Privacy Notice

Version 2026-08-25 · Last updated 25 August 2026

The short version

Lowen's Tides runs on WhatsApp. To join the waitlist we ask for one thing: your phone number — and we only have it because you messaged us first.

We store your number encrypted, with a note of when you agreed and what you agreed to.
While you wait, we send you one message — on the day we open, and nothing else unless you write to us first. If you later subscribe, Lowen sends only what you switch on, and you can turn it off or leave whenever you like.
Reply STOP at any time. We delete your number and never message you again.
We do not sell your data, share it for advertising, or profile you.

1. Who we are

Brewyon & Co Ltd is the data controller for the personal data described in this notice. That means we decide why and how it is used, and we are responsible for it.

Company	Brewyon & Co Ltd, registered in England and Wales
Company number	17343425
Registered office	66 Paul Street, London, England, EC2A 4NA
Data protection contact	Joshua Marsh — josh@brewyon.com
ICO registration	ZC200666

We have not appointed a Data Protection Officer, and we are not required to: none of the conditions in Article 37(1) UK GDPR applies to us. Joshua Marsh is our point of contact for anything in this notice.

2. What we collect, and why

2.1 The waitlist — before we launch

What	Why	Lawful basis
Your phone number, from WhatsApp	To send you one message when Lowen's Tides opens	Consent — Article 6(1)(a) UK GDPR, and regulation 22 PECR for the message itself
The date and time you agreed, the version of this notice you were shown, the exact wording you agreed to, and the message you sent to agree	To prove your consent was properly obtained, as Article 7(1) requires us to be able to do	Legal obligation — Article 6(1)(c)
A campaign tag from the link you clicked, if there was one	To know which posts brought people in	Legitimate interests — Article 6(1)(f)

You give consent by replying YES. Nothing is sent to you before that. Providing your number is entirely voluntary — there is no contract or legal requirement to give it, and the only consequence of not giving it is that we cannot tell you when we open. You can withdraw at any time by replying STOP, exactly as easily as you gave it.

2.2 Using Lowen — once you have access

What	Why	Lawful basis
The messages you send us — place names, dates, questions	To answer them. "Padstow tomorrow" is the request	Contract — Article 6(1)(b)
A location pin, if you choose to share one	To work out which stretch of coast you mean. We round the coordinates we store to roughly 1 km	Contract
Places you save, and your usual spot	So you don't have to type them again	Contract
A record of messages received and sent	Security, preventing abuse, and not answering a retried message twice	Legitimate interests — Article 6(1)(f)

2.2a If you subscribe

What	Why	Lawful basis
Your phone number, encrypted	So Lowen can send you the tides at the time you chose. Every other message is a reply, where WhatsApp tells us who you are; a scheduled one is the only thing we start, and we cannot start it without your number	Contract — Article 6(1)(b)
Your plan, its status and its dates	To know what you are entitled to	Contract
Stripe's customer and subscription identifiers	So a payment can be matched to an account, changed or cancelled	Contract
Your email address, held by Stripe, not by us	Receipts, and so we can reach you about your subscription if WhatsApp is ever unavailable	Contract
Who referred you, and any bonus days	To honour "give a month, get a month"	Contract
Your delivery choices, daily or weekly, the day, the time, and your usual spot	So the tides arrive when and where you asked	Contract
A holiday spot and dates, if you set them	So Lowen follows you for the week. They stay until you clear them or your subscription ends	Contract
Your personal share code and how often it has been used	To run "give a month, get a month" from your side too	Contract

We never see or store your card details. Payment is handled entirely by Stripe.

If you buy a gift year for someone else: Stripe processes your payment and holds your email, as above; we hold only the gift code you're given, the reference for the payment that bought it, and once it is redeemed, the recipient's subscription. We learn nothing about the recipient until they message Lowen themselves, and nothing about you beyond the purchase. We never ask you for your name, date of birth or home address. We do not need them.

2.3 If you opt out

When you reply STOP we delete your waitlist entry, but we keep one thing: a scrambled one-way marker derived from your number, with the date. That is how we know never to contact you again. We are required to honour an opt-out, and we cannot do that with no record of who opted out. It holds no number, no message content and nothing else, and we keep it indefinitely. This is permitted by Article 17(3)(b) UK GDPR.

2.4 What we do not do

We do not sell or rent your data. Ever.
We do not share it with advertisers or data brokers.
We do not build advertising profiles.
We make no automated decisions about you, and do no profiling, of any kind.
We do not track you across other websites or apps.

3. How your phone number is protected — and an honest word about "anonymous"

Your number is the only identifying thing we hold, so we treat it accordingly:

On the waitlist, it is encrypted at rest using AES-256-GCM. The key is held separately from the database, so a copied database yields unreadable numbers.
Elsewhere in the service, we mostly don't store the number itself. We store a keyed scrambled version of it (an HMAC-SHA-256) which lets us recognise you across messages.
There is one exception, and it is if you subscribe. Lowen sends you a digest at a time you chose, which means reaching you when you have not just written to us, and you cannot send a message to a scrambled version. So a subscriber's number is kept encrypted with the same AES-256-GCM as the waitlist, read only by the job that sends the digest, and erased the moment you reply STOP.
Your private tide page is reached by a secret link. We store only a scrambled version of its token, never the token.

We want to be straight with you about what that second point does and doesn't mean. The scrambled version is not anonymous. We hold the key, so we can always work back to you — which means UK law treats it as your personal data just like the number itself, and so do we. It is a security measure, not a way of putting your data outside your control. All your rights below apply to it in full.

4. Who else is involved

We use a small number of service providers. They process data on our instructions under written contracts meeting Article 28 UK GDPR, except where noted.

Provider	What they do	Where
Meta Platforms Ireland Ltd (WhatsApp)	Carries the messages. Meta also processes data about your use of WhatsApp under its own privacy policy, as a separate controller — we do not control that, and we'd encourage you to read it	Ireland
Stripe Payments Europe Ltd	Takes payment and holds your email address for receipts and subscription notices. We never see your card details	Ireland, with sub-processors in the United States
Vercel	Runs the service	London (UK)
Supabase	Database	European Union
OpenAI	Turns text into speech, only if you ask for a shipping-forecast voicenote. Receives the forecast text. Does not receive your number	United States
UKHO Admiralty, Open-Meteo, Environment Agency, Ordnance Survey	Supply tide, weather, water-quality and place data. They receive a place name or a coordinate — never your number, and nothing that identifies you	UK / EU

Transfers outside the UK. Where a provider processes data outside the UK we rely on UK adequacy regulations where they apply (including the UK Extension to the EU–US Data Privacy Framework), and otherwise on the International Data Transfer Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment on file. You can ask us for a copy of the safeguards in place.

We will also disclose data where we are legally required to — a court order, or a lawful request from a regulator or the police.

5. How long we keep things

Data	Kept for
Waitlist entry, never confirmed	90 days, then deleted automatically
Waitlist entry, confirmed, before we launch	Until we launch and message you — and in any case no more than 18 months, after which we delete it rather than message you on stale consent
Waitlist entry, after we have sent the launch message	12 months, so we can answer any complaint about that message, then deleted
Waitlist entry, where you were let in by an invite or gift code	Kept while your subscription lasts, because it records how you joined, then 24 months after it ends
Waitlist entry, after you reply STOP	Deleted immediately
Opt-out marker (section 2.3)	Indefinitely — it is what stops us contacting you again
Message records	12 months
Favourites and settings	Until you delete them, or 24 months after you last use the service
Subscription and payment records	While your subscription is active, then 24 months — the record that someone paid us carries tax and consumer-law duties of its own
A trial that never became a subscription	24 months from its end — long enough that a used trial is remembered, and no longer
Delivery settings, milestone history, your share code	Deleted with your subscription
Cached tide, weather and place data	Contains nothing about you; kept while it is useful

6. Your rights

Under UK GDPR you have the right to:

Be told what we hold about you and why — this notice
Get a copy of it (a subject access request)
Correct anything wrong
Have it deleted — the "right to be forgotten"
Restrict or object to how we use it
Take it elsewhere in a portable format
Withdraw consent at any time, without affecting anything we did beforehand

The quickest way to exercise most of these is to reply STOP in WhatsApp — that deletes your waitlist entry immediately. For anything else, email josh@brewyon.com. We respond within one month, free of charge. If your request is complex we may extend that by up to two further months, and we will tell you if so.

7. How to complain

Complain to us first, if you're willing — we would rather fix it. Email josh@brewyon.com with "Data protection complaint" in the subject line, or reply to Lowen on WhatsApp with the word COMPLAINT and we will pick it up. You don't need to use any particular form of words.

We will acknowledge your complaint within 30 days and respond as quickly as we can after that.

You can also complain to the regulator at any time, whether or not you come to us first. The Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

8. Children

Lowen's Tides is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has joined the waitlist, email us and we will delete the entry.

9. The website

Our website sets no cookies and uses no analytics or tracking. Fonts, images and everything else are served from our own domain, so loading a page contacts no third party at all.

10. Changes to this notice

If we change anything material we will update the version number at the top and, where the change affects what you consented to, ask you again. Previous versions are available on request.

11. Safety, and what this service is not

Lowen's Tides is for general information. Conditions at sea change fast, our data comes from third parties and can be wrong, delayed or missing, and it must not be used for navigation or relied on for safety. Always check official sources and use your own judgement. In an emergency at sea, call 999 and ask for the Coastguard.