How Directory handles data

Who we are

Directory is part of the Alpha Capture product and is operated by Harkster Limited. Harkster Limited is a company registered in England and Wales under company number 14661786. Its registered office is 5 Providence Court, Pynes Hill, Exeter, Devon, England, EX2 5JL.

Privacy enquiries and rights requests can be sent to hello@harkster.com.

Browser storage and cookies

Directory uses browser storage for:

• the Source identifiers in My Stack;
• a shared-stack management token, saved in local storage or, as a fallback, session storage.

This information remains on your device unless you use an explicit sharing action. You can remove it through Directory where controls are available or by clearing the site’s storage in your browser. Clearing it can remove saved Sources and the ability to revoke a shared stack from that browser.

Public forms use a strictly necessary antiforgery cookie. An encrypted, short-lived cookie may carry a confirmation reference across a successful form redirect. Administrator sign-in uses authentication and identity-provider cookies. Directory does not currently use analytics, advertising or other non-essential tracking technologies.

The current storage is used only to provide requested functionality, remember an expressed choice or secure a form or administrator session. The applicable PECR exemptions should be confirmed as part of the final pre-launch legal review.

Server-shared stacks

A shared stack is created only when you use the explicit Share Stack action. The server stores its name, optional expiry, ordered Source references and versioned Source-card snapshots so the shared list can retain context if a Source is later removed. Do not place personal or confidential information in a stack name.

Public and management tokens are generated separately. Only SHA-256 token hashes are stored in the database; the raw tokens are returned to the browser once. The management token is then retained in that browser where storage is available. Anyone with the public link can read the shared stack until it expires, is revoked or is deleted. A stack created without an expiry can remain available until it is revoked or deleted.

Submissions and corrections

A Source submission records the proposed Source name, website and publisher; selected Topic, Geography, pricing and access information; your rationale and relationship disclosure; and your confirmation that the information is accurate. The current public submission form does not ask for your name or email address.

A correction records the Source, correction details and any evidence URL you supply. Contact email is optional. When supplied, it receives a 12-month retention expiry and can be anonymised independently of the editorial correction record. Avoid including unnecessary personal, confidential or special-category information in free-text fields.

Technical and administrator data

Public POST requests are rate-limited using the requesting IP address as an in-memory key for a 15-minute window. The application does not write that rate-limit key to its Directory database, but production web-hosting and security logs may record IP address, browser or device details, requested pages, timestamps and errors.

Authorised administrators sign in through the configured Microsoft identity service. Directory uses their account identifier and administrator role for access control and records an administrator identifier against editorial and workflow actions where auditability is required.

Purposes and lawful bases

Harkster Limited uses the information described above to:

• provide My Stack, sharing and editorial-review features requested by users;
• review, verify and improve Directory listings;
• respond to correction enquiries;
• secure, administer and troubleshoot Directory; and
• maintain appropriate editorial and security audit records.

The intended lawful bases are Harkster Limited’s legitimate interests in operating, securing and improving Directory and responding to editorial input. A legal obligation may apply where records must be retained or disclosed by law. Harkster Limited must document the legitimate-interests assessments before production launch.

Directory does not use the described data for solely automated decisions that produce legal or similarly significant effects. Providing information is optional, but the relevant submission or sharing feature cannot work without its required fields.

Recipients, processors and international transfers

Information is available to authorised Harkster Limited personnel who need it to operate, secure or review Directory. Relevant service providers may process information on Harkster Limited’s behalf, including website and database hosting, email or workflow delivery, security and administrator identity providers. Harkster Limited does not sell personal data or share it with third parties for their own marketing.

The production providers, processing locations, contractual safeguards and any UK international data-transfer mechanism are to be confirmed before launch. This notice must be updated with those facts before production processing begins.

Retention and security

• Browser-local information remains until it is removed by the feature, overwritten or cleared in the browser.
• The in-memory public rate-limit window is 15 minutes; production server-log retention is to be confirmed with the host.
• Optional correction contact email receives a 12-month retention expiry.
• Expired correction emails are eligible for anonymisation through administrative actions; expiry does not itself prove that anonymisation has run.
• Editorial submission and correction content can remain as an editorial record until it is no longer needed or is deleted by an administrator.
• Shared stacks remain until their selected expiry and later purge, or until revocation or administrative deletion. Stacks without an expiry have no automatic expiry.

Harkster Limited uses access controls, hashed sharing tokens, rate limiting, antiforgery protection and form honeypots as safeguards. No online service can guarantee absolute security.

Your rights and complaints

Depending on the circumstances and lawful basis, you may have rights to:

• access your personal data and receive a copy;
• correct inaccurate or incomplete data;
• request erasure or restriction of processing;
• object to processing based on legitimate interests; and
• receive data in a portable format where that right applies.

Send a rights request to hello@harkster.com. Harkster Limited may need to verify your identity before acting on it.

We would welcome the opportunity to address a concern directly. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

Children, changes and contact

Directory is intended for economists, investment professionals, researchers and policy teams; it is not directed at children. Harkster Limited does not knowingly seek personal data from children.

This notice will be updated when Directory’s processing or production providers change. The review date at the top will identify the current version. Questions can be sent to hello@harkster.com or by post to the registered office above.