Your information, plainly.

Last updated: 25 September 2026. Netdesignr Ltd operates Luckyplace and is responsible for the information described here. Contact us about privacy or to exercise your rights.

What we use and why

Your account email, password hash and verification state provide and secure your organiser account. Passwords are never stored in readable form.
Sale information you submit is published after review. Source links, dates and updates help visitors assess accuracy. Do not include private personal information in listings or reports.
Service emails handle verification, password recovery and account security. Weekly date reminders are optional and can be switched off in Settings. Market update emails are separately opt-in, sent to your verified account email, and can be stopped on the market page or Saved sales. Ownership claims and correction reports are held privately for review.
We count outgoing organiser-website button clicks by sale and day. We do not attach a visitor identity to those counts or set analytics cookies. Shared links can include a source tag. We count their landing requests by channel and day, without visitor identifiers; repeats and bots may be included. Counts are not unique people or attendance.
To limit abuse, request rate limits use a keyed, daily-changing hash of the connection address and retain counters for the rate-limit window. Application logs contain request identifiers, paths, status codes and timings, without passwords, email-link tokens or request bodies.
Stripe processes payments and subscription records when you purchase promotion. We store its customer/subscription references and your plan, not card numbers.

Account and subscription processing supports the service you request. Security, directory accuracy and limited aggregate reporting support our legitimate interests in operating a reliable service. Optional reminders follow your account preference. We do not sell personal data.

Cookies and device storage

The lp_session cookie keeps account holders signed in for up to seven days. It is HttpOnly and uses Secure on HTTPS. Saved sales use your browser’s local storage when you ask to save a sale; they are not synchronised to an account. Market email subscriptions are stored against your account until you stop them or delete the account. Clear that list by unsaving sales or clearing this site’s browser data. There are no advertising pixels or third-party analytics scripts.

Service providers

Our hosting provider stores the application database and operational records. Resend delivers account emails. Stripe handles payment processing and its hosted checkout/portal. These providers may process data outside the UK; relevant contractual safeguards and provider arrangements must be maintained by the operator. Each provider’s own notice applies when you use its separately hosted service.

Retention

Expired sessions, expired verification/reset tokens and rate-limit counters are removed by maintenance. Verification links expire after 24 hours; reset links after 30 minutes. Completed or failed email queue records are removed after 30 days, with delivered message bodies removed immediately. Aggregate click and tagged landing records are retained for 90 days; audit records for up to one year; resolved correction reports for up to 90 days. Rejected market ownership requests are removed after 90 days; pending and approved ownership evidence remains while needed for the account and ownership review. Location suggestions and research notes are kept for directory review; closed candidates are removed after one year from submission. Please do not include private contact information in suggestions. Unverified unused accounts are removed after 30 days when no active session or listing remains.

Your account and listings remain while your account is active. Account deletion removes them from the working database; encrypted backups expire within 30 days. An encrypted deletion ledger retains only an opaque account identifier and deletion time for as long as recovery archives could be restored. Recovery reapplies those deletions before use. Payment providers may retain financial records under their separate obligations.

Your choices and rights

Settings provides account export, reminder preferences and account deletion. Contact us to ask about access, correction, erasure, restriction, objection or portability where applicable, or if you cannot access your account. We may need to check your identity. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.