Privacy policy

1. Who we are

Direct From Teachers is run by Stefan Cauchi, a sole trader established in Malta, at 15, Triq Il-Kwartin, Swieqi, Malta, who also runs Teachers Gain. For the personal data described here, we are the data controller. Contact: hello@directfromteachers.com.

2. What we collect

If you create an account or heart sites

Your email address, account and sign-in records, which sites you have hearted, and whether and when you asked for news emails. Sign-in records include your IP address and browser details. Accounts are for adults aged 18 or over.

If you list a site

Your email address; your site's name, address and description, its logo if you add one, and the details you choose for it; if you add them, a display name, location and a few words about you, and links to your marketplace shops and social profiles; and our review notes. We also use your site's public content and contact details to check ownership and create screenshots and preview images. We may contact you for clarification and keep the address and date of an ownership verification.

If you contact us or report a listing

What you write, the topic or reason you choose, which listing you reported, and your email address: your account's if you are signed in, or the one you give us. We also receive any personal information you include in email correspondence or that another person supplies in a report about your listing.

Everyone who visits

Our host receives your IP address, browser details and requested page address, including search terms or filters in it, with each request. Request and error logs help us diagnose problems. On the sign-in and contact forms, Cloudflare Turnstile uses information from your browser to check that a person, not an automated program, is using them.

We use Cloudflare Web Analytics to measure visits and page performance. It collects the page you visit, the referring page, your browser, operating system, device type and country, and page performance measurements. Its script sets no cookies and uses no browser storage. Cloudflare receives your IP address with analytics requests but discards it at its nearest data centre. It doesn't use these analytics to identify you or follow you across other sites. We see aggregate statistics. We use no advertising trackers.

You can browse without an account. An email address is required for sign-in, and the listing form marks the details needed to review and publish a site. Optional creator details, logos and profile links can be left blank. Without required information, we can't provide the relevant feature.

3. Why we use it and on what legal basis

We do not sell personal data. We send news emails only to people who ask for them, and emails about your account and listing come either way.

Listing and complaint decisions are made by a person. We do not use solely automated decision-making that has legal or similarly significant effects on you.

4. What is public

Once your listing is approved, the directory and your listing's page show your site's name, address, logo and description, the details you chose, any display name, location, words about you and links you added, and a screenshot of your site. Each site's heart count is public. We don't publish your account email or who hearted which site. Information you include in public listing text or on your captured website may be visible. Search engines and people sharing links can copy public listings and preview images; removing a listing here doesn't remove those independent copies.

5. Who we share it with

These services receive the information needed for their roles:

Access on our side is limited to people who need it to run the directory. Providers may also process data for their own security, service administration or legal duties under their privacy policies. We may disclose relevant information to authorities where legally required, or to professional advisers where necessary for legal claims.

Visiting a listed site or using a share link sends your browser to another service, whose privacy policy applies. Links to listed sites include a referral label identifying this directory, without your account details. Share buttons use plain links and don't load social network trackers on this site.

6. International transfers

Some of these providers process data outside the EU and EEA, mainly in the United States. Where they do, transfers are protected by the European Commission's Standard Contractual Clauses or an applicable adequacy decision. The EU-US Data Privacy Framework applies only to recipients with an active certification covering the transfer. Contact us for more information or a copy of the safeguards that apply.

7. Cookies and similar technologies

We set no advertising, analytics or cross-site tracking cookies, and our visitor analytics (section 2) use no browser storage. We use cookies and browser storage for sign-in, security and features you request:

• Signing in: two cookies, starting dft.session, that keep you signed in. The session cookie lasts up to seven days and is renewed during active use; the session cache cookie lasts five minutes. Signing out clears them.
• Hearting after signing in: if you click a heart while signed out, your browser's session storage remembers which site it was and uses it for up to 30 minutes. After sign-in, it sends your heart choice to us and clears the saved choice; closing the tab also clears session storage.
• Card view: your browser's local storage remembers whether you prefer previews or details. This choice stays in your browser until you change it or clear your browser's site data, and is never sent to us.
• Unfinished listing forms: your browser's local storage keeps your answers, selections and account email so you can return to them in the same browser. Uploaded logo files are not saved. The draft stays in your browser until you submit it, discard it, sign out or clear your browser's site data. We receive your answers only when you submit the form.
• Security: Cloudflare Turnstile on the sign-in and contact forms, as described in section 2.

You can block cookies or clear storage in your browser. Blocking sign-in cookies prevents account features from working.

8. Retention

We keep your account, listing and hearts until you remove them or delete your account. A sign-in session stops working after seven days without a visit; we keep its record until you sign out or delete your account, and may delete expired records sooner. Sign-in codes stop working after 10 minutes; their hashed records and associated emails are removed when used or during the sign-in system's cleanup, rather than necessarily at expiry. Our Worker request and error logs are kept for up to seven days. We can view visitor statistics in Cloudflare Web Analytics for the previous six months.

Your choice about news emails is kept until you change it or delete your account. Unsubscribing, from your account page or through the link in any news email, or deleting your account deletes your contact record at Resend.

Messages, reports, review alerts and email correspondence are kept while we deal with the matter and any related follow-up, dispute or legal obligation. We delete them when they are no longer needed for those purposes. Account deletion does not automatically delete these separate Discord or email records; you can ask us to review and delete them too.

When you remove your listing, we delete its database record and hearts and arrange deletion of its logo, screenshot and preview image. When you delete your account, we also delete your sessions and the hearts you gave. Our backups keep deleted data for about 30 days; copies in our providers' own backups are deleted on their own schedules.

9. Your rights

You can request access to or correction of your personal data, deletion or restriction where the law provides, and a portable copy of data you provided that we process automatically under our contract. You can object to processing based on legitimate interests for reasons relating to your situation. Contact hello@directfromteachers.com to exercise these rights. You can edit your listing, remove it, or delete your account yourself from your account page. You also have the right to complain to a supervisory authority: in Malta, the Information and Data Protection Commissioner (idpc.org.mt), or the authority in the country where you live.

We normally respond within one month. If a request is complex or you make several requests, we may extend this by up to two further months and will explain the extension within the first month. We may ask for information needed to confirm your identity. Requests are normally free.

10. Changes to this policy

We may update this policy from time to time. For material changes, we will email account holders before the change takes effect.