The Rotation is a private register for watch collectors, operated at therotation.ai by Atelier Benedict Limited, a company registered in England and Wales under number 17110936, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Atelier Benedict Limited is the data controller for the information described here, and is registered with the Information Commissioner's Office under number ZC113531.
This notice explains what we hold, why we hold it, who else touches it, where it lives, how long it stays and what you can make us do about it. The short version: we collect little, we sell none of it, and there are no advertising cookies or third-party marketing technology anywhere on this site. We count page views, with no cookie and nothing that identifies you.
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Account identity | Your email address and name, received from your sign-in provider, so the register knows whose it is. | Performance of a contract | Until you close the account |
| Your register | The watches you file — references, serial numbers, photographs, what you paid, what you wear and when. This is the service. | Performance of a contract | Until you delete it or close the account |
| The watch’s voice | When the bench listens to a watch, the last twenty seconds of what the microphone heard can be kept with the reading, so the watch can be heard again from its own record. Recorded only while you listen and only if you keep it; the room’s other sounds are in it too. It stays in your account, is deleted with the reading, the watch or the account, and is never sent to a model or to anyone. Do not record where anyone is speaking: a voice in the recording is that person’s own information, and you are responsible for having their agreement. | Performance of a contract | Until you remove it or close the account |
| The catalogue’s photographs | When you file a watch or a wish without a photograph of your own, its brand, model and reference are sent to the house, and the shelf hands back its own picture of that reference when it has one — a copy the house keeps of the maker’s product photograph, taken from the maker’s own website. Where the Registrar’s card names a picture or a page for the reference, the house may fetch that picture on your behalf — the picture the card names, or the one its page presents as its own — and from nowhere else. Nothing else travels; no model is asked and nothing is counted against your allowance. The picture then lives in your register like any photograph you added, and leaves with it. | Performance of a contract | Until you remove it or close the account |
| Cards in issue | When you draw a card for one watch, the details you chose to show — and the photograph, if you included it — are held so that the address can be opened. What you paid is never among them, and no part of your wear log travels with it. We also count how many times the address was opened, and when. | Performance of a contract | Until the card closes or you withdraw it, then deleted |
| Membership billing | The standing of your membership — plan, status, renewal date — and the identifiers the till assigns: Apple's own transaction and subscription identifiers for a membership taken in the iPhone app, the only place one can be bought. Card details go to Apple directly and never reach us. | Performance of a contract | While the membership stands; deleted when the account closes |
| Waiting list | Name, email, city and country, so we can write to you about membership. | Consent | Until you ask to come off, or 24 months after the list closes |
| IP address | Counted against the password gate and the waiting-list form to stop automated abuse, and kept with the keeper’s own sign-in session while that session stands. Each member sign-in is noted too, by its address beside a one-way fingerprint of the email address tried; only a failed one is counted, so that guesses at one account can be slowed without slowing everyone else on the same network. Never linked to your register. | Legitimate interests (security) | 7 days |
| Identification records | What the model proposed from a photograph, whether you accepted it, a one-way fingerprint of the photograph, and how the photograph was taken and sent: whether it came from the camera or your library, whether it was sent from the iPhone app or the website, how many views were sent, and its size, sharpness and exposure as numbers. This is so identification improves. The photograph itself is never stored. | Legitimate interests (improving the service) | Unlinked from you after 12 months; the anonymous outcome is kept |
| Requests to the AI | The photograph you send to the Eye, a question to the Registrar with the part of your register it needs, or the material you bring to the importer, passed to Anthropic so that its model can answer you. The website, and the iPhone app from version 1.1.0, send nothing until you have given permission; an earlier version of the app does not ask (see Your permission for the AI, below). | Performance of a contract | Not stored on our servers. Anthropic deletes it within 30 days, or keeps it for up to two years only if its safety systems flag it |
| The month’s letter | The month’s account — the names of the pieces, the counts and dates, and the month’s figures — sent to Anthropic to compose your letter. Paused since 25 September 2026: nothing travels for it. | Performance of a contract | The letter: until you close the account. Anthropic: as above |
| Your AI permission | Whether you have allowed the AI desks, the wording you agreed to, and when you gave or withdrew it, so we can show that permission was asked for. | Legitimate interests (showing that permission was given) | Until you close the account |
| Notes on the AI’s answers | When you tell us that an answer from the Registrar or a reading by the Eye was wrong, which of the two it was and any words you add, up to 200 characters, kept against your account. These notes go to the house, not to Anthropic: we read them to improve the Eye and the Registrar, and nothing in your register changes. | Legitimate interests (improving the service) | 12 months, or until you close the account |
| Sync records | Which of your devices last sent or received your register, and when, so two devices do not overwrite each other. | Performance of a contract | Until you close the account |
| Cookies | Keeping you signed in, and remembering the collector’s entrance — the keeper’s own door. | Strictly necessary | Up to 30 days |
We do not profile you, we make no automated decisions that produce legal or similarly significant effects, and we do not use your register to advertise anything to you.
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
| rotation_session | Keeps you signed in to your account after you log in with email or a social provider. Without it, the register cannot recognise you. | Strictly necessary | Up to 30 days |
| rotation_key | Remembers that the keeper’s entrance was opened with its password. Used only by that door. | Strictly necessary | Up to 30 days |
Both cookies are first-party, HttpOnly, Secure and SameSite=Lax — a script on the page cannot read them, they travel only over encrypted connections, and they are not sent from other sites. They contain a session identifier: never your password, and nothing that tracks you across other websites.
Because every cookie we set is strictly necessary for the service you asked for, no consent banner is required — there is nothing optional to consent to. If we ever introduce optional cookies, this notice will change first and you will be asked properly.
You can choose Sign in with Apple in the iPhone app. Apple gives us an identifier for your account and the email address you choose to share, which may be a private relay address. We never receive your Apple password. We keep an encrypted Apple authorization token so we can disconnect Apple when you close your account. If Apple is temporarily unavailable, only the encrypted token and Apple identifier remain in a retry queue until disconnection succeeds; your register and account are still deleted. Apple sign-in does not purchase or cancel a membership. Apple handles sign-in under its own privacy notice.
The iPhone app may also offer Continue with Google. Google gives us a stable identifier for your Google account and the email address on it, and confirms that address is verified; we never receive your Google password, and we keep no Google token at all — the sign-in happens in the phone's own system browser session, never in a web view of ours. What we file is the identifier beside your account, so the same register opens next time; it is deleted with the account. Google sign-in does not purchase or cancel a membership. Google handles the sign-in under its own privacy policy, as an independent controller for that step.
Membership is bought only in the iPhone app; this website offers no membership and takes no payment.
A membership bought in the iPhone app is bought from Apple instead, under your Apple ID and inside Apple's own purchase sheet. We never see the card, and Apple does not give us your Apple ID, your name or your payment details: what reaches us is a signed receipt naming the product, the term, and whether it stands — filed against Apple's own transaction identifiers and against the account you are signed in to here. Apple handles that purchase under Apple's privacy policy, as an independent controller for it, and it is not a processor acting on our instructions.
Closing your account deletes our billing record of your membership. It does not cancel the subscription itself, which is Apple's; only you can end it, in Settings → your name → Subscriptions.
An App Store subscription is the one thing closing your account cannot end. It is held by Apple under your Apple ID rather than by us, and it goes on being charged after the account and everything in it are gone. Only you can stop it, in Settings → your name → Subscriptions, and it is worth doing that first; the closing screen says so too. We delete our record of it either way.
If you leave your address with us, we store the name, email, city and country you give us, and the date you asked. We use them for one thing: to write to you about The Rotation. We do not add you to any other list, and we do not pass the list to anyone.
Asking twice updates your details and keeps your original date. You can ask us to remove you at any time, by writing to the address at the foot of this page — that is also how you withdraw consent, and it costs you nothing to do so.
Your register — watches, wear history, wishlist, preferences — is stored on your own device — the browser’s local storage, or the iPhone app’s own store — so the register works instantly and offline. If you are signed in, a copy is also kept on our servers so your register follows you across devices. A small preference (your clock timezone) is stored the same way. Local storage is not sent to anyone else and never used for tracking. The same exemption that covers our cookies covers it: it exists only to deliver the service you asked for.
To be precise about that server copy, because the word is often used loosely: it travels over TLS and is encrypted at rest by our database provider, on encrypted volumes with encrypted backups. It is not end-to-end encrypted — we hold the keys, which means our systems could in principle read it, and it means we can restore your register if you lose your device. If you would rather nothing left your device at all, use the register signed out: local-first is the default, and the server copy only exists once you have an account.
Two further copies exist so that the server copy can survive a mistake — ours or yours. Each time your register is saved to the server, the version it replaces is kept for thirty days, which lets us put your register back as it stood at any point in the last month if something goes wrong; write to the address below and we will do it. Those versions hold the register’s document — the records themselves — and not the photographs and recordings kept beside it, so a picture or a voice you replaced or removed is not brought back by them. And once a day an encrypted copy of the whole database is taken and held, off the premises, for thirty days — insurance against losing the database itself. Those copies are encrypted with a key held separately before they leave, and they are used for nothing except restoration.
The Eye, the Registrar and the importer send what you give them to Anthropic, as the next two sections describe. Before anything of yours is first sent, the register asks for your permission, in words that name Anthropic and what will travel, and sends nothing to Anthropic until you have given it: the website asks, and the iPhone app from version 1.1.0 asks the same question in the same words, before you first use the Eye, the Registrar or the importer. You can withdraw it at any time — in the app from Account, on the website from the account card. From that moment nothing more is sent from the website, or from the app in which you withdrew it; the app on another iPhone of yours hears of the withdrawal the next time it is brought to the front, and until then it can still send what you give it. An earlier version of the iPhone app does not ask: until we require the permission of every version, using the Eye, the Registrar or the importer in one sends what you give it, exactly as described below, and updating the app brings the question. Everything else in the register works without the AI.
The register can name a watch from a photograph. When you use that, the photograph leaves your device: it is sent to our server and passed to Anthropic, whose model reads it and proposes which reference it is. Three things are worth stating plainly:
If you would rather no photograph ever left your device, do not use the identification feature — naming a watch by hand, or typing it into the Registrar, never sends an image anywhere. Note that identification names a watch; it does not authenticate one, and nothing it returns should be treated as a judgement of whether a watch is genuine.
The magnetism check reads the phone’s own compass and gyroscope, and the optical bench its camera; both are read on the phone, and nothing from them travels except the figure filed with a reading. No image from the optical bench is kept or sent.
The Registrar answers questions about your own register, and the importer reads a collection you bring — pasted text, a spreadsheet, or photographs of a list. Both work the same way, and it is worth stating as plainly as the photographs above:
The whole register works with the AI left alone — filing by hand, the wear log, the analytics and every export involve no model at all, and nothing of yours travels to one unless you put a question to it.
We keep the list of suppliers deliberately short. Each acts as our processor, under contract, on our instructions only — except Apple, which takes the money and is not our processor at all for a purchase made in the app — it is the merchant, and it decides for itself what it does with what it holds.
| Who | What for | Where |
|---|---|---|
| Vercel | Hosting the site and running the server functions, and counting page views | United States |
| Neon | The database holding accounts and register copies | United States (us-east-1) |
| Anthropic | Reading what you put to the register’s AI — a photograph sent for identification, a question to the Registrar together with the part of your register it needs, or a collection brought to the importer. Anthropic does not use what we send it to train its models, and deletes each request within 30 days (up to two years only if its safety systems flag it); it processes the request in the United States under standard contractual clauses, and, when we last checked (9 September 2026), did not appear on the Data Privacy Framework list, so the clauses are the safeguard we rely on | United States |
| GitHub | Holding the daily encrypted database backups | United States |
| Resend | Sending the letters the register owes you — sign-in, password reset, invitations | United States |
| Receiving mail you send to our published address | United States | |
| Apple | Taking membership payments made in the iPhone app, as an independent controller rather than our processor | Per Apple's own policy |
| Apple | Optional Sign in with Apple in the iPhone app | Per Apple's own policy |
| Optional Continue with Google in the iPhone app | Per Google's own policy |
We do not sell personal data, we do not share it for advertising, and the only measurement we do is a cookieless count of page views, by our host, which never leaves them and is never joined to your account.
Our database and server functions currently run in the United States. If you are in the UK or the European Economic Area, that means your information is transferred outside your home jurisdiction. Those transfers are made under the safeguards the law provides for them: the data processing agreements we hold with Vercel and Anthropic incorporate the European Commission's standard contractual clauses together with the UK addendum, and Neon's data processing agreement is part of its terms of service.
You can ask us for details of the safeguards that apply to any particular transfer.
Your account details and, for members, your standing with the till are contractual requirements: an account cannot be opened, or a membership kept, without them.
If the UK GDPR or EU GDPR applies to you, you have the right to:
Write to the address below and we will answer within one month. You will never be charged for asking, and we will not ask you why.
If you think we have handled your data badly, please tell us first — but you are entitled to go straight to a supervisory authority. In the UK that is the Information Commissioner's Office; in the EEA it is the authority for the country you live in.
HttpOnly, Secure and SameSite=Lax; every session is checked against our own database on every request, and a suspended account stops working immediately.No system is perfect. If a breach ever affects your rights and freedoms, we will notify the supervisory authority within 72 hours of becoming aware of it, and tell you directly where the law requires it.
You can delete or block cookies in your browser's settings at any time. Deleting them signs you out and re-locks the register on that device; your account data remains safe on our servers, and your local register remains in local storage until you clear that too.
The Rotation is for adults: you must be 18 or over to open an account, and we do not knowingly collect data from anyone under 18. If you believe someone under 18 has given us their details, write to us and we will delete them.
If we change what we collect or what we do with it, we change this page first and update the date at the top; the earlier versions are kept at therotation.ai/legal/history. A change that matters to you is sent to you by email before it takes effect, rather than left here to be discovered.
Questions, requests about your data, or complaints: hello@therotation.ai. Written enquiries: Atelier Benedict Limited, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
← therotation.ai