Privacy policy

The company that operates Greyback, identified on the legal information page, is the data controller. It decides what is collected and why.

Your data is handled under the UK General Data Protection Regulation and the Data Protection Act 2018. If you are in the European Economic Area the EU GDPR applies to you as well; if you are in California, the section on Californian rights below applies.

If you only read the site

• Your IP address, in server logs, kept for 30 days for security and abuse handling.
• An essential cookie only if you interact with something that needs one. Nothing analytical is set before you choose on the cookie bar.

If you hold an account

• Your email address and a hashed password. We never see the password itself.
• Which tier you are on, when it renews, and your history of charges.
• The photographs you upload, the descriptions you type about how a sock is washed, and the readings produced from them.
• Basic usage records — how much of your allowance has been used, and when — because without them the allowance cannot work.

We do not collect your location beyond what an IP address implies, we do not build advertising profiles, and we do not buy data about you from anyone.

No. Photographs you upload are not used to train any model, ours or anyone else’s. They are not sold, not licensed and not shared for that purpose, and there is no setting buried anywhere that opts you into it.

A photograph is sent to an image model for one narrow question — which regions of this sock have shifted, and which way the tone moved — and the provider is contractually barred from retaining it or using it to improve their own systems. The ranking that follows happens in your browser, against a table published on the front page.

What we do learn from, in aggregate, is whether the service worked: error rates, how long readings take, how often a photograph could not be read at all. Those are counts, not content.

Performance of a contract

Your account, your subscription, your photographs and the readings made from them. We cannot provide the service without these.

Legitimate interests

Security logs, abuse prevention and aggregate quality measurement. We have balanced these against your interests and kept them to the minimum that works.

Consent

Analytics cookies, and any optional email that is not about your account. You can withdraw consent at any time and it is as easy to withdraw as it was to give.

Legal obligation

Records of charges, which tax law requires us to keep.

• Photographs and readings — 30 days, then deleted automatically. You can delete either sooner from the reading itself, and deletion is immediate rather than queued.
• Account details — until you close the account, then removed within 30 days.
• Records of charges — six years after the end of the relevant financial year, because tax law requires it. These contain an amount and a date, not a photograph.
• Server logs — 30 days.

Closing your account deletes every photograph you have uploaded, whether or not the 30 days has run.

Four kinds of supplier, each doing one job:

• The hosting provider that runs the site and stores the files.
• The image model provider that answers the single narrow question described above, under terms that bar retention and training.
• The payment processor configured for this deployment, which handles card details. We never see or store a full card number.
• The provider that sends account emails, such as receipts and renewal reminders.

None of them may use your data for their own purposes. We do not sell personal data and we do not share it for cross-context behavioural advertising, in any jurisdiction.

Some of it does, because some of those suppliers operate outside the UK. Where that happens we rely either on the UK government’s finding that the destination country offers adequate protection, or on the International Data Transfer Agreement, or on the UK Addendum to the European Commission’s Standard Contractual Clauses, together with an assessment of the destination.

You can ask us which mechanism applies to a particular supplier and we will tell you.

Under UK data protection law you can require us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete what we hold, subject only to records the law requires us to keep;
• stop or restrict a particular use;
• hand your data over in a portable form, to you or to someone else;
• stop relying on legitimate interests, where you object and we cannot show otherwise.

Write to support@simplyhosieryonline.shop. We answer within one month and there is no charge. We will not ask you why.

Complaining to the regulator

If you are not satisfied with how we have handled your data, you have the right to complain to the Information Commissioner’s Office, the United Kingdom’s supervisory authority. The ICO can be reached at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first, although we would rather you did.

You have the right to know what is collected and why, to a copy, to deletion, to correction, and to opt out of sale or sharing. There is nothing to opt out of here: we do not sell personal information and we do not share it for cross-context behavioural advertising. We will not discriminate against you for exercising any of these rights.

We honour the Global Privacy Control signal where a browser sends one. Requests go to the same address as everything else.

The service is for people aged 16 and over and is not designed for children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to support@simplyhosieryonline.shop and we will delete it.

The date at the top changes, and for anything material we email registered users at least 30 days before it takes effect. A change that would allow your photographs to be used for training would be material, and we would ask rather than tell.