Four questions to apply.Nothing hidden.

Portal Media Group Ltd, company number 15224555, of 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, is the controller of the personal data described here. Write to [email protected] about anything on this page.

We have not appointed a Data Protection Officer, and we are not required to. We are not a public authority; we do not process criminal offence data or special category data; and our core activity is not the large-scale, regular and systematic monitoring of people. If what PortalBunny does changes, we will take that decision again. The address above is a privacy contact, not a Data Protection Officer.

What you send us in an application:

• Whether you are applying as a creator or as a brand.
• Your name, or the company’s name.
• A link. A creator gives one main profile. A company gives its website, its main social account, or both — either one is enough.
• Your email address. It is how we answer an application — our Telegram address is in the footer if you would rather reach us, but applications are answered by email.
• Your confirmation that you are 18 or over. We store the fact that you confirmed it. We do not ask for a date of birth and do not hold one.
• Whether you ticked the box asking for occasional updates. If you did, we also store the exact sentence you were shown, the date and time, and the version of the form — so what you agreed to can be shown back to you.

And what we attach to it ourselves: a reference for the application, a private key that lets whoever applied open their own entry and nobody else, its status, the language of the form, which version of the form was used, which version of the terms you agreed to when you sent it and the exact sentence that said so, and the times it was created and last changed.

Nothing is written to your device unless you allow it. The site sets no cookies of its own, keeps nothing in local storage and carries no advertising or tracking pixels. The only cookies here are the analytics ones described in section 09, and they are not set unless you accept them. The fonts are served from our own domain, so opening a page makes no request to any third party beyond that.

Our server keeps an ordinary access log, which records IP addresses along with the pages requested.

Every purpose we have, and the ground each one actually stands on:

Reading an application from a creator, and replying to it

Steps taken at your own request before any contract — Art. 6(1)(b).

Reading an application from a company, and replying to it — including the business contact details of whoever sent it

Our legitimate interest in assessing and speaking to prospective business partners — Art. 6(1)(f). The contract in prospect would be with the company, not with the person who filled the form, so their details do not rest on 6(1)(b).

Running the site, keeping it secure and working out what went wrong when something does — including the server logs that requires

Our legitimate interest in a service that stays available and can be examined after an incident — Art. 6(1)(f). It is a narrow interest: the log is read when something breaks or is abused. It is not read to build a picture of anybody, and nothing in it is joined to an application.

Remembering the answer you gave about analytics

A strictly necessary cookie, used only to remember your privacy choice, so that we do not have to ask again on every page. It holds nothing but your answer. Analytics itself stays off unless you accept it.

Sending you occasional updates, if you asked us to

Your consent, given by ticking a box that starts empty — Art. 6(1)(a).

Measuring how the site is used, through Google Analytics 4, if you accepted analytics

Your consent, given on the banner — Art. 6(1)(a), and reg. 6 of PECR for the cookies themselves.

Keeping a limited record after an application has been declined or has closed

Our legitimate interest in knowing what we decided, not reviewing the same application twice, and being able to answer if you come back to us or disagree with the outcome — Art. 6(1)(f). How long that lasts is in section 08.

If you reject analytics, PortalBunny carries on working normally. We still process the limited information needed to deliver the site, keep it secure and remember your privacy choice — that much happens for every visitor, and it is the first four rows above. What stops is the measuring.

Nobody has to apply. If you do, every field except a company’s second link and the updates box is needed to review the application; without them there is nothing for us to look at, and no address to answer.

PortalBunny is intended for people aged 18 and over. We do not knowingly collect applications from anyone under 18, and the application asks you to confirm your age before it can be sent.

If we learn that we have collected personal information from someone under 18, we will delete it unless we have a legal reason to retain it.

If you believe someone under 18 has submitted personal information to PortalBunny, please contact us at [email protected].

We do not use automated decision-making, or profiling, to accept or reject an application. Applications are read by people. That is not a legal flourish — it is why the confirmation says we will read it ourselves.

Our hosting provider and our email provider, because the site has to be served and the reply has to be sent. Google, as the provider of the analytics described in section 09, but only if you accepted them. Authorities, where the law requires it.

There is no payment provider and no data partner: nothing is paid for here, and nothing about you is looked up anywhere. We do not sell personal data, and we do not share it for advertising.

Your email address, and anything you write to us, is handled by Google Workspace, and reaches the United States. Under UK law that is a restricted transfer, so it needs a basis of its own.

It has one. Google LLC holds active status under the UK Extension to the EU-US Data Privacy Framework — the UK-US data bridge — for the kind of data we send, and you can check that yourself on the register the US Department of Commerce publishes. Google’s Cloud Data Processing Addendum also carries the UK Addendum to the EU Standard Contractual Clauses, which stands behind that. Google acts as our processor; we remain responsible for your data.

There is no payment provider and no data partner — nothing is paid for here, and nothing about you is looked up anywhere.

An application is kept while we are considering it and while we are talking to you about it.

If we decline it, or if it simply goes quiet, it is deleted twelve months later. The twelve months run from the moment it went quiet — the day we said no, or the last day anything happened to it — not from the day you sent it. The deletion is automatic: the server checks once a day and removes what is past the date. It is a rule that runs, not a sentence on a page.

Analytics data, if you accepted it, is kept by Google for fourteen months and then deleted.

If we accept it, what you sent becomes part of onboarding you and of the relationship that follows. We keep it for as long as we reasonably need it to bring you on, talk to you and run that relationship — so an accepted application is not on the twelve-month clock above.

When that relationship ends, we delete what we no longer need. Anything kept past that point is kept only because a specific, continuing reason requires it — a legal or regulatory obligation, an accounting record, a security matter, an unresolved dispute — and only for as long as that reason lasts. That is a narrow door, not a wide one: it covers the records that arose for those reasons, not a licence to hold your original application for ever.

PortalBunny uses analytics to understand how the site is used: which pages are viewed, where a visit came from, roughly where in the world it is, what device and browser it used, and what was clicked or opened. We use it to see what works on the site and what does not.

The product is Google Analytics 4. Two things about how it is set up, because they are the difference between measurement and surveillance: Google Signals is off and no advertising features are enabled, so nothing here is joined to an advertising profile or used to target you anywhere; and we do not send Google any details you gave us. Analytics data is kept for 14 months and then deleted by Google.

None of it runs until you say yes. No analytics cookie is set and no analytics script is loaded before you accept, and refusing takes exactly one press — the same as accepting. If you change your mind either way, the choice is at the foot of every page, and it is remembered in a single cookie that holds nothing but your answer.

Google Analytics involves the same transfer to the United States, and rests on the same basis, as the email described in section 07.