Privacy notice
The short version: I only keep what I need tae make yer roast, I delete it after 90 days, and I never sell it.
Who’s responsible
Duncan Smith, trading as SlammDunk Productions, Scotland, UK, is the data controller. Contact: hello@whitdidyesay.com.
What I collect
- From you, the buyer: your first name, your email, your order and payment confirmation, and your tick-box choices. Payment is handled by Shopify; I never see your card details.
- About the person being roasted: their first name, town, the occasion, and the details you type in.
- Made by me: the script, the voice recording and the video.
- When yer roast link is used: the date and time it’s first opened and saved, plus the type of browser. That’s my proof the roast was delivered (my legitimate interest), and it’s deleted with the rest of the order after 90 days.
Why I use it (and the legal reasons)
- To make and deliver your roast. This is needed for our contract.
- To check every order is safe and fair, and to keep a record of my review. This is my legitimate interest in running a safe service.
- To keep tax and business records. This is a legal obligation.
- To post the channel version, only if you ticked the box. It can show the first name and town of the person being roasted. This is your consent, and you can withdraw it at any time.
I don’t use your details for marketing unless you sign up for that separately.
The person being roasted
You’re telling me about someone who isn’t here. I use their details only to make your roast, under my legitimate interest in providing a comedy gift the buyer asked for. I keep it to what’s needed and delete it after 90 days. If you’re the person who was roasted, you can ask me what I hold about you, or ask me to delete it, at hello@whitdidyesay.com.
How long I keep it
- Order details, script, voice and video: deleted 90 days after delivery. Your download link stops working when the video is deleted.
- A minimal review record (who reviewed, when, what changed, the decision): kept for 6 years as a business record, with no more personal detail than needed.
- Shopify order and payment records: kept as long as tax law requires.
Who helps me make it
- Shopify: checkout, payments and order records.
- A script-writing service: helps me draft the script.
- A voice service: produces the voice.
- Netlify: hosts this website and the order page.
- My email and file-hosting providers: sending you your roast.
They only process data on my instructions. Some of them are based outside the UK (for example, in the US); where that happens, the transfer is covered by approved legal safeguards, such as the UK International Data Transfer Addendum or the UK-US data bridge.
What I never do
I never sell or rent your data, and I never use the details you give me for anything except your roast. Nobody under 18 can be roasted or order one.
Your rights
You can ask to see, correct or delete your data, object to how it’s used, or withdraw consent for the channel share. Email hello@whitdidyesay.com and I’ll reply within a month. If you’re unhappy with how I’ve handled it, you can complain to the Information Commissioner’s Office at ico.org.uk.