Privacy Policy

Last updated: 19 April 2026

Who we are

Siftra is a B2B business-data search service operated by Bloor Engineering Ltd, a company registered in England and Wales (company number 14230472), registered office 11 Pennine Way, Swadlincote, Derbyshire, DE11 9EX, United Kingdom. For data-protection questions you can contact us at george@bloorengineering.com.

1. Data we collect about you (the customer)

• Account data: email address and a bcrypt-hashed password you choose at signup.
• Subscription data: if you subscribe, Stripe processes your payment and returns a customer ID and subscription ID, which we store. We never see or store your card details.
• Usage data: timestamps of your searches, exports and API calls so we can enforce plan limits and prevent abuse.
• Technical data: IP address, user-agent and referer on UTM-tagged landing visits. We do not use advertising cookies.

2. Data we provide through the service (the UK businesses you search for)

Siftra's database contains publicly available business listings (name, category, address, phone number, email, website, Google rating, review count) scraped from public sources such as Google Business Profile listings. These relate to businesses, not individuals. We process this data under the lawful basis of legitimate interestfor B2B direct marketing, in line with UK GDPR and the ICO's B2B guidance. We do not sell personal data about consumers.

If you are a UK business and want your listing removed, email us at george@bloorengineering.com with the business name and postcode and we will remove it within 7 working days.

3. Why we process your data

• To provide the Siftra service you've signed up for (contract basis).
• To operate our subscription billing via Stripe (contract + legitimate interest).
• To prevent abuse and enforce plan limits (legitimate interest).
• To respond to support messages you send us (legitimate interest).

4. Who we share data with

• Stripe (payment processor, PCI DSS Level 1).
• Vercel (hosting — frontend).
• Hetzner Online GmbH (hosting — backend and database, Germany).
• Resend (transactional email, where applicable).

We do not share or sell customer account data with anyone else.

5. How long we keep data

Account data: kept while your account is active and for up to 6 years after cancellation for tax/accounting records (HMRC requirement). Usage logs: 13 months rolling. UK business listings: retained indefinitely while publicly available; deleted on request (see §2).

6. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, port and object to processing of your data. To exercise any right, email george@bloorengineering.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

7. Security

Passwords are hashed with bcrypt. All traffic is HTTPS (HSTS, TLS 1.2+). Database connections require SSL. Payment details never touch our servers — they go directly to Stripe.

8. Cookies

We use one first-party cookie (siftra_token) to keep you logged in. No advertising or tracking cookies. UTM parameters on landing URLs are logged to our own database only.

9. Changes to this policy

If we make material changes we will update this page and, if necessary, email logged-in users at least 14 days before the change takes effect.

← Back to Siftra