Privacy Policy
This notice explains what personal data RankThatMovie processes, why, on what legal basis, who we share it with, how long we keep it, and the rights you have under the UK GDPR. It is built from an internal record of our actual processing activities rather than generic wording.
1. Who we are
The data controller is Alexander Bojarski / Level Higher . For any privacy question or to exercise a right, email [email protected] (general enquiries: [email protected]).
2. What data we process
- Page requests & security logs. IP address, timestamp, requested URL, HTTP status, user agent, referrer and security flags, generated automatically when you load a page.
- Consent records. Your consent choice, a timestamp, the policy/CMP version, region and any withdrawal event, so we can honour and evidence your preference.
- Contact correspondence. If you email us: your name/email if supplied, the message, any attachments and the reply history.
- Advertising data (only after consent). If you consent, Google and its ad-technology partners may process identifiers such as your IP address, device/browser information and ad interactions.
- Analytics (only if enabled and consented). If we run analytics, the provider, events and storage are described in the Cookie Policy.
- Recommendation inputs. Your mood, runtime and audience selections. These are used to produce a recommendation and are not used to identify you.
- No account data. There is no login, and we do not ask for your name, email or payment details to browse.
3. Purposes and legal bases
We map a lawful basis to each purpose:
- Deliver and secure the service (serve pages, prevent abuse, diagnose faults) — legitimate interests.
- Remember your consent choice — legal obligation / consent, as applicable.
- Respond to your enquiries — legitimate interests, or steps prior to a contract if relevant.
- Show personalised or measured advertising — consent, given through the consent banner.
- Measure performance (analytics), if used — consent.
- Comply with legal obligations and respond to lawful requests — legal obligation.
4. Advertising — Google AdSense
We intend to use Google AdSense to display ads. Where you give consent through our consent banner, Google and its partners use cookies and similar technologies to serve and measure ads, and may use advertising identifiers and your IP address. If you reject, we do not enable non-essential advertising storage. You can review Google's practices at policies.google.com/technologies/ads and manage ad personalisation at myadcenter.google.com.
5. Recipients and processors
We share data only with providers that help us run the service, acting on our instructions:
- Hosting & delivery — our server host and Cloudflare (CDN/DNS/tunnel).
- Email — our email provider for support correspondence.
- Advertising / consent — Google AdSense and our consent management platform, once live.
- Movie data — TMDB (metadata/artwork) and JustWatch (availability), which receive requests needed to fetch data but not your identity.
A current vendor list is maintained internally and updated before any new script is added.
6. International transfers
Some providers (for example Google and Cloudflare) may process data outside the UK. Where they do, transfers rely on an appropriate safeguard such as UK adequacy regulations, the UK Addendum to the EU Standard Contractual Clauses, or an equivalent mechanism offered by that vendor. We do not assume a single mechanism applies to all vendors; each provider's safeguards can be inspected in their own documentation.
7. Retention
- Security/server logs — kept for a short period for diagnostics and abuse prevention, unless an incident requires longer.
- Consent records — kept while the choice is valid and for a reasonable period afterwards to demonstrate compliance.
- Contact emails — kept for as long as needed to handle the matter and a reasonable follow-up period.
- Advertising/analytics — governed by the relevant provider's retention, described in the Cookie Policy.
8. Your rights
Subject to the applicable legal basis, you have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent at any time (which does not affect prior processing). To make a request, email [email protected] with “Privacy request” in the subject. We aim to respond within one month and may ask for proportionate identity verification before disclosing personal information.
9. Automated decisions and profiling
Our recommendation engine uses your in-session mood, runtime and audience selections to rank films. These inputs are session-based and are not used to build a personal profile or make decisions with legal or similarly significant effects about you. Advertising personalisation by Google, where you consent, is separate and is described above.
10. Children
RankThatMovie is not directed at children under 13. Family-oriented recommendations are a use case, but we do not knowingly collect data from children or apply behavioural advertising aimed at them.
11. Complaints
Please contact us first at [email protected]. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, helpline 0303 123 1113.
12. Changes
We update this notice when our processing changes. The date at the top shows the latest version.