Privacy Notice
Last updated: 15 October 2026
This notice explains how The Reference (thereference.uk) handles your personal data: what we collect, why, who we share it with and what your rights are. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU and UK General Data Protection Regulation (GDPR).
1. Who is responsible
The controller of your personal data is Massimo Duse, Via Fontana 15, 6828 Balerna, Switzerland. For any question or request about your data, write to privacy@thereference.uk.
2. What we collect
- Your account. Your email address and an account identifier. If you sign in with Google, Google also passes on your name and profile picture, which our sign-in provider stores with your account; we don’t use them for anything else. We never see your Google password.
- What you do in the app. Your saved searches and alert settings, your favourites, the listings whose retailer you contact, your credit balance and its history, and the feedback and listing reports you choose to send us (with any comment you add).
- Purchases. The number of credits, the amount and currency, the status of the payment, the reference numbers Stripe gives it, any refund or dispute, and when you asked for immediate supply of your credits under which version of the Terms. Your card or other payment details are entered on Stripe’s page: we never see or store them.
- Usage. Events such as sign-ins, searches, alerts turned on or off, listings viewed, retailers contacted, the offer to buy credits being shown, clicks through to a retailer’s website and favourites, recorded with your account identifier and the date, plus the button and page you signed up from. For visitors who aren’t signed in, we only count visits, and whether they look further or start to sign up, without identifying anyone.
- Preferences. Your language and display currency, and your cookie settings.
- Measuring our Reddit ads. If you arrive from one of our Reddit ads, the id Reddit adds to the ad’s link. If your cookie settings allow it, what Reddit’s tools record and send to Reddit, set out in section 5.
- Technical data. Your IP address, browser type and the time of each request, which our hosting provider keeps in server logs for security and reliability. We also use IP addresses briefly, in memory only, to limit abusive traffic.
3. Why we use it
| Purpose | Legal basis under the GDPR |
|---|---|
| Providing the Service: your account, the catalogue, contacting retailers and credits, saved searches and the email alerts you turn on | Performance of our contract with you (Art. 6(1)(b)) |
| Selling credits, confirming purchases and keeping accounting records | Contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)) |
| Understanding how the Service is used and improving it (usage statistics, feedback) | Our legitimate interest in a useful product (Art. 6(1)(f)) |
| Measuring which of our Reddit ads bring visitors who sign up, so Reddit can show them to people likely to be interested | Your consent (Art. 6(1)(a)), which you can withdraw at any time under Cookie settings |
| Keeping the Service secure, preventing fraud and abuse, handling refunds and disputes | Our legitimate interests (Art. 6(1)(f)); legal obligations (Art. 6(1)(c)) |
We process your data for these purposes only, in line with the principles of the FADP. We don’t make decisions about you based solely on automated processing.
4. Who we share it with
We don’t sell your personal data, and we never share it with the retailers. We share it only with:
- Google (Firebase and Google Cloud), our hosting provider, for sign-in, the database, the servers and the website. Our database and servers are in the European Union (Milan, Italy); Firebase’s sign-in service may process data in the United States. Google acts as our processor.
- Resend (United States), which sends our emails: the alerts you turn on and the confirmations of your actions. Resend acts as our processor.
- Stripe and Link, when you buy credits. You pay on a page run by Stripe, and Link, a Stripe service, processes the payment as merchant of record. Stripe and Link handle your payment data as independent controllers, under their own privacy policies (stripe.com/privacy and link.com/privacy). We send Stripe your email address, your account identifier, your language and the address of the page to bring you back to after paying, which may contain the anonymous reference of the listing you were viewing. We never send Stripe a retailer’s name, a price or any other detail of a listing.
- Google as a sign-in provider, if you choose to sign in with Google, under Google’s own privacy policy.
- Reddit (Reddit, Inc., United States), only if your cookie settings allow it, to measure our Reddit ads: see section 5.
- Authorities, where the law requires it.
If you click through to a retailer’s website, you leave The Reference and the retailer’s own privacy policy applies there.
5. Measuring our Reddit ads
We advertise on Reddit. To learn which of our ads bring people who go on to sign up, and so show them to more people like you, we use Reddit’s tools: the Reddit Pixel, Reddit’s script running in your browser, and Reddit’s Conversions API, through which our server tells Reddit that an account was created. They run only on thereference.uk.
Only with your OK. A banner asks on your first visit, and until you accept, the Pixel doesn’t load and our server tells Reddit nothing about you. On a device set to a US time zone there is no banner: they are on unless you turn them off, and a browser that sends Global Privacy Control counts as a no.
What Reddit receives.
- The address of each page you view here, which includes any words typed into the search.
- For a watch you open, its model, its reference and the anonymous id in its address; for a search, the model or reference searched.
- That you started to sign in, and that you created an account.
- With a new account, what Reddit needs to match it with an ad: the id Reddit added to the link of the ad you tapped, your email address and account identifier as codes (SHA-256 hashes: Reddit receives the code, never the address), the id Reddit’s cookie keeps for your browser, your IP address, your browser and screen size, and an id that lets Reddit count the sign-up once.
We never send Reddit a retailer, a watch’s price, your email address in plain text, or the names of your alerts. We keep a note that your sign-up was reported, so it is reported only once. Reddit matches what it receives with the people who saw or tapped our ads, which can include your Reddit account if you have one, and uses it under its own privacy policy (reddit.com/policies/privacy-policy).
Changing your mind. You can change your answer at any time in Cookie settings (Your privacy choices in the US), at the foot of every page and in Account. Saying no stops anything further from being sent to Reddit, removes Reddit’s cookies from this site and forgets the ad you came from; it doesn’t affect what was sent before. Your answer is kept in this browser, and where the banner asks, it asks again after six months.
6. Transfers abroad
Some of these providers process data outside Switzerland and the European Economic Area, in particular in the United States. In that case we rely on the safeguards the law provides: the Swiss–US and EU–US Data Privacy Framework where the provider is certified, or the European Commission’s Standard Contractual Clauses, with the adaptations required for Switzerland.
7. How long we keep it
- Account, activity and usage data: as long as your account exists. When you ask us to delete your account, we delete it within one month.
- Purchase records and the history of your credits: 10 years, the period Swiss law requires for accounting records. After your account is deleted, we keep them only for that purpose.
- Server logs: about 30 days.
- Statistics that no longer identify you (for example, how many people signed up on a given day) may be kept longer.
8. Your rights
You can ask us for access to your data, to correct or delete it, to restrict its use, or to receive it in a portable format, and you can object to any use based on our legitimate interests. You can turn off email alerts at any time, in the app or with the link in every alert, and withdraw your consent to Reddit’s tools under Cookie settings. To exercise your rights, write to privacy@thereference.uk; we reply within 30 days and may ask you to confirm your identity.
You can also complain to a data protection authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch); in the EU or the UK, the authority of the country where you live.
9. Security
Data travels over encrypted connections (HTTPS). Access to our database is restricted: security rules let you read only your own data, and only we can see the purchase records.
10. Children
The Service is intended for adults. We don’t knowingly collect data about children; if you believe a child has given us personal data, please contact us and we will delete it.
11. Cookies
Reddit’s tools, which run only as your cookie settings allow, set Reddit’s cookies on this site. They, and everything else we store in your browser, are described in the Cookies notice.
12. Changes to this notice
We will update this notice when our handling of personal data changes, publish the new version here with a new date and, for significant changes, tell you by email or in the app.