In short
- If you found something and are sending a message: we need your message, a short description of what you found, and your email address. Your email is how the owner's replies reach you and how the two of you arrange the return. We pass what you write to the owner, but the owner never sees your email address, and only learns your name or any other way of reaching you if you put it in a message yourself.
- If you own a tagged item: we hold your email address, what you have called your items, and the messages in your recovery cases. Your item label is private and is never shown to a finder.
- We never sell personal information. If you consent to advertising cookies, Meta uses information about your visit to measure our ads and to show you ReturnMePlz ads on its own platforms. If you say no, none of that happens.
- If you use our contact form: your message is emailed to us and stored nowhere else. Your name is optional, and nothing about your visit is logged unless the message is refused as abuse.
- We use cookies. The ones that are not essential only load if you say yes. See the Cookie Policy.
The rest of this page is the detail, including the things the law requires us to tell you.
1. Who is responsible for your information
ReturnMePlz is a UK sole trader business, and is the data controller for the personal information described here. The registered controller details sit on the ICO's public register against the registration reference in the table below.
| Controller | ReturnMePlz, a UK sole trader business |
|---|---|
| Address | Lytchett House, 13 Freeland Park, Wareham Rd, Poole, Dorset BH16 6FA |
| Email for privacy questions | info@returnmeplz.com |
| ICO registration reference | ZC239452 |
ReturnMePlz, a UK sole trader business
Lytchett House, 13 Freeland Park, Wareham Rd, Poole, Dorset BH16 6FA
ZC239452
We are not required to appoint a Data Protection Officer, and we have not appointed one. Privacy questions go to the address above and are handled by the Founder.
2. If you found something and want to send a message
This section is for finders. It is the part most people reading this page need.
What we collect
| What | Required? | Why |
|---|---|---|
| Your message to the owner | Yes | It is the whole point: we cannot pass on a message we do not have |
| A short description of what you found | Yes | So the owner can check the item really is theirs, and so a false claim can be spotted |
| Your email address | Yes | It is how the owner's replies reach you and how the return gets arranged: we email you when the owner writes back. The owner never sees it |
| Your name | No, optional | Only if you want the owner to know who to thank |
| The fact that a tag was scanned, and when | Collected automatically | To run the service and to detect abuse |
| Technical information about your visit, IP address, browser type, approximate region | Collected automatically | Security, rate-limiting and preventing people from trawling our codes |
- Required?
- Yes
- Why
- It is the whole point: we cannot pass on a message we do not have
- Required?
- Yes
- Why
- So the owner can check the item really is theirs, and so a false claim can be spotted
- Required?
- Yes
- Why
- It is how the owner's replies reach you and how the return gets arranged: we email you when the owner writes back. The owner never sees it
- Required?
- No, optional
- Why
- Only if you want the owner to know who to thank
- Required?
- Collected automatically
- Why
- To run the service and to detect abuse
- Required?
- Collected automatically
- Why
- Security, rate-limiting and preventing people from trawling our codes
What we do not collect. We do not collect your precise location. We do not track you across other websites. We do not ask you to create an account, and we do not build a profile of you.
Our legal basis. We rely on legitimate interests (UK GDPR Article 6(1)(f)). Our legitimate interest is running a service that gets lost belongings back to the people who lost them, and keeping that service safe from abuse. We have weighed that against your interests and concluded it is fair, because you came to the page voluntarily, we ask for the minimum, and we do not use your information for anything except the recovery you started. The one contact detail we require, your email address, is there so the owner's replies can reach you, and it is never shown to the owner. We keep a written record of that assessment and you can ask us for a summary of it.
Because we rely on legitimate interests, you have the right to object to us processing your information, see section 10. You can object at any time by emailing info@returnmeplz.com.
Who sees what. The owner sees your messages, your description of the item and, if the item has a public note, whether you said it matches what you found. The owner never sees your email address: we use it to email you when the owner replies or the return moves on. The owner learns your name, or any other way of reaching you, only if you write it into a message yourself. The owner does not see your IP address or any technical data. We do not publish anything you send.
3. If you own tagged items
What we collect
- Your email address, and a one-time code sent to it, to sign you in. We do not store a password.
- Your item information: the private label you give an item, an optional public note, an optional message to a finder, an optional reward note, a category and an estimated value if you enter one.
- Your tag and pack codes, and which of them are yours.
- A household or family name, if you activate a retail pack and choose to use one.
- Your recovery cases: the messages between you and a finder, the stage the case has reached, and the notification emails we have sent about it.
- A delivery address, only if you choose to share one with a finder for a postal return. See section 4.
- A phone number, only if you give us one for future notification options. We do not use it today.
What we do not collect. We do not hold your card or payment details: purchases go through our shop's payment provider and we only ever see the order, never the card. We do not collect photographs of items in this version of the service.
Your private item label is private. It is shown to you, never to a finder. Any public note is separate, optional, and empty unless you deliberately write one. We do this because item labels often contain a child's name, and a stranger who finds an item should not learn it.
Our legal basis. Mostly contract (Article 6(1)(b)), you have bought a tag and asked us to run the recovery service for it, and we cannot do that without this information. For keeping the service secure, preventing abuse and understanding how the service is used in aggregate, we rely on legitimate interests (Article 6(1)(f)). For non-essential cookies and any marketing emails, we rely on your consent (Article 6(1)(a)), which you can withdraw at any time.
Providing your email address is a requirement of the contract, without it there is no way to tell you that somebody has found your item, so we cannot provide the service.
4. Sharing an address for a postal return
If you and a finder agree that an item will be posted, you can share a delivery address through a structured form. We treat this with particular care:
- It is your choice. You are never required to share an address, and there are always other options, a meeting, or leaving the item somewhere safe.
- The address is shown only inside the conversation, only to the finder in that case.
- It is never included in any email we send, and never appears in a notification preview.
- We warn you at seven days and delete it automatically at ten days, or as soon as the item is marked received, whichever comes first. Deletion removes it from the live service; it is held briefly in encrypted system backups while those rotate, and is not accessible to anyone in ordinary use.
Please use the address form rather than typing an address into a message. An address typed into free text is just a message: it has none of these protections, and we cannot remove it from the other person's inbox.
Legal basis: contract, and your explicit choice to disclose.
5. If you buy from our shop
Our shop runs on Shopify, and Shopify processes your order on our behalf: your name, delivery and billing address, email, phone if you give one, order contents and delivery status. Payment is handled by Shopify's payment provider: we never see or store your card details.
Legal basis: contract, for taking and fulfilling your order; legal obligation (Article 6(1)(c)), for keeping tax and accounting records; consent, for marketing emails.
Shopify's own privacy notice explains what it does as a business in its own right: https://www.shopify.com/legal/privacy
6. If you use our contact form
The form at returnmeplz.com/contact is how you reach us about anything: a complaint, a privacy request, a safety report, a question about a product or a tag, something you have found, a recovery story, or working with us.
What we collect
| What | Required? | Why |
|---|---|---|
| What your message is about | Yes | It routes your message to the right place and starts the right clock. Complaints, privacy requests and safety reports have published response times |
| Your email address | Yes | It is the only way we can reply to you |
| Your name | No, optional | A complaint does not need a name. Leave it blank if you would rather |
| Your message, up to 5,000 characters | Yes | It is what you are telling us |
| Your IP address | Collected automatically | Only to keep the form from being abused. See below |
- Required?
- Yes
- Why
- It routes your message to the right place and starts the right clock. Complaints, privacy requests and safety reports have published response times
- Required?
- Yes
- Why
- It is the only way we can reply to you
- Required?
- No, optional
- Why
- A complaint does not need a name. Leave it blank if you would rather
- Required?
- Yes
- Why
- It is what you are telling us
- Required?
- Collected automatically
- Why
- Only to keep the form from being abused. See below
Where your message goes. Straight to our inbox, as an email, and nowhere else. We do not store contact form messages in any database, file or log of our own. There is no record of your message except the email itself. We reply from info@returnmeplz.com, the same address you can always reach us on.
Your IP address, and why we do not keep it. The form is open to anyone, with no account and no sign-in, so it has to be protected from automated abuse. Your IP address is used at the moment you press send, to limit how many messages can come from one place and to notice the same message arriving twice. That check lives in the memory of the server handling your request, expires within an hour, and is never written to a database.
If a message is refused, because it hits that limit or looks automated, your IP address appears in our hosting provider's runtime log, and those logs are discarded automatically within 24 hours. Nothing is logged when a message goes through. We do not record your browser, your device or anything else about your visit.
We will not publish what you send. If you send us a recovery story, we will not publish it, or any part of it, or your name, without asking you first and getting your answer.
Our legal basis depends on why you are writing:
- Legal obligation (Article 6(1)(c)) for a privacy request or a data protection complaint. We are required to receive these and act on them.
- Contract (Article 6(1)(b)) where your message is about an order you have placed with us.
- Legitimate interests (Article 6(1)(f)) for everything else: replying to people who get in touch, and keeping the form working by keeping automated abuse off it. You can object to this, see section 10.
How long it lasts is in section 9, along with everything else.
7. Emails we send
- Service emails, a sign-in code, a "someone has found your item" alert, a nudge when a case has gone quiet, a case update, an order confirmation. These are part of the service and we send them because you are using it. You cannot opt out of them while you have an active tag or an open case, though you can close your account.
- Marketing emails, only if you have asked for them. Every one has an unsubscribe link and we act on it.
We deliberately keep case details out of email subject lines and previews where they could reveal something personal on a lock screen.
8. Who else handles your information
Providers who act only on our instructions. These process personal information for us, under contract, and only to run ReturnMePlz.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database and sign-in | Ireland (EU) |
| Vercel | Website hosting, running our contact form, and scheduled jobs | Ireland (EU) |
| Resend | Sending our emails | Ireland (EU) |
| SnapAddress | UK postcode-to-address lookup, when you use "Find address" | UK |
| Google (Workspace) | Hosts our info@returnmeplz.com mailbox. Every message you send us, and every reply we send, sits in that account | United States and other countries |
- What they do
- Database and sign-in
- Where
- Ireland (EU)
- What they do
- Website hosting, running our contact form, and scheduled jobs
- Where
- Ireland (EU)
- What they do
- Sending our emails
- Where
- Ireland (EU)
- What they do
- UK postcode-to-address lookup, when you use "Find address"
- Where
- UK
- What they do
- Hosts our info@returnmeplz.com mailbox. Every message you send us, and every reply we send, sits in that account
- Where
- United States and other countries
Google appears in both of these tables, in two different roles. As our email host it acts only on our instructions, which is the row above. As the provider of website analytics it is something else, which is the row below. The two are separate services and separate agreements.
Companies that also use the information for their own purposes. These are not simply acting for us, so their own privacy terms apply alongside ours.
| Company | What they do | Where |
|---|---|---|
| Shopify | Runs our shop and processes orders and payments, and also operates its platform as a business in its own right | Canada and the United States |
| Website analytics, only if you consent. Google is a controller for parts of this | United States and other countries | |
| Meta | Advertising measurement and retargeting, only if you consent. Meta and we are joint controllers for pixel data, and Meta uses it for its own purposes too | United States and other countries |
- What they do
- Runs our shop and processes orders and payments, and also operates its platform as a business in its own right
- Where
- Canada and the United States
- What they do
- Website analytics, only if you consent. Google is a controller for parts of this
- Where
- United States and other countries
- What they do
- Advertising measurement and retargeting, only if you consent. Meta and we are joint controllers for pixel data, and Meta uses it for its own purposes too
- Where
- United States and other countries
We also disclose information where the law requires it, or where it is necessary to report a crime, protect somebody from harm, or establish or defend a legal claim.
We do not sell personal information, and we do not share it with data brokers.
International transfers. Some of these companies process data outside the UK. Transfers to Ireland and the rest of the EEA rely on the UK's adequacy regulations for the EEA. Transfers to Google and Meta in the United States rely on the UK Extension to the EU-US Data Privacy Framework. Anywhere else, we rely on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with appropriate safeguards. Ask us at info@returnmeplz.com for details.
9. How long we keep things
Your tags keep working; the personal detail inside old cases does not stick around. These are two different things and we treat them differently. The link between your tag and your recovery page lasts as long as your account does, because a tag that stopped resolving would be useless. The messages, contact details and addresses inside a recovery case are deleted on the timetable below, because there is no good reason to keep a stranger's message about a lost water bottle for years.
| Information | How long |
|---|---|
| The link between your tag, your item and your account | While your account is open. This is what keeps your tags working |
| Owner account and item data | While your account is open, then 30 days after you close it |
| Recovery case messages and the finder's item description | 12 months after the case is closed |
| Finder contact details, where the finder gave any | 90 days after the case is closed |
| A shared delivery address | 10 days, or sooner if the item is marked received |
| Scan and security logs | 12 months |
| Order and tax records | 6 years from the end of the relevant tax year (HMRC requirement) |
| Marketing consents | Until you unsubscribe, then a record that you did |
| Reports of illegal content and what we did | 3 years, so that we can show we handled them properly |
| Complaints and how we resolved them | 3 years |
| A message you sent through the contact form | It lives in our email inbox and nowhere else. 12 months, or 3 years if it is a complaint or a safety report, matching the two rows above |
| The abuse check on a contact form message | In the server's memory only, expires within 1 hour. Never written to a database |
| The runtime log entry for a refused contact form message | Discarded automatically within 24 hours. Nothing is logged for a message that goes through |
- How long
- While your account is open. This is what keeps your tags working
- How long
- While your account is open, then 30 days after you close it
- How long
- 12 months after the case is closed
- How long
- 90 days after the case is closed
- How long
- 10 days, or sooner if the item is marked received
- How long
- 12 months
- How long
- 6 years from the end of the relevant tax year (HMRC requirement)
- How long
- Until you unsubscribe, then a record that you did
- How long
- 3 years, so that we can show we handled them properly
- How long
- 3 years
- How long
- It lives in our email inbox and nowhere else. 12 months, or 3 years if it is a complaint or a safety report, matching the two rows above
- How long
- In the server's memory only, expires within 1 hour. Never written to a database
- How long
- Discarded automatically within 24 hours. Nothing is logged for a message that goes through
Our email provider keeps its own copy for a while. Resend, which sends our email for us, retains the content and delivery record of a message for 30 days and then deletes it. That applies to contact form messages and to the service emails in section 7.
When a retention period ends we delete the information, or anonymise it so it can no longer identify anybody. Deletion removes it from the live service; it is held briefly in encrypted system backups while those rotate, and is not accessible to anyone in ordinary use.
You do not have to wait for these periods. You can ask us to delete a closed case at any time: see section 10.
10. Your rights
Under UK data protection law you have the right to:
- be told how we use your information, this page;
- get a copy of the information we hold about you;
- have it corrected if it is wrong;
- have it deleted in certain circumstances;
- restrict how we use it while a concern is being resolved;
- object to our using it where we rely on legitimate interests, including everything in section 2. If you object, we will stop unless we can show compelling legitimate grounds that override your interests, or we need it for legal claims;
- portability, receive information you gave us in a machine-readable form;
- withdraw consent at any time, where consent is what we relied on;
- object to direct marketing at any time, and we must stop.
To exercise any of these, email info@returnmeplz.com. We will respond within one month. We can extend that by up to two further months for a complex request, and if we need to we will tell you within the first month and explain why. There is no charge unless a request is manifestly unfounded or excessive.
11. Complaining
Complain to us first if you can. Email info@returnmeplz.com, or use the form at returnmeplz.com/contact. We will acknowledge your complaint within 30 days, look into it, keep you posted, and tell you the outcome. Our Complaints Policy has the full process.
Or complain to the regulator. You can complain to the Information Commissioner's Office at any time, whether or not you have come to us first.
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · https://ico.org.uk/make-a-complaint/
12. Children
ReturnMePlz accounts are for adults, and you must be 18 or over to buy a tag, hold an account or activate a tag.
The recovery page is different: anyone who finds a tagged item can use it, and that may include a child who has found a classmate's lost bottle. If you are a child sending a message to an owner:
- Just say what you found and where. We do not need your name or your phone number.
- We do need an email address, because that is how the owner's reply reaches you. The owner never sees it. It is best to ask a parent, a teacher or another adult you trust to send the message using their email address, so they can help arrange the return.
- We only keep what you type, so please do not include your address or your school.
- Do not agree to meet an adult you do not know. Give the item to a teacher, a parent or another adult you trust, and let them sort it out.
Parents and guardians: if you believe your child has sent us information you would rather we did not hold, email info@returnmeplz.com and we will delete it.
13. Security
We keep personal information on access-controlled systems, encrypted in transit. Recovery pages and conversations are reachable only through long, unguessable codes and tokens, and we rate-limit them so they cannot be trawled. Sign-in is by one-time code rather than a password. Our database is configured so that item and owner data cannot be read by the public web, only by our own server. Owner details are never sent to a finder's browser.
No system is perfectly secure. If a breach happens that is likely to put your rights at risk, we will tell you and, where required, the ICO.
14. Automated decisions
We do not make decisions about you by automated means that produce legal or similarly significant effects.
We do use automated rate-limiting to stop our recovery pages being trawled. If it blocks you by mistake, email info@returnmeplz.com and a person will look at it.
We do not build profiles of you ourselves. If you consent to advertising cookies, Meta builds its own profile using information about your visit, and that is described in the Cookie Policy.
15. Cookies
See the Cookie Policy.
16. Changes to this policy
We will update this page when what we do changes. The date at the top is always the date of the current version. If a change is significant, we will tell account holders by email.
ReturnMePlz · Lytchett House, 13 Freeland Park, Wareham Rd, Poole, Dorset BH16 6FA · info@returnmeplz.com