Privacy

Last updated: 17 October 2026.

Who Charged Me (WCM) is operated by WCM, LLC, which is responsible for the personal information described in this notice. We use limited information to run our directory, prevent spam, publish comments submitted by visitors and provide complaint help when requested. You can browse and search the directory without giving us your name, email address or phone number.

Information we use

Searches look through service information already in our directory. Our directory search records contain service numbers or queries, counts and dates, without attaching your name, email address, IP address or a browser identifier. Public service numbers and lookup times may appear in recent searches; unmatched queries are reviewed privately to improve the directory. Do not enter personal information in search fields. Directory entries come from public sources such as Ofcom and provider websites, and submitted corrections. They can include business contact details, including those of sole traders.

If you choose to leave a comment, we collect the information needed to verify and publish it. Comments and any service selection included in them are public and may appear in search engines. Keep personal, financial and sensitive information out of comments. Name, email and phone fields are private. We require email verification to reduce spam and check that the person submitting a comment can access the inbox. Clicking the verification link confirms inbox access and publishes your comment; it does not verify your identity or prove that a charge occurred. Links expire after 24 hours and work once. You can separately choose to ask WCM for help with your complaint. Name and the phone number charged are optional and collected only if you request help. You can use the directory without commenting, and publish a comment without requesting help.

We do not sell your private contact details or share them with the company behind the charge. WCM may contact you by email about your specific complaint only when you select the optional help request. This does not sign you up for general marketing. Participating service providers may pay WCM to help resolve complaints. You can withdraw your request by emailing us. Provider-information suggestions are reviewed separately. We also process IP addresses, browser information and submission activity for security and troubleshooting. Older records may contain approximate location information; we no longer make external IP-location lookups or display visitor locations publicly.

Why we use it

Our lawful basis is legitimate interests: maintaining a useful directory, verifying and publishing requested comments, preventing abuse and improving this website. Optional complaint-help contact is based on your consent, recorded separately from your public comment. Withdrawing that consent does not remove your comment. We limit the information used and balance these interests against your privacy and rights. You can object by emailing us. If a specific law requires us to keep or disclose information, our basis for that use is legal obligation.

Providers and security

We use established providers for hosting, Cloudflare for security and spam checks, Resend for verification emails, Sentry for error diagnostics and PostHog for limited website statistics when enabled. They process information needed for those services. Resend receives your email address and verification message, without your comment text. Analytics exclude contact details, search text, comment contents and verification tokens. We do not ask for sensitive information.

Our security measures include spam checks, submission rate limits, expiring single-use verification links, hashed verification tokens and diagnostic filtering. Session recording is disabled. We restrict access to private information to people and providers who need it for the purposes described here.

Our website and database are UK-hosted; PostHog statistics use its EU region. Resend stores email data in the US under its data-processing terms, which provide contractual safeguards for UK transfers. Other providers’ processing locations depend on their configuration and subprocessors. Contact us for details of relevant transfer safeguards. We may disclose information when required by law or needed to establish or defend legal claims.

Statistics and browser storage

When enabled, we collect limited statistics for eligible UK visits to understand page types, lookup outcomes and use of website features. We do not collect these statistics for other or unknown regions. A random identifier stays in page memory; there are no analytics cookies, advertising profiles or automatic form-field capture. Our server does not forward your IP address to PostHog.

You can turn statistics off at any time in Analytics preferences. We respect Do Not Track and Global Privacy Control. If preference storage is blocked, collection stays off. Your choice is saved in this browser until changed or cleared. A necessary verification receipt cookie expires after 24 hours; Cloudflare may also use necessary security storage. Non-exempt tracking requires prior consent.

How long we keep information

We currently retain published comments and their associated private submission details without a fixed automatic deletion period. Requested complaint-help records are also retained; there is currently no automatic deletion when a case is resolved or a provider does not respond. You can ask us to delete your personal information by emailing us. We assess each request and explain any legal reason for retaining particular information.

Verification links expire after 24 hours; expiry does not itself delete the saved submission. Directory-review records are held separately without a stored visitor identity. Technical, email and statistics records held by our service providers are subject to the retention arrangements for those services. Contact us for details relevant to your information.

Your rights and complaints

You can request access, correction, deletion or restriction, and object to use of your information. Portability and withdrawal of consent apply where their legal conditions are met. We may need to verify your request and normally respond within one month. We will explain any limits or extension. We do not make solely automated decisions with legal or similarly significant effects about you.

Email us to raise a privacy complaint. We will acknowledge it within 30 days, investigate without undue delay and tell you the outcome. You can also complain to the UK Information Commissioner’s Office at ico.org.uk. Linked customer-care services have their own privacy notices. We update this notice as practices change and tell you about significant new uses before they begin.

Analytics preferences

Choose whether Who Charged Me can collect limited statistics to improve this website. Your choice is saved in this browser and can be changed at any time.

Collection only runs when analytics is enabled for eligible UK visits. Do Not Track and Global Privacy Control take priority. If your browser blocks preference storage, collection stays off.