Skip to main content
Black Stacks — home

Privacy Policy

Last updated 25 August 2026

Black Stacks helps you find and save Black-owned businesses in the UK. This policy explains what information we collect, why, and what you can do about it. We've tried to write it plainly. If anything is unclear, email us at admin@blackstacks.co.uk and we'll explain.

1. Who we are

Black Stacks Directory Ltd is the data controller for the information described here.

  1. Company number: 17404226
  2. Registered office: 42 Plomer Avenue, Hoddesdon, EN11 9FR
  3. Email address: admin@blackstacks.co.uk

2. What we collect and why

2.1. When you create an account

WhatWhyOur lawful basis
Your email addressTo sign you in and to send you sign-in codesPerformance of our contract with you
Your display name and picture, if you've set oneTo personalise the appPerformance of our contract with you
Your app appearance preference (light, dark, or system default)To remember how you like the app to lookPerformance of our contract with you
  1. You can sign in three ways: with a code sent to your email, with Google, or with Apple. If you use Google or Apple, they tell us your email address so we can create your account. If you use Sign in with Apple and choose to hide your email, Apple gives us a private relay address instead of your real one. We can email you at it, but we never see your actual address.
  2. You cannot browse the map or search without an account. You also need an account to save businesses you are interested in.

2.2. When you save a business

  1. We store which businesses you've saved and when you saved them, so we can show you your list and let you sort it.
  2. We also count how many people have saved each business, so we can show which are popular. That count is a total and it doesn't reveal who saved what. Nobody, including us, can see another person's saved list.
  3. Lawful basis: performance of our contract with you.

2.3. Your location

  1. If you allow it, we use your device's rough location to centre the map near you and to show which businesses are closest to your location.
    1. We ask when you first open the app, and again if you use a feature that needs it.
    2. You can say no, and the app still functions without access to your rough location by opening on a more zoomed out location of the whole UK. You can then pan to where you want to search.
    3. You can change your mind at any time in your device settings, under Black Stacks.
    4. We don't store your location. It's used on your device to draw the map and calculate distances, and it isn't sent to us or saved anywhere.
  2. Lawful basis: your consent, given through your device's permission prompt.

2.4. When the app crashes

  1. We use Sentry to find out when the app breaks. A crash report contains your device model, operating system version, app version, what the app was doing, and a technical stack trace. It includes a random identifier for your installation so we can tell whether one person hit the same bug ten times or ten people hit it once. It doesn't contain your email, your saved businesses, or your location.
  2. Lawful basis: our legitimate interests in keeping the app working. We've considered the impact on you and think it's minimal, as the data is short-lived, technical, and can't be used to identify you.

2.5. Maps

  1. The map is drawn using tiles from MapTiler. To send us those tiles, they receive your device's IP address and the part of the map you're looking at. We don't control what they do with that information and we refer you to their privacy policy (opens in a new tab).

2.6. If you submit a business

  1. If you fill in our business submission form, we collect your name and email address, the business details you give us, and your confirmation that the business meets our ownership criteria. We use this information to check the business exists and, if we approve it, to create a public listing.
  2. That confirmation can indirectly indicate the ethnic heritage of a business's owner. Under UK data protection law that makes it sensitive information, so we ask for your explicit permission before recording it and we use it only to decide whether a business belongs in the directory. We never publish it as a separate piece of information. You can withdraw that permission at any time by emailing us at admin@blackstacks.co.uk.
  3. Lawful bases: our legitimate interests in running an accurate directory, for reviewing and contacting you about the submission; your explicit consent under Article 9(2)(a) UK GDPR, for the ownership confirmation.
  4. If someone else submits the details of a business you own, we'll contact you before publishing anything, and we'll tell you what we hold and where we got it.

2.7. Cookies on our website

  1. Our website uses one cookie: a sign-in session cookie, set by Supabase (our database and sign-in provider), which keeps you signed in as you move between pages in your account.
  2. This cookie is strictly necessary — the website can't keep you signed in without it — so UK cookie law (PECR) doesn't require us to ask your permission before setting it. We're telling you about it here anyway, for transparency.
  3. If you go on to make a payment (for example, donating, or paying for a business listing), you'll be taken to a page hosted by Stripe, our payment provider. Stripe sets its own cookies there, under Stripe's own privacy policy (opens in a new tab), not this one.
  4. We don't use any cookies for analytics, advertising, or tracking you across other websites.
  5. Lawful basis: performance of our contract with you — the same basis as section 2.1, since this cookie exists only to keep you signed in.

2.8. Website analytics

  1. Our website uses Vercel Web Analytics to understand how many people visit and which pages they use, so we know whether the site is working and where to improve it.
  2. It records the page you visited, what referred you there, your rough location (country, region and city, worked out from your IP address — the address itself isn't stored), and your device and browser type. Nothing is tied to you individually: visitors are identified by a hash generated from the request, discarded after 24 hours. It doesn't use cookies and it doesn't track you across other websites.
  3. Lawful basis: our legitimate interests in understanding and improving the website. We've considered the impact on you and think it's minimal, since nothing is tied back to you as an individual.

3. What we don't do

  1. We don't sell your information.
  2. We don't share it for advertising, and there are no ads in the app.
  3. We don't track you across other apps or websites.
  4. We don't send marketing emails. The only emails we send are sign-in codes and messages about your account or a business submission.
  5. We don't make automated decisions about you.

4. Who we share data with

  1. We use these companies to run the service. They process information on our behalf, under contract, and can't use it for their own purposes.
WhoWhat forWhere
VercelWebsite hosting; anonymised website analyticsMay process information outside the UK
SupabaseDatabase and sign-inUnited Kingdom (London region)
SupabaseSending sign-in codesUnited Kingdom (Ireland region)
SentryCrash reportsGermany (Frankfurt region)
GoogleSign in with Google; our business submission formGoogle may process information outside the UK
AppleSign in with AppleApple may process information outside the UK
MapTilerMap imagerySwitzerland
  1. We may also share information if the law requires us to, or to protect the rights and safety of people using the app.
  2. Information stored outside the UK is protected by safeguards approved for international transfers, such as the UK International Data Transfer Addendum.

5. How long we keep it

WhatHow long
Your account and saved businessesUntil you delete your account. We then permanently delete everything within 7 days.
Your locationNot stored at all.
Crash reports90 days, then deleted automatically.
Business submissions we don't approve6 months, then deleted.
Business submissions we do approveFor as long as the listing is live, and 6 months after it's removed.
Emails you send us12 months after a matter is resolved.

6. Your rights

  1. You can ask us, at any time, to:
    1. Give you a copy of the information we hold about you.
    2. Correct anything that's wrong.
    3. Delete it. This can also be done by yourself in the app under Settings → Delete Account.
    4. Restrict or stop using your information.
    5. Send it to you or another service in a portable format.
    6. Object to us using it where we rely on legitimate interests.
  2. Where we rely on your consent (for location or for a business submission) you can withdraw it at any time. That won't affect anything we did before you withdrew it.
  3. Email admin@blackstacks.co.uk and we'll respond within one month, at no cost to yourself.

7. Deleting your account

  1. Settings → Delete account, in the app. We'll ask you to confirm, then permanently delete your account, your saved businesses and your preferences within 7 days. This can't be undone.

8. Children

  1. Black Stacks isn't intended for children under 13, and we don't knowingly collect information from them. If you believe a child has given us their information, email admin@blackstacks.co.uk and we'll delete it.

9. Keeping your information safe

  1. Information is encrypted in transit and at rest. Access to our database is restricted so that you can only read and change your own information. We don't use passwords, which removes a common source of account compromise.
  2. No system is perfectly secure. If a breach occurs that puts your rights at risk, we'll notify you and report it to the Information Commissioner's Office (ICO) within 72 hours.

10. Change to this policy

  1. If we change how we use your information we will update this page and change the date at the top. For significant changes we'll tell you in the app before they take effect.

11. Complaints

  1. If you're unhappy with how we've handled your information, please tell us first at admin@blackstacks.co.uk. We'd like the chance to put it right.
  2. You also have the right to complain to the ICO at:
    1. Online: ico.org.uk/make-a-complaint (opens in a new tab)
    2. Phone: 0303 123 1113