Privacy policy

Last updated 3 November 2026.

FairRenew is run by Mark Forde, trading as FairRenew, 256 Green Wrythe Lane, Carshalton, SM5 1TS. Contact: support@fairrenew.co.uk.

Two roles

Businesses that use FairRenew: we are the controller of your account data (your email address, business details, billing records). When you create an account we also record how you found us, if the link you used says (for example a campaign tag such as "utm_source" or "ref", or the name of the website that linked to us). We use it only to count which of our marketing works. We do not use a cookie for this.

Their customers (subscribers): we process subscriber data as a processor on behalf of the business you subscribe to, which is the controller. If you are a subscriber, contact that business about your data; we will help them respond.

What we process for businesses' customers

• Name, email address and Stripe customer and subscription identifiers.
• Subscription details: product, price, billing dates, trial and discount dates, invoice amounts, status.
• Copies of notices sent, their content fingerprint and delivery status.
• Cancellation requests made on the cancel page, including an optional reason.

We use this only to send the notices the business has switched on, run the cancel page and keep the audit log. We do not sell it, use it for marketing, or combine it across businesses.

Business contacts we approach about partnerships

We occasionally email a small number of UK firms, such as accountants, bookkeepers, trade bodies and publishers, whose clients or members sell subscriptions, to tell them about FairRenew and our free guides. For this we are the controller.

• Who: limited companies and LLPs only. We check a firm's status on Companies House first, and we do not email sole traders or partnerships about this.
• What we hold: the firm's name and company number, the business email address or contact form we used, the name of the contact if the firm publishes one for business enquiries, when we contacted them and the outcome (for example a reply, or a request not to be contacted).
• Where it comes from: the firm's own website or a public business listing, and Companies House. We never buy, rent or scrape email lists, and we only use addresses a firm publishes for business enquiries.
• Why, and our lawful basis: our legitimate interests (UK GDPR Article 6(1)(f)) in telling firms that advise subscription businesses about a low-cost tool their clients may need before a legal deadline. We send at most one email and one follow-up, written for that firm, with no tracking pixels or attachments.
• Saying no: reply "no thanks" to any email, or write to support@fairrenew.co.uk, and we will not contact you again. You can object at any time. We keep only the address and the date on a "do not contact" list, so that we never email it again.
• How long: if no business relationship follows, we delete the record 12 months after our last contact. Entries on the "do not contact" list are kept for as long as we do this kind of outreach.

Processing terms (UK GDPR Article 28)

As a processor we: act only on the business's documented instructions (these terms and their settings); make sure anyone with access is bound by confidentiality; use appropriate security (encryption in transit, encryption of Stripe keys at rest, access controls, a hash-chained log); use only the sub-processors listed below and tell businesses before adding one; help the business respond to individuals' rights requests and with security incidents; delete or return data at the end of the service; and provide information needed to show compliance.

Sub-processors

Transfers outside the UK rely on the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum, as applicable.

How long we keep data

Audit log entries and notice copies are kept for as long as the business has an account, because they are its evidence if a customer complains (customers can claim back up to 12 months after a missed notice). The audit log is deliberately never trimmed while the account is open: it is hash-chained, so removing entries would break the proof that it is complete. Sign-in and cancel links expire within 30 minutes. After an account is closed we delete its data within 30 days, unless the business asks us to keep the audit log longer.

Our hosting provider (Railway) keeps request logs (IP address, page requested, time, browser type) for a short period for security and fault-finding. Our own logs and internal monitoring emails do not contain subscribers' email addresses.

Lawful basis

For businesses' account data: performing our contract with you (UK GDPR Article 6(1)(b)), and our legal obligations for billing records; recording how you found us relies on our legitimate interests in knowing which marketing works (Article 6(1)(f)). For business contacts we approach about partnerships: legitimate interests (see above). For subscriber data we act as a processor on the business's instructions; the business's basis is usually its legal obligation to send these notices under the Digital Markets, Competition and Consumers Act 2024 (Article 6(1)(c)), and keeping the audit log supports its legitimate interest in being able to prove it did (Article 6(1)(f)). Security logs and abuse prevention rely on legitimate interests.

Cookies

We use only essential cookies: a sign-in cookie for businesses, a short-lived cookie on the cancel page, and a security cookie that protects forms. No analytics or advertising cookies. Everything on our pages, including the font, is served from our own site.

Your rights

You can ask for access to, correction or deletion of your data, or object to processing. Email support@fairrenew.co.uk. You can complain to the Information Commissioner's Office (ico.org.uk).