores or sees card details of any kind.
• Technical records — our hosting and database providers keep standard server logs (including IP address and browser type) for security and to keep the service running.

The only cookies this site sets are the ones that keep you signed in to your account. They are strictly necessary for the service to work, are not used to profile you, and are not shared with anyone for advertising. That is why you are not asked to accept cookies on arrival — there is nothing optional to accept.

Each one is listed by name, with what it does and how long it lasts, in our cookie policy.

• To provide what you paid for — creating your account, confirming payment and opening access to the directories. Lawful basis: performance of our contract with you.
• To keep the service secure — verifying sign-ins, limiting repeated attempts, and preventing unauthorised sharing of licensed content. Lawful basis: our legitimate interests in protecting the service.
• To meet our legal duties — keeping records of sales for tax purposes. Lawful basis: compliance with a legal obligation.

We do not send marketing emails, and we do not sell, rent or trade your personal data. Emails you receive from us relate to your account: confirming your address, resetting your password, or confirming a payment.

We use a small number of established providers, each of which processes data only on our instructions:

• Supabase — provides account sign-in, the database holding your account, and the private storage the directory files sit in.
• Resend — delivers the emails we send you, including your sign-in codes. It receives your email address and the content of those emails.
• Hostinger — hosts the website itself and keeps short-lived server logs.

Some of these providers operate outside the UK. Where personal data is transferred abroad, it is done under the safeguards UK data protection law requires, such as an International Data Transfer Agreement or equivalent contractual protections.

We will also disclose data where the law requires it — for example, in response to a valid legal request.

Account details are kept for as long as your account exists. For individual access, which does not expire, that will normally be indefinite unless you ask us to close it. For an institutional licence, the account is closed when the licence ends and is not renewed.

Records of payments are kept for at least six years, which is what tax record-keeping requires. That means a purchase record may outlive a deleted account — it is retained on its own, without the rest of your account details.

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate details corrected;
• ask us to delete your data, where we are not required to keep it;
• ask us to restrict how we use it, or object to our use of it;
• receive your data in a portable format;
• withdraw consent, where we relied on consent.

To exercise any of these, email wb.citypath@gmail.com. We will respond within one month. There is no charge.

Deleting your account ends your access to the directories, and does not entitle you to a refund of what you paid.

The directories describe firms, not individuals. The details in them — company names, offices, switchboard numbers, websites and general enquiry addresses — are business contact details, gathered from the firms' own published sources and public records.

If your firm is listed and you would like it removed — or an entry identifies you personally and you want it corrected — email wb.citypath@gmail.com with the subject URGENT, naming the firm and the detail in question. We aim to remove it within 24 hours, subject to staff availability, by reissuing the affected directory.

If you think we have handled your data badly, please tell us first — most things are quickest to fix directly. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

If this policy changes, the revised version will appear on this page with a new date at the top. Where a change materially affects how we use your data, we will email account holders rather than rely on you noticing.