Privacy notice
Dated 2026-11-02. The data controller is Netadot Ltd, England and Wales, company number 12658462, trading as Sminto. Contact: hello@sminto.com.
What is collected and why
The site collects little, and the check itself collects nothing about you. The table lists every item, where it lives, why it is collected, the lawful basis under the UK GDPR (and the EU GDPR for visitors in the EU), and how long it is kept.
| Data | Where | Why | Basis | Kept |
|---|---|---|---|---|
| Lookup counts: the brand, the statuses of the result, whether a reference or a photo was given, the day | Our database, in a counts table | To know whether the check is used, and how the honest "not derivable" answer is received | Legitimate interest. No serial, no identifier, no IP address is stored with a lookup | Kept, as counts only |
| A key derived from your IP address | Our database, in the rate-limit table | To stop abuse of the check and the forms | Legitimate interest | Hours |
| Your email address and the sign-in tokens | Our database (the sign-in system) | The record's sign-in; there is no password | Contract: the service you asked for | Until you delete the account |
| For each watch you record: brand, serial (as a keyed hash and an encrypted copy), reference, the result on the day, the date | Our database | The record and its one-page summary | Contract | Until you delete the watch or the account |
| One photo per recorded watch, with camera metadata removed on upload | Our file storage | The record and its summary | Contract | With the watch |
| Error reports from your browser: the message, the page, the build | Our database, in an error log | Fixing faults | Legitimate interest | Pruned daily |
| Page views and referrers | Cloudflare Web Analytics | Knowing how many people visit and from where | Legitimate interest. No cookie, no identifier, no fingerprint | Cloudflare's own |
| What you write in the contact form, with your name and email | Sent to us by email | Answering you | Legitimate interest | As long as the correspondence is open |
A serial number stored beside your email is personal data, and we treat it as such: it is stored as a hash under a secret key for matching and as an encrypted copy for showing it back to you, and it is never shown on any public page or in any API answer. A lookup is never linked to an account.
Who processes it
- Cloudflare (hosting, the database, the file storage, Web Analytics): a US company, under its data processing agreement with the EU standard contractual clauses and the UK addendum. Cloudflare's EU localisation does not cover the database, so we do not claim EU residency for it.
- Resend (the sign-in and contact emails), under its data processing agreement.
No other processor is involved. If a registry ever answers a check through an agreement, or a photo-reading feature is added, this notice changes before any data is sent.
Analytics without a banner
Cloudflare Web Analytics counts page views. It sets no cookie, stores nothing in your browser and builds no fingerprint, which is why the site shows no consent banner. No user id is ever sent to it. If you would rather not be counted, a content blocker that blocks static.cloudflareinsights.com stops the script, and the site works the same without it; you can also write to us and object.
Your rights
You can see and export what the record holds about you from the record page and its one-page summary; correct a watch by editing it; and delete a watch, or the whole account with everything in it, including the photos, from the same page. For anything else, including access to data that is not in the record, write to hello@sminto.com. You have the right to complain to the Information Commissioner's Office, ico.org.uk, which is the supervisory authority for Netadot Ltd.
Changes
If this notice changes, the new version is published here with its date.