Waiting list privacy notice
This notice covers the waiting list on this website. The app’s own privacy policy is separate (/privacy).
Who we are
Run the Deck is run by Lorenzo Fuller, trading as 628 Studios, 42a Broadway, London W13 0SU, United Kingdom (“we”). We are the controller for the waiting list. Questions or requests: renzoskitchen@gmail.com.
What we collect, and why
| What | Why | Lawful basis |
|---|---|---|
| First name, email address | To confirm your sign-up, tell you your place in the queue and email you when Run the Deck launches at your uni | Taking steps at your request (you asked to join the list) |
| Your uni or college | Unis unlock in order of demand; it shows your uni’s progress (“Bath: 42/100”) | As above |
| Age group (16–17 or 18+) | Run the Deck is for 16s and over. We never ask for your birthday. If you’re under 16 we store nothing at all | Legal obligation / legitimate interests (keeping under-16s out) |
| Whether you ticked “news and reminders” | Only then do we send anything beyond your spot and your uni’s launch | Consent (untick any time) |
| Who invited you: a mate’s link code or an ambassador code + where it was (“poster”, “story”) | Moving your mate up the queue; paying ambassadors per verified sign-up. Recorded once, from the link you used | Legitimate interests (running a fair referral scheme) |
| A scrambled (hashed) version of your network address | Stopping spam and fake sign-ups. We never store the address itself, and we wipe the hash after 30 days | Legitimate interests (security, fraud prevention) |
What we don’t do: no cookies, no tracking pixels, no advertising networks, no device fingerprinting, no selling or sharing your details. Ambassadors only ever see counts (“12 verified sign-ups”), never who you are.
How long we keep it
- Not confirmed within 7 days of us sending your confirmation email: deleted automatically. If we haven’t been able to send that email yet, we keep your sign-up until we can, and for no more than 90 days.
- Hashed network address: wiped after 30 days.
- Everyone else: until 12 months after Run the Deck launches. If you never start playing by then, your details are deleted. If you do sign up to the app with the same email, the app’s privacy policy takes over.
- Leave any time with the link in your email (delete page): your details go straight away.
Who processes it for us
- Supabase (database, London region) stores the list.
- Resend sends the emails.
- Cloudflare hosts this site. If we switch on Turnstile (Cloudflare’s robot check), it processes your network address and browser signals to tell people from bots. See Cloudflare’s Turnstile privacy addendum.
Some of these providers may process data outside the UK under the UK’s data transfer safeguards (adequacy regulations or the International Data Transfer Addendum).
Your rights
You can ask for a copy of your details, ask us to correct or delete them, object to how we use them, or withdraw consent for news emails at any time. Email renzoskitchen@gmail.com, or use the complaints form; we acknowledge complaints within 30 days. If you’re unhappy with our answer you can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
Version waitlist-2026-10. ICO registration number: {{ICO_NUMBER}}.