Privacy Policy

1. Who we are

VantaSpec ("we", "us", "our") is a PC hardware price comparison service operated by FloatWeb. Our website is at vantaspec.com.

FloatWeb is the data controller for the personal data described here. For anything in this policy, including a request to see or delete your data, contact [email protected]. We aim to respond within 30 days, which is the statutory limit.

2. What we collect

• Account data. Your email address, display name and username. Optionally a profile picture, bio and social links, if you add them.
• Password. Stored only as a bcrypt hash. We cannot read it, and we cannot tell you what it is. If you forget it, you reset it.
• Sign-in with Google or Facebook. If you use it, we receive your name, email and profile picture from that provider. We do not receive your password.
• Sign-in or linking with Discord. If you use it, we receive your Discord user ID, username, email and avatar. We show your username on your profile, add you to the VantaSpec Discord server with a Verified role, and give your profile a Discord badge. Unlinking from your profile removes the link, the role and the badge.
• Posting a build to TikTok. If you connect your TikTok account to post a build, we receive your TikTok ID, display name and profile picture, and keep a token, encrypted, that lets us post to your account only when you press Post on a video you have previewed. We read the audiences and settings TikTok offers you so you can choose them; we never choose for you. The video is kept on our server only briefly: it is deleted once posted, or when you make another. Disconnecting on the share page deletes the token, and you can also remove VantaSpec in TikTok's settings.
• Things you write. Reviews, forum posts, saved builds, favourites and price alerts. Reviews and forum posts are public.
• Analytics. If you accept analytics cookies: the pages you visit, the site that referred you, which of our social media posts you arrived from (if you followed a link in one), your browser, operating system, device type and the country and city your connection appears to come from, with that city's rough position (to about 10 km) so we can show visits on a map. The post is kept in your browser for that visit only, and also noted if you click through to a retailer. We do not store your IP address with this. If you are signed in, the visit is noted against your account, and so are the pages you viewed earlier in the same browser tab before signing in or signing up (for example, how you first found the site). Our staff use this to see what an account did when looking into a problem or abuse, and to understand how people find and use the site. When you open a product after searching, we also note the search words and that product, with nothing that identifies you, so that search can show what people were looking for higher up next time. Your last search is kept in your browser for ten minutes for this.
• Retailer clicks. When you click through to a retailer we record which offer, its price, and a daily-rotating one-way hash of your IP address and browser. The hash lets us count visitors without identifying them, and it changes every midnight so the record cannot be linked across days even by us. The raw IP address is never stored. If you are signed in, the click is also noted against your account. Each click carries a random reference that we pass to the retailer's affiliate network; if you then place an order, the network reports that reference back with the order's value and status, and sometimes the products ordered, so we can see which click led to a sale. The network does not send us your name, address or payment details.
• Your public profile. If you set a username, your profile page at /user/your-name is public: your display name, username, profile picture, bio, location and any social links you added, plus your reviews, builds and forum activity. It is listed in our member directory and can be found by search engines. Your favourites are shown there only if you switch on “Show my favourites on my profile” in your account settings; they are private otherwise, though the number of them is shown. Seasonal stickers show there too: being signed in during an event such as Halloween records a sticker for it (which one, and the date), and so do a few things you do here, such as visiting after midnight, saving a build, setting a price alert or favouriting five products. Badges you earn show there as well, and to award the Active Member one we count how many different days you have visited while signed in (a number and the date of your last visit, nothing about the pages). Your email address is never shown. Clear the username on your profile and the page and the listing both go.
• Desktop notifications. If you turn them on from the notification bell, we keep the address your browser's push service gave us for that browser (Google, Mozilla, Microsoft or Apple, depending on the browser), linked to your account. We use it only to wake your browser when you have a new notification; the message itself is fetched from us and never passes through the push service. Turn it off from the bell, or block notifications in your browser, and it is deleted.
• Phone app price alerts. The app's watchlist is kept on your phone. Only if you turn on price drop alerts do we keep the notification address Expo gave the app, the products on your watchlist and the price each was saved at, with no account, name or email. We use them only to tell you when one gets cheaper or is back in stock. Unlike desktop notifications, the message (the product, the price and the shop) travels through Expo and Google's or Apple's push service to reach the phone. Turn alerts off in the app's settings and they are deleted; if the app goes unopened for 60 days, or is uninstalled, they are deleted too.
• Newsletter. If you subscribe: your email address, the date, and the IP address the signup came from. The IP is kept as evidence that the consent was given, which is something we are required to be able to show. We only add an address after you click a confirmation link sent to it, so nobody can subscribe you.
• Security logs. Sign-in attempts, password changes and admin actions, with the IP address they came from. This is how we detect someone trying to break into an account.

3. Why we are allowed to use it

Under UK GDPR we need a lawful basis for each purpose. Ours are:

• Contract: running your account, saving your builds, favourites and price alerts. We cannot provide these without processing the data.
• Legitimate interests: keeping accounts secure, preventing abuse and fraud, moderating content, and measuring aggregate traffic to a retailer. We have weighed these against your rights and use the least data that works.
• Consent: analytics and advertising cookies. Nothing in that category is stored on your device or read back until you agree, and you can withdraw at any time (see section 4).
• Legal obligation: where we must keep or disclose records by law.

4. Cookies and similar storage

Strictly necessary. A session cookie that keeps you signed in, and a record of your cookie choice so we can honour it. These do not require consent, because the site cannot work without them. Staff previewing a seasonal theme also get a cookie holding that choice for an hour; it is never set for anyone else.

Analytics. A session-storage identifier that lets us tell one visit from another. Only set if you accept.

Reminders. If you accept, your browser keeps a count of the days you use the site and of the days you look at each part. We use it to ask, at most once a day, whether you bought a part you keep coming back to and would review it, whether you would like to join our Discord server, or whether you would review us on Trustpilot. The count stays on your device and is never sent to us. Rejecting or withdrawing consent deletes it.

Advertising. We use Google AdSense to fund the site. If you accept, Google sets its own cookies and may use them to personalise advertising; that processing is Google's, described in Google's advertising policy. If you do not accept, no advertising cookie is set or read, and any advert you see is non-personalised, chosen from the page you are on, not from anything stored about you.

We do this with Google Consent Mode. The AdSense script is present on the page from the start, but it is told before it runs that advertising storage is refused, and it stays refused unless and until you accept. If you do accept, that is communicated immediately, without reloading the page.

You can change your mind whenever you like. Withdrawing is as easy as giving consent:

5. Affiliate links

Links to retailers may carry affiliate parameters, and we may earn a commission if you buy, at no extra cost to you. Affiliate relationships never influence price rankings or product placement: offers are ordered by price.

We take part in the Amazon.co.uk Associates Programme. Where a product page offers a link to search Amazon, that link is tagged and we may earn from qualifying purchases. We do not display Amazon prices, and clicking the link hands you to Amazon, whose own privacy notice and cookies apply from that point (Amazon Privacy Notice).

6. Who else sees your data

Our own team. The site owner can sign in as a team account. The shared accounts we post and moderate from. This exists so those accounts can be used without a separate password being shared around. It cannot be used to sign in as an ordinary member's account: the list it offers is limited to team accounts, and the check is applied again when the switch is made, not only when the list is drawn. Every switch and every return is written to the security log against the real person who did it, and while it is in effect the site shows a banner on every page saying so.

We do not sell your data. We share it with:

• Google: for optional sign-in, and for AdSense if you accept advertising cookies (privacy policy).
• Discord: for optional Discord sign-in and our server (privacy policy).
• TikTok: for posting your builds to your own TikTok, if you choose to (privacy policy).
• Meta: for optional Facebook sign-in, if you use it (privacy policy).
• Our hosting and email providers: who process data on our instructions only.

Our servers are in Europe. Google and Meta are US companies and may process data outside the UK; those transfers rely on the UK extension to the EU–US Data Privacy Framework, or on standard contractual clauses where it does not apply.

Clicking through to a retailer takes you to their site, which has its own privacy policy. We do not pass them anything about you.

7. How long we keep it

• Account data: until you delete your account, then removed.
• Reviews and forum posts: deleted with your account.
• Analytics and click records: up to 12 months, then deleted. Not linked to you unless you were signed in when you clicked.
• Security logs: up to 12 months.
• Newsletter subscription: until you unsubscribe. After that we keep the address on a suppression list so a later signup by somebody else cannot quietly put you back on it. Deleting your account removes the record entirely.
• Password reset links: one hour, and destroyed the moment they are used.

8. How we protect it

• Passwords are stored as bcrypt hashes, never in readable form.
• Everything is served over HTTPS, with HSTS so your browser refuses to fall back.
• Sign-in attempts are rate limited, so a stolen password list cannot be tried against accounts at speed.
• Two-factor authentication is available in your account settings. We recommend turning it on.
• Resetting your password signs out every other session immediately.

No system is perfectly secure. If a breach happens that is likely to put your rights at risk we will tell the ICO within 72 hours and tell you without undue delay.

9. Your rights

Under UK GDPR and the Data Protection Act 2018 you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another service. Where we rely on consent, you can withdraw it at any time.

Two of these you can do yourself, right now, without asking: download all of your data or delete your account. For anything else, email [email protected].

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.

10. Children

VantaSpec is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, email us and we will remove it.

11. Changes

We may update this policy. The date at the top always reflects the current version, and we will post a notice on the site for changes that materially affect you.