Privacy policy

Who we are

Promote Your Business is a free UK business directory operated by InstaWebsite (Codemind Ltd, UK). Our domain is promoteyourbusiness.co.uk. For any privacy questions, contact [email protected].

What we collect

When you submit a business listing via our form, we collect:

Email address (required)
Business name, contact name, mobile number (optional)
Business category, city / region, description (optional)
Whether you have a website and the URL if you provide it (optional)
Your IP address and browser user-agent at submission, for spam-prevention purposes only

When you visit the public site, we record page views and click events on outbound listing links. These store a one-way hash of your IP (salted daily, never stored as plain text) and the page that referred you, so we can show listing owners how many people found their entry and how many clicked through to them.

We also record which kind of source brought you to the site — for example "a search engine", "an AI assistant", "Facebook", or the name of the website that linked to us. Only that short label is stored, never the full address of the page you came from. Your browser keeps the label for the length of your visit and forgets it when you close the tab.

Our website statistics run on Umami, which we host ourselves on our own servers. It sets no cookies and stores nothing on your device, it does not follow you to other websites, and it never builds a profile of you. (The account activity described below is separate, and only exists for business owners who have signed in.) If your browser sends a "Do Not Track" signal, we don't count your visit at all. We do not use advertising trackers, and we do not send your data to any analytics company.

Why we collect it

To publish your listing in the directory once approved
To email you when your listing goes live, or to let you know if we couldn't publish it
To detect and reject spam submissions (rate limiting + Cloudflare Turnstile)
To give listing owners traffic stats on their listing page

If you submit a listing, we may add your contact details to our internal CRM (operated by InstaWebsite) so we can follow up about your business's online presence. You can ask us to remove you from this CRM at any time.

Your account, and the emails we send you

When you submit or claim a listing we create an account for your email address so you can sign in and manage it. You sign in with a code we email you (or a password, if you choose to set one). For signed-in owners we keep a record of account activity: when you sign in, open your dashboard, edit your listing, start or complete a payment, and which links you click in our marketing emails. We use it to run your account, to keep it secure, and to decide which of our emails are relevant to you — for example, only telling you about featured listings when your listing is already getting views. Our lawful basis is performance of our contract with you (your account) and legitimate interests (understanding how owners use the service and keeping our emails relevant).

We send three kinds of email. Service emails — sign-in codes, receipts, messages from customers — always arrive. Listing updates— a monthly summary of your listing's views and a reminder before a featured period ends. Tips and offers— at most one every two weeks and no more than three in total, and never after six months without you using your account. We send updates and offers under the "soft opt-in": you were offered the chance to refuse when you gave us your address, and every one of these emails has a one-click unsubscribe. You can switch either off on your account page at any time; you have an absolute right to object to direct marketing.

We do not use tracking pixels and do not record whether you open our emails. Links in our marketing emails pass through our own site so we can count the click, then take you straight to the page.

Listings we research ourselves

Some listings are added by our own research process (assisted by automated tools) rather than submitted by the business. For these we collect only information that is already publicly available: the business name, category, city, whether it has a website, its website address, and — where the business publishes one on its own website — a phone number and business contact email address. We write our own short description of the business; we do not copy text from its website.

Our lawful basis for this processing is legitimate interests (UK GDPR Article 6(1)(f)): operating a public directory of trading businesses using information those businesses have chosen to publish.

If we list your business this way and a contact email is published on your own website's domain, we may send you a single notification email telling you about the listing, with one-click options to claim it, correct it, have it removed, or opt out of any further email. We only email addresses at the business's own domain (never personal or generic mailbox providers), we honour opt-outs permanently via a suppression list, and we cap the number of such emails we send per day. To have a listing removed at any time, use the removal link in the email or contact [email protected].

Who we share with

We share your data with:

Cloudflare — runs Turnstile (the "I'm not a robot" check on the submit form)
The mail server hosting our domain — used to send your confirmation and approval emails
Hetzner Cloud (EU) — hosts our servers
Have I Been Pwned— if you set a password, we check it hasn't appeared in a known data breach. Only the first five characters of a one-way hash of it are sent; never the password.
Stripe — processes card payments for featured listings and adverts

We do not sell or rent your data. We do not pass it to advertisers.

How long we keep it

Approved listings: published indefinitely until you ask us to remove them
Rejected submissions: kept for 6 months for spam-pattern analysis, then deleted
Click-tracking events: 12 months, then aggregated anonymously
Your account and its activity record: for as long as you have a listing with us; email us to delete it
A record of each email we sent you: 24 months

Your rights (UK GDPR)

You have the right to:

See what data we hold about you
Correct anything that's wrong
Have us delete your data ("right to be forgotten")
Withdraw consent and have your listing removed

Email [email protected]with your request and we'll act on it within 30 days. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

We don't set tracking cookies. The only cookies on this site are essential ones that keep you signed in when you manage a listing (or to the admin area), and third-party cookies set by Cloudflare Turnstile during the security check on our forms. Our website statistics are cookieless. The one thing we do keep in your browser is the short "where you came from" label described above, held in session storage for the length of your visit only.

Changes to this policy

If we make material changes we'll update the "last updated" date at the top and, where appropriate, email submitters of active listings.