Privacy notice
Draft for legal review before public launch. Last updated 23 October 2026.
Who we are
Competese is run by Mellow. We are the controller of the personal data described here. Contact us about privacy at hello@competese.com.
What we collect, and why
- Your account: your email address and name, and which businesses you belong to and your role. We need these to sign you in and run the service you signed up for (the lawful basis is our contract with you).
- Signing in: each sign-in link is single use and expires after 15 minutes. We keep only a one-way code of each link, never the link itself. Your session lasts 12 hours.
- Your business's settings: your website, the competitors you choose, your plan, alert and email settings, and anything you upload. This belongs to the business and is used only for that business.
- Security and abuse prevention: we count sign-up attempts per IP address and email domain, and record which email addresses have had a free trial, as one-way codes. We do this to stop misuse of free trials and protect the service (the lawful basis is our legitimate interest in keeping the service safe and affordable).
- Billing: Stripe handles card payments. We never see or store card numbers. We keep the subscription status Stripe gives us. Stripe keeps invoices as tax law requires (legal obligation).
We do not use advertising or analytics trackers. The only cookie is the one that keeps you signed in (plus a short-lived one during Microsoft sign-in, if you use it).
Public information about other businesses
Competese reads the public pages of the websites you ask it to: product names, prices, stock and promotions. It identifies itself as CompeteseBot and follows each site's robots.txt rules (see how our crawler works). It is meant for business information, not people. If a public page happens to include a person's name (a sole trader, say), we keep it only as part of that page's record. Our lawful basis is legitimate interests: helping small businesses compare public prices.
Product pictures are shown straight from the competitor's own website, so your browser asks that website for the picture. Like any web request, this shows that website your IP address. We tell your browser not to say which page you were on.
Who else handles data for us
- Microsoft Azure (UK): hosting, our database and file storage, and Azure Communication Services for sending emails. Everything runs in Azure's UK South region (London).
- OpenAI (USA): finds competitors with a web search, groups products into categories, judges whether two products are the same and writes market summaries. We send only public business information: business names, website addresses, public product listings and the area you serve. Never email addresses, supplier documents or purchase costs. OpenAI is asked not to store this data (store: false). This transfer to the USA is covered by OpenAI's data processing addendum and its standard contractual clauses for UK data.
- Stripe: subscription payments.
- Cloudflare: the "not a robot" check on the sign-up page, when it is switched on.
We don't sell personal data or share it with anyone else, unless the law requires us to.
How long we keep it
| What | How long |
|---|---|
| Your account (name, email address) | Until you delete your account |
| Sign-in sessions | 12 hours, then deleted |
| Sign-in link requests (email address, and the business name and website typed at sign-up) | 30 days |
| Invitations to join a business | Deleted once accepted or expired (they expire after 7 days) |
| Emails we send you (subject, text, delivery status) | 30 days after sending |
| Activity log (who changed what in a business) | 12 months; your name is removed if you delete your account |
| Price history, products, changes and insights | 2 years |
| Copies of public web pages we read | 30 days |
| Supplier price-list files you upload | The file is deleted after 30 days; the extracted costs stay with the business until you delete them or the business |
| Free-trial record (a one-way code made from your email address, and your email domain if it is a business domain) | 12 months, even after you delete your account, so the same person can’t start trial after trial |
| Abuse-prevention counters (one-way codes of IP addresses and email addresses) | 2 days |
| A business that its owner deletes | Removed from our database within a day, with everything in it |
Backups of the database are kept for 7 days and then deleted, so deleted data can survive in a backup for that long.
Your rights, and how to use them
- Get a copy of your data: Settings → Your account → Download my data. The business's own data (competitors and prices) has its own CSV export.
- Delete your account: Settings → Your account → Delete my account. If you own a business, transfer it to a colleague (Settings → Team) or delete it (Settings → Plan & billing → Delete business) first.
- Correct, restrict or object: email us at hello@competese.com. We reply within one month.
- Complain: you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd like the chance to put things right first.
Supplier price lists
Only owners and admins can see supplier files and purchase costs. Files are virus-scanned and read in isolation, and never sent to AI, web search or any shared cache. Extracted costs need your review before they are used.
Children
Competese is a business tool and isn't meant for anyone under 18.
Changes
If we change this notice in a way that matters, we'll email account holders first.