Legal
Privacy policy
Last updated: 31 October 2026
Who we are
This website is operated by Rhoda Ikhuemose under the name Fraudlyst. Rhoda Ikhuemose is the data controller for personal information collected through this website. You can contact us at hello@fraudlyst.co.uk.
The website does not take payments, deposits, pre-orders or bookings.
What this policy covers
This policy explains how we use personal information when you:
- visit the Fraudlyst website;
- join one or more product waiting lists;
- tell us whether you are interested for yourself or for a team or organisation;
- optionally tell us your country;
- tell us which Advanced route interests you;
- send anonymous feedback; or
- contact us about your information.
The playable Maya Demo and learner accounts are not live yet. We will update this policy before they are introduced.
The information we collect
When you join a waiting list
We collect:
- your email address;
- the product or products you select: the Free Demo, the Live Investigation Simulation, Applied or Advanced;
- confirmation that you are 18 or over;
- your agreement to receive email about the selected products, with the date and time you agreed and the version of the wording you agreed to;
- the page you joined from and, where present, an approved referral label (for example, that you arrived from LinkedIn);
- optionally, whether your interest is for yourself or for your team or organisation;
- optionally, your country;
- if you select Advanced, whether you are interested in starting with Applied, have relevant professional experience, or are not yet sure;
- if you select the Live Investigation Simulation, optionally, the simulation role you would like to try and the session times that would suit you; and
- optionally, whether you are interested in live reviews of publicly reported fraud cases, a possible future format. We use this answer only to gauge interest. We will not email you about it unless you later join a list for it.
We keep a lowercased, trimmed copy of your email address to stop the same address being added to a product list twice. We do not otherwise change the address you give us.
Anonymous feedback
If you complete the feedback form, we collect your answers, the topic you choose (if any) and the time they were sent. We do not attach your email address or waiting-list record to them. Please do not put personal information in your answers. If you do, we will remove it as soon as reasonably practicable.
Technical and security information
Our hosting and form-processing services process technical information needed to deliver and protect the website. This may include your IP address, the time of your request, your browser or device type, the page requested and signals used to detect spam or abuse. To limit repeated form submissions, our form function also keeps a salted hash of your IP address, never the address itself, for 30 days. Netlify, which hosts the website, logs each request, including your IP address, the page requested, the page you came from and your browser type. Supabase, which runs our form function, logs form requests to keep the service running and secure.
Information we do not ask for
We do not ask for your name, telephone number, job title, date of birth, payment details or identity documents. Please do not send sensitive personal information, information about criminal offences or confidential case material through our forms.
Why we use your information
| Purpose | Information used | Lawful basis |
|---|---|---|
| To email you when a product you selected opens, and send updates about it | Email, selected product, consent record | Consent. You choose the products and tick an unticked consent box. |
| To keep separate product lists and prevent duplicates | Email copy, selected product, timestamps | Legitimate interests in keeping accurate lists without collecting more than we need. |
| To understand whether interest is individual or from a team | Optional audience answer | Legitimate interests in planning the product. The field is optional. |
| To understand which pages and channels bring people to Fraudlyst | Source page and referral label | Legitimate interests in knowing which pages and channels work, without tracking you. |
| To understand where interest comes from | Optional country | Legitimate interests in planning a product open to learners worldwide. The field is optional. |
| To understand interest in the two Advanced routes | Advanced route answer | Legitimate interests in planning Advanced. It is not an application and does not decide eligibility. |
| To understand which simulation roles, session times and future formats interest people | Optional role, session-time and case-review interest answers | Legitimate interests in planning the Live Investigation Simulation. Both fields are optional, and choosing a role or time does not reserve anything. |
| To apply the 18 or over rule | Age confirmation | Legitimate interests in limiting Fraudlyst to adults. We do not collect your date of birth. |
| To run and secure the website, and prevent spam and abuse | Technical and security information | Legitimate interests in running a safe, reliable website. |
| To respect a withdrawal and not contact you again about a product | Email copy, product, withdrawal date and any reason you choose to give | Legitimate interests in respecting your choice and showing we have applied it. |
| To improve Fraudlyst using feedback | Anonymous feedback | Data protection law does not apply to genuinely anonymous information. Any brief handling needed to receive it relies on our legitimate interests in improving the service. |
You can object to processing based on legitimate interests. Your right to object to direct marketing is absolute.
Email updates and your choices
We only email you about the products you selected. Joining one list does not add you to another.
You can withdraw your consent for one or more products at any time by emailing hello@fraudlyst.co.uk and telling us which list or lists to leave. We will stop the relevant emails as soon as reasonably possible, and within one month.
After you withdraw, we keep a minimal record of your email and that product so we don't contact you about it again. If you later sign up for that product again, we treat that as fresh consent.
We do not currently send automatic confirmation emails. We do not sell your personal information or share it with other organisations for their own marketing.
Who receives your information
We use service providers that act on our instructions. They may use personal information only to provide their services to us.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Supabase | Waiting-list database and protected form processing | Waiting-list details, consent records and technical information | Stored in London, UK. Supabase's support team may access it from other countries, only when needed. |
| Netlify | Hosting and delivering the website | IP address, request and security logs | United States. Pages are delivered from servers worldwide, usually the ones nearest you. |
We do not use analytics, advertising or social media tracking on this website. Fonts are served from our own website, not from a third party.
We may also disclose information where the law requires it, to protect legal rights or to investigate a genuine security incident. We never publish waiting-list information.
International transfers
Waiting-list information is processed and stored in London. Supabase is run by Supabase Pte. Ltd in Singapore, with technical support from Supabase, Inc. in the United States, and keeps its service logs in the European Union. These transfers are covered by the Standard Contractual Clauses with the UK Addendum. Netlify, Inc. is based in the United States. Its transfers are covered by the UK Extension to the EU-US Data Privacy Framework or, where that does not apply, the UK International Data Transfer Addendum. Both safeguards are part of each provider's data processing agreement.
How long we keep information
| Information | How long we keep it |
|---|---|
| Waiting-list entry, before the product opens | Until you withdraw, or 24 months after you joined. After that we delete it, unless you give fresh consent. |
| Waiting-list entry, after the product opens | Until you withdraw, or 12 months after our final launch email about that product, unless you agree to further updates. |
| Consent record, country, route, audience, role, session-time and case-review interest answers | Deleted with the waiting-list entry. |
| Withdrawal record | Your email, the product and any reason you gave, for as long as we send product emails. |
| Anonymous feedback | Up to 24 months. We review it periodically and delete what we no longer need sooner. |
| Form rate-limit record (a salted hash of your IP address) | 30 days, then deleted automatically. |
| Hosting and security logs | Netlify: up to 90 days, and up to one year in offline security archives. Supabase: short periods set by Supabase to run and secure the service. |
We may keep information longer where we need it to establish, exercise or defend legal claims, comply with the law or investigate a security incident, and only for that purpose.
Security
We use proportionate technical and organisational measures to protect personal information. The public form can send records through a protected function but cannot read the database. We use access controls, row-level security, rate limits and restricted administrative access.
No online service is completely secure. If a personal data breach happens, we will assess it and tell the people affected and the Information Commissioner where the law requires.
Your rights
Depending on the circumstances, you have the right to:
- ask for a copy of your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to delete your information;
- ask us to restrict how we use it;
- object to processing based on legitimate interests;
- receive information you gave us in a portable format, where the law allows; and
- withdraw consent at any time, without affecting anything done before you withdrew.
To use any of these rights, email hello@fraudlyst.co.uk. We may ask for information to confirm your identity. We normally respond within one month. ICO guidance on time limits for rights requests (opens in a new tab). The law allows longer in some complex cases; if that applies, we will tell you within the first month.
We do not make decisions about you by solely automated means that have legal or similarly significant effects.
People under 18
Fraudlyst is for people aged 18 or over. If we learn that someone under 18 has joined a waiting list, we will delete their information, except for anything we must keep to meet a legal or security obligation.
Complaints
Please contact us first at hello@fraudlyst.co.uk, and we will do everything we can to put things right.
You also have the right to complain to the Information Commissioner's Office (ICO):
- Website: Make a complaint to the ICO (opens in a new tab)
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Changes to this policy
We will update this policy before introducing learner accounts, the playable Maya Demo, payments or any materially different use of personal information. The new version will appear on this page with a new date. If a change affects your existing consent or adds a new purpose, we will tell you and ask for fresh consent where needed.