Find someone’s pageType a name or an @handle — a business, a club, a friend.
Last updated: 2 November 2026
We keep things simple. This policy explains what data we collect, why we collect it, and what we do with it. No surprises, no hidden agendas.
exclusively.me is operated by Exclusively Me Ltd, a company registered in England and Wales (company number 17458606), registered office 167-169 Great Portland Street, London, England, W1W 5PF. We are the data controller for the personal data described in this policy. Full company details are also on our Contact page.
If you have questions about your data, contact us at [email protected].
We only collect what we need to run the service and make it better. Here's the full picture:
| Data | Why | Lawful basis |
|---|---|---|
| Username | Your unique URL and identity on the platform | Contract |
| Email address | Account access, notifications, service updates | Contract |
| Password (hashed) | Securing your account — we never store your actual password | Contract |
| Avatar image | Displayed on your page | Contract |
| Timezone | Scheduled content timing | Contract |
| Date of birth | Asked for when you sign up. We use it to check you’re 13 or over, to apply our protections for under-18s, and, if you join a team, to work out your age group. It’s never shown on your page, and a team sees only your age group, never the date | Contract; legitimate interest for team age groups |
| Data | Why | Lawful basis |
|---|---|---|
| Display name, bio | Shown on your public page | Contract |
| Links (titles, URLs, icons) | The content you choose to share | Contract |
| Theme preferences, custom CSS | Personalising your page's look | Contract |
| Scheduled content | Timed updates to your page (Pro) | Contract |
| Who can find each page (Everywhere, Connections only, or Only people with the link) | Deciding whether a page appears in our own Find a page search, in search engines and to your connections | Contract |
Find a page. A page set to Everywhere can appear in our own search at exclusively.me/find, as well as in search engines and to your connections. A search result shows your avatar, display name and username. — and, on Pro, your welcome message. Never your email address or your links. To keep a page out of search, choose Connections only or Only people with the link on the page’s Security tab.
We don’t keep a record of what anyone searches for — not in our database, not in our web server’s logs, and not in Google Analytics, which isn’t used on the search page. To stop the search being used to list everyone, we count each visitor’s searches for up to a day, against a scrambled form of their IP address held in memory only.
Only if you start a team, or join one.
| Data | Why | Lawful basis |
|---|---|---|
| Team name, address and picture | Shown to the team’s members and on the team’s page | Contract |
| Your membership: role, groups, when you joined and left | Running the team. Its admins can see it | Contract |
| The email address on your account | The team’s owner and admins can see it while you’re a member, to contact you about the team. It’s ticked by default for adults and you can switch it off; if you’re under 18, only if your parent or guardian agreed | Consent |
| Your age group (for now, only “Under 18”) | Applying our under-18 protections, and showing the team which members they cover | Legitimate interest |
| What you let the team see or do (your statistics, managing your pages, your email address) | Only what you agreed to when you joined, or, if you’re under 18, what your parent or guardian agreed to | Consent |
| A record of each time a team looks at your data | So there’s always an answer to “who looked at my figures, and when” | Legitimate interest |
| A parent or guardian’s email address (members aged 13 to 17) | Given to us by the team, never by the member, to ask for their agreement. If they also agree to hear from the team, we keep it while the member is in the team so the team’s admins can email them about the team | Legitimate interest; consent for the team’s emails |
Joining a team. A team sees that you’re a member, which of its groups you’re in, and, if you’re under 18, your age group. It sees your statistics or your email address, or manages your pages, only if you agreed to that when you joined. Your account and pages stay yours, and you can leave at any time. When you leave, the team keeps your figures for the time you were a member, so its reports stay accurate. It sees nothing from after you left.
When a team invites you, we email you to say so. If you’re 13 to 17, we also email the parent or guardian the team names, and use their address to send that email. That email also asks them, separately, whether the team’s admins may see your email address and whether they may email the parent or guardian about the team. Both are off unless they agree, and you can join if they say no.
| Data | Why | Lawful basis |
|---|---|---|
| Page views (timestamp, page visited) | Analytics for you and service improvement | Legitimate interest |
| Link clicks (which links, when) | Analytics for you and service improvement | Legitimate interest |
| Referrer URLs | Understanding how visitors find your page | Legitimate interest |
| Country (derived from IP) | Geographic analytics, localised pricing | Legitimate interest |
| The landing page and campaign tag you signed up through, if any | Understanding which of our promotions work | Legitimate interest |
| User agent string | Device and browser analytics | Legitimate interest |
| IP address | Security, rate limiting, geographic lookup — never stored with analytics | Legitimate interest |
| IP address and browser when you sign in | Protecting your account, and preventing fraud and abuse | Legitimate interest |
We derive country from your IP address for geographic analytics, then discard the raw IP. We do not build individual profiles from analytics data. The one exception is our guides, and only if you’re signed in and have accepted analytics cookies (below).
The one place we keep an IP address is your sign-in record: when you sign in, we note the IP address and browser so we can spot a sign-in that wasn't you and stop fraud and abuse. It's used for nothing else.
Our guides at exclusively.me/guides count how often each one is read. For each read we note the date, your country (from your IP address, which we then discard), the name of the website you came from (never its full address) and whether you opened the guide from your dashboard. No cookie is set to do this.
We use your data for these purposes:
Our free tier is genuinely free — you're not the product. However, we do use aggregated, anonymised platform data (trends, statistics, usage patterns) to improve the service and to share insights with partners. This data is stripped of anything that could identify you personally.
We will never sell your personal data. Full stop. What we may do is share anonymised, aggregated statistics — things like "40% of pages include an Instagram link" or "UK-based pages average 12 links." This helps us grow the platform and keep the free tier free.
Under UK GDPR (including amendments from the Data Use and Access Act 2025), we rely on these lawful bases:
We keep your data close. Here's who might see it:
We do not sell personal data to anyone. We do not provide your email to advertisers. We do not let third parties track you on our platform.
We primarily process data within the UK. Where we use service providers based outside the UK, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements or adequacy decisions by the UK Government.
| Data | Retention |
|---|---|
| Account data | For the life of your account, plus 60 days after deletion request |
| Page content and links | For the life of your account, plus 60 days after deletion request |
| Date of birth | For the life of your account, plus 60 days after deletion request |
| Team membership history | A team keeps your figures for the time you were a member. We’re setting a fixed period and will update this policy when we have |
| A parent or guardian’s email address | Kept with the email we sent them for 30 days. If they agreed to hear from the team, we keep the address until the member leaves, the parent withdraws or the member turns 18. After that, only a one-way hash, so we can recognise the same address if a team asks again |
| Page view, click and guide reading data | Rolling 24 months, then aggregated and anonymised |
| The guides you’ve read (signed in) | For the life of your account, and deleted with it when it’s permanently deleted |
| Visitor IP addresses | Not stored with analytics. Our web server's access log keeps them for 14 days |
| IP address of a sign-in | Kept with the record of that sign-in, for security and fraud prevention. We're setting a fixed retention period and will update this policy when we have |
| Backups | Encrypted copies of our database, stored with our hosting provider in the UK and Ireland, kept for 30 days and then deleted |
| Audit records | Retained indefinitely (contains no personal content — account lifecycle events only) |
| Hashed email (post-purge) | Retained indefinitely for fraud prevention — cannot be reversed to your email |
When you delete your account, we soft-delete it for 60 days (so you can change your mind), then permanently purge your personal data. A minimal audit record is kept for fraud prevention — it contains a one-way hash of your email and basic account metadata, nothing more.
We keep cookies minimal. These are essential and need no consent:
em_auth) — keeps you signed in if our servers restart, for up to a day.em_consent) — remembers the answer you gave the banner below, for six months, so we don't ask again on every page.em_region) — only when you choose a currency yourself, or sign in: remembers it for a year so prices stay in it.em_join) — only if you open a team’s join link while signed out. It remembers the link for a day, so you come back to it once you’ve signed in or registered.em_pg…) — only if you enter a page’s access code. It remembers that you’ve unlocked that page, until you close your browser or for the number of days the page’s owner chose.These are not essential, and we only set them if you say yes:
em_cc, 30 days, and em_region, a year) — remembers the country we detected and its currency, so we don’t have to work it out again on every page. Without them, we still show prices in your currency; we just work out your country afresh each time._ga, _ga_*) — tells us how many people visit our marketing pages and how they found us. Google Ireland Limited processes this on our behalf, and data may be transferred outside the UK under the safeguards described in Section 6. Advertising and personalisation features are switched off, so this is never used to target ads at you or to follow you around other websites.Until you choose, none of these is set and Google receives nothing that identifies you. You can change your mind whenever you like:
Your public page carries no tracking cookies. Analytics cookies and the consent banner appear on our own pages — marketing, sign-in and your dashboard. They are never loaded on exclusively.me/yourname, so nobody visiting your page gets a cookie banner from us. The only cookie a visitor can get there is the page unlock above, and only if they enter an access code. The visitor numbers we show you in your dashboard are counted on our own servers and use no cookies at all.
Under UK GDPR, you have the right to:
To exercise any right, email [email protected]. We'll respond within 30 days.
You must be 13 or over to use exclusively.me. We ask for your date of birth when you sign up, and we don't create an account for anyone under 13. If we learn that we've collected data from a child under 13, we'll delete it promptly. If you're between 13 and 18, we recommend getting a parent or guardian's OK before signing up.
If you're 13 to 17, you can only join a team with a parent or guardian's agreement. The team gives us their email address, never you, and we email them to ask. They can withdraw their agreement at any time from the same email, and you'll leave the team. Until you're 18, a team sees your statistics or your email address only if your parent or guardian agreed to exactly that, and it can email them only if they agreed to that.
We take security seriously. Passwords are hashed using PBKDF2-SHA256 with 600,000 iterations — industry-recommended strength. We enforce HTTPS everywhere and use secure session cookies. Two-factor sign-in isn't available yet; it's on our list, and we'll tell you when it arrives. No system is perfectly secure, but we work hard to protect your data.
We may update this policy from time to time. If we make significant changes, we'll notify you by email or via a notice on the platform before the changes take effect. Continued use of the service after changes constitutes acceptance of the updated policy.
If you're unhappy with how we handle your data, please contact us first at [email protected] — we'd genuinely like to sort it out. If we can't resolve your concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
Exclusively Me Ltd
Registered in England and Wales, company number 17458606
Registered office: 167-169 Great Portland Street, London, England, W1W 5PF
Email: [email protected]
ICO registration number: ZC248827