Last updated: 7 October 2026
This policy explains what personal information LLYN.LIVE collects, why, who it is shared with, how long it is kept and what your rights are. We have tried to write it in plain English. If anything is unclear, email us and we will explain.
Who we are
LLYN.LIVE (llyn.live) is run by Stuart Gradwell, trading as Anything Digital. For the purposes of UK data protection law, we are the controller of the personal information described in this policy, except where we say we act on behalf of a holiday-let host (see “Guest lists” below).
Contact for anything to do with your data: llynlive53@gmail.com.
The short version
- We collect as little as we can. Guests using a QR Welcome page are never asked for their name.
- We do not sell your data, and we do not use advertising trackers.
- Payments are handled by Stripe. We never see or store your card details.
- Email marketing only happens if you tick a box asking for it, and every email has an unsubscribe link.
- You can ask to see, correct or delete your data at any time.
Information we collect and why
If you browse the site
Like any website, our hosting server receives your IP address, browser type and the page you asked for, and keeps short-term server logs for security and to keep the site running. Our security plugin records the IP address of failed login attempts to block attacks. Lawful basis: legitimate interests (keeping the site secure and working).
We do not currently run Google Analytics or any other analytics or advertising tracking on the public site. If that changes, we will ask for your consent first and update this policy.
Business listings in the directory
The LLYN.LIVE directory lists local businesses. Some basic listing details (business name, address, category, opening hours, food hygiene rating, map location) come from public sources such as the Food Standards Agency and OpenStreetMap. Where a business is run by a sole trader, those details may count as personal information. Lawful basis: legitimate interests (helping residents and visitors find local businesses). Business owners can claim, correct or ask us to remove a listing at any time.
If you claim or add a listing, or become a member, we collect your name, email address, phone number and the business details you choose to publish. Lawful basis: contract (providing the listing or membership you asked for). If you choose to show a WhatsApp button, we count how many times it is tapped so we can show you the results; we do not see who tapped it.
Holiday-let owners using QR Welcome
If you sign up for QR Welcome we collect your name, email address, your property’s name, address and map location, and the information you choose to put on your guest pages (for example WiFi details, house notes and recommendations). To keep levy and occupancy records we store booking dates and the number of adults and children per stay, taken from the calendar links you give us or entered by you. We never store guest names in the booking ledger. We also store the safety renewal dates and declaration you enter. Lawful basis: contract; for levy records, also legal obligation (Wales Visitor Levy record-keeping, where the levy applies).
We use your property’s postcode to place it on the map, using the free postcodes.io and OpenStreetMap Nominatim services.
Guests using a QR Welcome page
A QR Welcome page is the digital guide a host gives their guests. Using it does not require an account or your name. Depending on which features the host has switched on, the following may be collected:
| What | When | What we store | Lawful basis |
|---|---|---|---|
| Party size | You tap “Confirm your party” | Number of adults and children, linked to that stay. No names. | Legitimate interests (the host’s levy and occupancy records) |
| Private feedback | You send a star rating or comment | The rating, your comment and the date. Emailed to the host only. | Legitimate interests (helping the host improve). You choose whether to send it. |
| Check-out | You tap “We’ve left” | The date and time. Emailed to the host. | Legitimate interests (changeovers) |
| Page visits | You open the page | A count of visits per property. Your IP address is used in a scrambled (hashed) form for 6 hours only, to avoid counting the same visit twice, then discarded. | Legitimate interests (showing hosts the page is used) |
| Guest list sign-up | You enter your email and tick a box | Your email, which box(es) you ticked, the exact wording you agreed to and when. | Consent |
Guest lists and the LLYN.LIVE newsletter
On some QR Welcome pages you can give your email address to hear about offers and availability from that holiday let. There are two separate boxes, and neither is ticked for you:
- “Email me offers and availability from [property]”: your email goes on that host’s guest list. The host is the controller of their list and decides how to use it; LLYN.LIVE stores it on their behalf, as a processor, and only gives it to that host. Hosts must only use it to send you the kind of emails you agreed to and must honour unsubscribe requests.
- “Also send me the LLYN.LIVE what’s-on email”: your email goes on our own list, and we are the controller.
Every email address on either list gets its own one-click unsubscribe link. If you unsubscribe, we keep a note of your email marked as unsubscribed so that you are not added back by mistake. You can also ask us to delete it completely.
Buying from us
If you pay for a membership, QR Welcome, a QR sign or an ebook, payment is taken by Stripe. We receive your name, email address, what you bought, the amount and Stripe’s customer and subscription references, but never your card details. Ebook orders are recorded by our store software so you can download your purchase again. Lawful basis: contract, and legal obligation for keeping financial records.
Contact forms and emails
If you use a form on the site or email us, we keep your message and contact details so we can reply. Lawful basis: legitimate interests (responding to you). Emails from the site, such as confirmations, reminders and host notifications, are sent through our email provider.
Schools and community projects
Our schools oral-history project is run with participating schools, which collect any permissions needed before learners take part. Information about that project is handled under arrangements agreed with each school.
Who we share information with
We only share what is needed, with these service providers:
| Provider | What for | Where |
|---|---|---|
| Namecheap (hosting) | Runs the website and stores its data | Servers may be outside the UK |
| Stripe | Taking payments | UK, EU and USA |
| Our email provider (via the GoSMTP plugin) | Sending site emails | May be outside the UK |
| Open-Meteo | Weather, sea and tide information. Your browser fetches this directly, so Open-Meteo sees your IP address. | EU |
| OpenStreetMap | Map images. Your browser fetches these directly, so the OpenStreetMap Foundation sees your IP address. | UK and EU |
| YouTube (privacy-enhanced mode) | Video tours. Videos load from youtube-nocookie.com and YouTube does not set tracking cookies until you play one. | USA |
| Google Translate (via GTranslate) | Only if you choose a language from the translation menu | USA |
Holiday-let hosts receive the guest information described above for their own property. Some pages link to other sites (for example Google Maps, booking platforms, our merchandise store, social media and affiliate partners such as Starlink). Those sites have their own privacy policies, and we may receive a referral fee if you sign up through an affiliate link.
Where data goes outside the UK, we rely on the UK’s adequacy regulations or the provider’s standard data-transfer safeguards. We will never sell your personal information.
Cookies
We keep cookies to a minimum:
| Cookie | Purpose | Type |
|---|---|---|
| WordPress login cookies (wordpress_*, wordpress_logged_in_*) | Keep owners and members logged in | Strictly necessary; only set when you log in |
| Store cookies (edd_*) | Remember your basket when buying an ebook | Strictly necessary; only set when you shop |
| googtrans | Remembers the language you picked | Functional; only set if you use the translation menu |
We do not use advertising or analytics cookies. Strictly necessary cookies do not need consent; if we ever add optional cookies, we will ask first.
How long we keep information
| Information | How long |
|---|---|
| Booking ledger (dates and guest numbers) | 6 years, in line with levy record-keeping rules |
| Owner and member accounts | While your account is active, then deleted within 12 months, except financial records |
| Payment and invoice records | 6 years (HMRC requirement) |
| Private guest feedback | The most recent 50 per property; hosts can delete any of it at any time |
| Check-out log | The most recent 30 per property |
| Guest list and newsletter emails | Until you unsubscribe or the host removes you; after unsubscribing, kept only as an “unsubscribed” marker unless you ask for full deletion |
| Page-visit check (hashed IP) | 6 hours |
| Contact form messages | Up to 2 years |
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct anything that is wrong;
- ask us to delete your information;
- object to, or ask us to restrict, how we use it;
- ask for your information in a portable format;
- withdraw consent at any time, for example by unsubscribing. This does not affect anything we did before.
Email llynlive53@gmail.com and we will respond within one month. If your request is about a host’s guest list, we will pass it to the host and help them deal with it.
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Children
LLYN.LIVE is a general-audience site and is not aimed at children. We do not knowingly collect personal information from children under 13 except through school projects run with the school’s involvement.
Security
The site uses HTTPS throughout, login protection against repeated attempts, and access controls so that owners can only see their own properties’ information. Guest pages are protected by a private key in the link, and guest actions are rate-limited to prevent misuse.
Changes to this policy
We will update this page when our services change and show the date at the top. Significant changes will be highlighted on the site.