Privacy.

The data controller for personal data collected through Reparations.design is:

Neeley Worldwide Ltd
Company no. 10288310 (England & Wales)
Registered office: 86-90 Paul Street, London, England, EC2A 4NE
Privacy contact: privacy@reparations.design

Because the School of Critical Design is an education project from Neeley Worldwide Ltd (not a separate company), data handled “by the School” remains under the same controller. We do not transfer your personal data to a separate organisation when we work on the scholarship.

When you submit a confession we collect: the confession text, your chosen contribution tier (which may be $0 — confessions are free to submit and publish), your selected tags, and a contact email. If you sign your name, we also collect your name, optional role, and optional URL.

For contributions of $10,000 and above, we additionally collect billing details (legal name, company, address, country, and any tax ID you provide) so we can issue an invoice from our accounting system.

For card payments below $10,000, Stripe collects the card data on its own infrastructure. We never see or store your card number — we only see the resulting payment confirmation.

If you check “Keep me updated on Reparations.Design” on the confession form, we record that opt-in alongside your email so we can send occasional updates about the project.

Automatically, without you entering it. When you submit the form, suggest a tag, or attempt an admin login, we record your IP address in a rate-limiting table so the same address cannot flood the ledger with submissions. Nothing else about the request is stored with it, it is never published or linked to your confession, and it is purged automatically (see retention, section F). Our host, Vercel, additionally keeps short-term server logs that include IP addresses and user agents, as any web host does.

The public ledger displays your confession text, the contribution amount (if any), the tags you selected, and (only if you chose “Sign my name”) your name, optional role, and optional URL. Your contact email and billing details are never published.

• We do not sell, rent, or share contact emails with anyone.
• We do not run third-party advertising trackers.
• We do not deanonymize anonymous submissions.
• We do not retain payment card numbers — Stripe handles those.
• We do not sell your personal data, and we do not hand your contact details, billing details, or IP address to anyone for AI training.
• We do, deliberately, let AI crawlers read the published ledger — see robots.txt. Being cited in AI-generated answers is how this record reaches people. So a published entry may be crawled, quoted, and used in model training by third parties we do not control. Everything unpublished stays out of that entirely.

We use a small set of vendors to operate the site. Each processes only the data they need to provide their service:

• Supabase — database hosting (confession content, contact emails, billing snapshots).
• Stripe — payment processing for card contributions.
• Resend — transactional email (moderation outcome, newsletter).
• Vercel — application hosting and edge caching.
• Xero — invoice billing for $10,000+ contributions.

International transfers. Supabase hosts our database in the EU. Stripe, Resend, and Vercel are US‑headquartered and may process data outside the UK and EEA. Where that happens we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, together with each provider’s own transfer safeguards as set out in their data processing terms.

We keep personal data only as long as we need it for the purpose we collected it, except where UK law requires us to keep it longer.

• Published entries — kept indefinitely. This is a permanent public record, and that permanence is the point. You can ask us to remove yours at any time (section H).
• Contact email, where the entry was published — 12 months after publication, then deleted, unless you opted into updates. Deleted sooner on request.
• Declined or withdrawn submissions — 12 months, so we can handle an appeal or a resubmission, then deleted in full.
• Newsletter opt-in and email — until you withdraw consent, then deleted within 30 days.
• Billing details and payment records — 6 years from the end of the accounting period they fall in. This one we cannot shorten on request: UK tax and company law require it.
• Rate-limiting records (IP addresses) — purged automatically after 7 days, and usually within the hour.
• Server access logs — retained by Vercel on its own short rolling schedule, typically about 30 days.
• Admin session cookie — 30 days, and it belongs to us, not to visitors.

Under UK GDPR we rely on the following legal bases:

• Publication of confession content — your explicit consent (given when you submit the form), supported by our legitimate interest in operating a public ledger.
• Moderation communications — performance of pre-contractual steps and our legitimate interest in operating moderation.
• Payment processing — necessary to process a voluntary contribution you choose to make and to comply with our tax and accounting obligations. No payment data is collected if you contribute nothing.
• Newsletter / project updates — your explicit consent, given via the opt-in checkbox on the confession form. You may withdraw consent at any time by emailing privacy@reparations.design.

We do not rely on legitimate interest for marketing.

You can ask us to delete your contact email at any time; published confession text remains on the public ledger but the email associated with it will be removed. You can ask us to remove a published confession entirely by writing to privacy@reparations.design. If you live in the UK, the EU/EEA, or California, you have additional statutory rights — including access, rectification, portability, restriction, objection, and erasure — and we will honour them within the statutory period (30 days for UK/EU, 45 days for California, extendable in limited cases).

If you believe we have mishandled your personal data, you have the right to complain to the UK Information Commissioner’s Office at ico.org.uk or your local supervisory authority.

We do not use advertising or tracking cookies. The only cookie we set is a 30-day session cookie used by the admin moderation tools.

Questions, requests, or complaints about privacy: privacy@reparations.design. Postal correspondence: Neeley Worldwide Ltd, 86-90 Paul Street, London, England, EC2A 4NE.

Terms of use →