The Rotation is a private register for watch collectors, operated at therotation.ai by Atelier Benedict Limited, a company registered in England and Wales under number 17110936, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Atelier Benedict Limited is the data controller for the information described here, and is registered with the Information Commissioner's Office under number ZC113531.
This notice explains what we hold, why we hold it, who else touches it, where it lives, how long it stays and what you can make us do about it. The short version: we collect little, we sell none of it, and there are no advertising cookies or third-party marketing technology anywhere on this site. We count page views, with no cookie and nothing that identifies you.
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Account identity | Your email address and name, received from your sign-in provider, so the register knows whose it is. | Performance of a contract | Until you close the account |
| Your register | The watches you file — references, serial numbers, photographs, what you paid, what you wear and when. This is the service. | Performance of a contract | Until you delete it or close the account |
| The watch’s voice | When the bench listens to a watch, the last twenty seconds of what the microphone heard can be kept with the reading, so the watch can be heard again from its own record. Recorded only while you listen and only if you keep it; the room’s other sounds are in it too. It stays in your account, is deleted with the reading, the watch or the account, and is never sent to a model or to anyone. Do not record where anyone is speaking: a voice in the recording is that person’s own information, and you are responsible for having their agreement. | Performance of a contract | Until you remove it or close the account |
| The catalogue’s photographs | When you file a watch or a wish without a photograph of your own, its brand, model and reference are sent to the house, and the shelf hands back its own picture of that reference when it has one — a copy the house keeps of the maker’s product photograph, taken from the maker’s own website. Where the Registrar’s card names a picture or a page for the reference, the house may fetch that picture on your behalf — the picture the card names, or the one its page presents as its own — and from nowhere else. Nothing else travels; no model is asked and nothing is counted against your allowance. The picture then lives in your register like any photograph you added, and leaves with it. | Performance of a contract | Until you remove it or close the account |
| Cards in issue | When you draw a card for one watch, the details you chose to show — and the photograph, if you included it — are held so that the address can be opened. What you paid is never among them, and no part of your wear log travels with it. We also count how many times the address was opened, and when. | Performance of a contract | Until the card closes or you withdraw it, then deleted |
| Membership billing | The standing of your membership — plan, status, renewal date — and the identifiers the till assigns: a customer and subscription identifier from Stripe for a membership taken on this website, or Apple's own transaction and subscription identifiers for one taken in the iPhone app. Card details go to Stripe or to Apple directly and never reach us. | Performance of a contract | While the membership stands; deleted when the account closes |
| Waiting list | Name, email, city and country, so we can write to you about membership. | Consent | Until you ask to come off, or 24 months after the list closes |
| IP address | Counted against the password gate and the waiting-list form to stop automated abuse, and kept with the keeper’s own sign-in session while that session stands. Each member sign-in is noted too, by its address beside a one-way fingerprint of the email address tried; only a failed one is counted, so that guesses at one account can be slowed without slowing everyone else on the same network. Never linked to your register. | Legitimate interests (security) | 7 days |
| Identification records | What the model proposed from a photograph and whether you accepted it, so identification improves. The photograph itself is never stored. | Legitimate interests (improving the service) | Unlinked from you after 12 months; the anonymous outcome is kept |
| Cookies | Keeping you signed in, and remembering the collector’s entrance — the keeper’s own door. | Strictly necessary | Up to 30 days |
We do not profile you, we make no automated decisions that produce legal or similarly significant effects, and we do not use your register to advertise anything to you.
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
| rotation_session | Keeps you signed in to your account after you log in with email or a social provider. Without it, the register cannot recognise you. | Strictly necessary | Up to 30 days |
| rotation_key | Remembers that the keeper’s entrance was opened with its password. Used only by that door. | Strictly necessary | Up to 30 days |
Both cookies are first-party, HttpOnly, Secure and SameSite=Lax — a script on the page cannot read them, they travel only over encrypted connections, and they are not sent from other sites. They contain a session identifier: never your password, and nothing that tracks you across other websites.
Because every cookie we set is strictly necessary for the service you asked for, no consent banner is required — there is nothing optional to consent to. If we ever introduce optional cookies, this notice will change first and you will be asked properly.
Sign-in with Google or Apple is not offered at present; if it is, this notice changes first. Were you to sign in with a social provider, that provider would set its own cookies on its own domain during the sign-in step, under its own policies — see Google's cookie policy and Apple's privacy policy. We receive only your basic account identity (email, name) to create your register; we do not read or set cookies on their domains beyond that sign-in flow.
Membership payments are taken by Stripe where you join on this website, and by Apple where you join in the iPhone app. Taking the website first: the checkout and the billing portal are pages on Stripe's own domain: your card details are entered there, go to Stripe directly, and never touch our servers — this site loads no Stripe script at all. While you are on Stripe's pages, Stripe sets its own cookies under Stripe's privacy policy. We give Stripe your email address and name, so the checkout and its receipts know who is paying; what comes back to us is only the standing of your membership — which plan, whether it is trialing, active or cancelled, and when it renews — filed against the identifiers Stripe assigns. We hold no card numbers, and cannot see any.
A membership bought in the iPhone app is bought from Apple instead, under your Apple ID and inside Apple's own purchase sheet. We never see the card, and Apple does not give us your Apple ID, your name or your payment details: what reaches us is a signed receipt naming the product, the term, and whether it stands — filed against Apple's own transaction identifiers and against the account you are signed in to here. Apple handles that purchase under Apple's privacy policy, as an independent controller for it, and it is not a processor acting on our instructions.
Closing your account cancels any subscription at Stripe and deletes our billing record of it. Stripe itself keeps the transaction records that financial law requires it to keep.
An App Store subscription is the one thing closing your account cannot end. It is held by Apple under your Apple ID rather than by us, and it goes on being charged after the account and everything in it are gone. Only you can stop it, in Settings → your name → Subscriptions, and it is worth doing that first; the closing screen says so too. We delete our record of it either way.
If you leave your address with us, we store the name, email, city and country you give us, and the date you asked. We use them for one thing: to write to you about The Rotation. We do not add you to any other list, and we do not pass the list to anyone.
Asking twice updates your details and keeps your original date. You can ask us to remove you at any time, by writing to the address at the foot of this page — that is also how you withdraw consent, and it costs you nothing to do so.
Your register — watches, wear history, wishlist, preferences — is stored on your own device — the browser’s local storage, or the iPhone app’s own store — so the register works instantly and offline. If you are signed in, a copy is also kept on our servers so your register follows you across devices. A small preference (your clock timezone) is stored the same way. Local storage is not sent to anyone else and never used for tracking. The same exemption that covers our cookies covers it: it exists only to deliver the service you asked for.
To be precise about that server copy, because the word is often used loosely: it travels over TLS and is encrypted at rest by our database provider, on encrypted volumes with encrypted backups. It is not end-to-end encrypted — we hold the keys, which means our systems could in principle read it, and it means we can restore your register if you lose your device. If you would rather nothing left your device at all, use the register signed out: local-first is the default, and the server copy only exists once you have an account.
Two further copies exist so that the server copy can survive a mistake — ours or yours. Each time your register is saved to the server, the version it replaces is kept for thirty days, which lets us put your register back as it stood at any point in the last month if something goes wrong; write to the address below and we will do it. Those versions hold the register’s document — the records themselves — and not the photographs and recordings kept beside it, so a picture or a voice you replaced or removed is not brought back by them. And once a day an encrypted copy of the whole database is taken and held, off the premises, for thirty days — insurance against losing the database itself. Those copies are encrypted with a key held separately before they leave, and they are used for nothing except restoration.
The register can name a watch from a photograph. When you use that, the photograph leaves your device: it is sent to our server and passed to Anthropic, whose model reads it and proposes which reference it is. Three things are worth stating plainly:
If you would rather no photograph ever left your device, do not use the identification feature — naming a watch by hand, or typing it into the Registrar, never sends an image anywhere. Note that identification names a watch; it does not authenticate one, and nothing it returns should be treated as a judgement of whether a watch is genuine.
The magnetism check reads the phone’s own compass and gyroscope, and the optical bench its camera; both are read on the phone, and nothing from them travels except the figure filed with a reading. No image from the optical bench is kept or sent.
The Registrar answers questions about your own register, and the importer reads a collection you bring — pasted text, a spreadsheet, or photographs of a list. Both work the same way, and it is worth stating as plainly as the photographs above:
The whole register works with the AI left alone — filing by hand, the wear log, the analytics and every export involve no model at all, and nothing of yours travels to one unless you put a question to it.
We keep the list of suppliers deliberately short. Each acts as our processor, under contract, on our instructions only — except for the two that take money. Stripe, like any payment institution, also acts as an independent controller for the fraud-prevention and record-keeping duties the law places on it directly; and Apple is not our processor at all for a purchase made in the app — it is the merchant, and it decides for itself what it does with what it holds.
| Who | What for | Where |
|---|---|---|
| Vercel | Hosting the site and running the server functions, and counting page views | United States |
| Neon | The database holding accounts and register copies | United States (us-east-1) |
| Anthropic | Reading what you put to the register’s AI — a photograph sent for identification, a question to the Registrar together with the part of your register it needs, or a collection brought to the importer. Anthropic does not use what we send it to train its models; it processes the request in the United States under standard contractual clauses, and, when we last checked (9 September 2026), did not appear on the Data Privacy Framework list, so the clauses are the safeguard we rely on | United States |
| GitHub | Holding the daily encrypted database backups | United States |
| Resend | Sending the letters the register owes you — sign-in, password reset, invitations | United States |
| Receiving mail you send to our published address | United States | |
| Stripe | Taking membership payments for the website, and hosting its checkout and billing pages | United States |
| Apple | Taking membership payments made in the iPhone app, as an independent controller rather than our processor | Per Apple's own policy |
| Google / Apple | Sign-in, only if you choose that route | Per their own policies |
We do not sell personal data, we do not share it for advertising, and the only measurement we do is a cookieless count of page views, by our host, which never leaves them and is never joined to your account.
Our database and server functions currently run in the United States. If you are in the UK or the European Economic Area, that means your information is transferred outside your home jurisdiction. Those transfers are made under the safeguards the law provides for them: the data processing agreements we hold with Vercel and Anthropic incorporate the European Commission's standard contractual clauses together with the UK addendum, Neon's data processing agreement is part of its terms of service, and Stripe holds an active certification under the EU–US Data Privacy Framework and its UK Extension, with standard contractual clauses standing behind it in its agreement.
You can ask us for details of the safeguards that apply to any particular transfer.
Your account details and, for members, your standing with the till are contractual requirements: an account cannot be opened, or a membership kept, without them.
If the UK GDPR or EU GDPR applies to you, you have the right to:
Write to the address below and we will answer within one month. You will never be charged for asking, and we will not ask you why.
If you think we have handled your data badly, please tell us first — but you are entitled to go straight to a supervisory authority. In the UK that is the Information Commissioner's Office; in the EEA it is the authority for the country you live in.
HttpOnly, Secure and SameSite=Lax; every session is checked against our own database on every request, and a suspended account stops working immediately.No system is perfect. If a breach ever affects your rights and freedoms, we will notify the supervisory authority within 72 hours of becoming aware of it, and tell you directly where the law requires it.
You can delete or block cookies in your browser's settings at any time. Deleting them signs you out and re-locks the register on that device; your account data remains safe on our servers, and your local register remains in local storage until you clear that too.
The Rotation is not intended for children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us their details, write to us and we will remove them.
If we change what we collect or what we do with it, we will change this page first and update the date at the top. Material changes will be put in front of you in the app rather than left here to be discovered.
Questions, requests about your data, or complaints: hello@therotation.ai. Written enquiries: Atelier Benedict Limited, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
← therotation.ai