Privacy Policy

Last updated 31 August 2026

The short version. To sign in, MovieFinder needs your email address. To recommend films, it needs to remember what you thought of the ones you rated. That is essentially all it keeps. Nothing is sold, nothing is shared with advertisers, there is no tracking pixel and no analytics cookie. You can try the whole idea on the front page without an account, in which case nothing about you is stored at all. Ask us and we will delete everything.

• 1. Who we are
• 2. What we hold, and why
• 3. Our legal basis
• 4. Who else sees it
• 5. Cookies and browser storage
• 6. How long we keep it
• 7. Using it without an account
• 8. Your rights
• 9. Children
• 10. Changes
• 11. Contact and complaints

1. Who we are

MovieFinder is operated by Soltech Consulting Limited, a company registered in England and Wales under company number 16946304, with its registered office at 53 La Rose Lane, London N15 3AP. Soltech Consulting Limited is the data controller for the personal data described here — meaning we are the ones who decide what is collected and why, and the ones you hold responsible for it.

We are registered with the Information Commissioner's Office, the UK's data protection regulator, under registration reference ZC211888.

For anything in this policy, write to privacy@soltechconsulting.co.uk.

2. What we hold, and why

MovieFinder is a recommendation tool, and a recommendation tool that forgets what you told it is useless. So the data below is almost entirely things you told it on purpose.

What we do not hold: any password (we never see one — sign-in is by emailed code), any payment details (MovieFinder is free and has no payment system), your contacts, your location, or any advertising or cross-site tracking identifier.

A note on what ratings reveal

We should be straight about this. A long list of films you loved and hated is more revealing than it first looks — taste in film can hint at beliefs, politics, or identity. We do not analyse your ratings for any of that, we do not infer characteristics from them, and we do not sell or share them. They are used to pick films and to explain why those films were picked, and for nothing else. But it is why the delete route in section 8 exists and why we would rather you knew.

3. Our legal basis

Under the UK GDPR we rely on two bases:

• Performance of a contract — for your account, your ratings, your watchlist and your preferences. You asked for a service that learns your taste; these are the data that service is made of. Without them there is no product.
• Legitimate interests — for technical logs and security records. Our interest is keeping the service running, working out why it broke, and preventing abuse. We have weighed that against your privacy: these records are about requests rather than people, they are not used to build any profile, and they expire on their own.

We do not rely on consent, because we do not do any of the things consent would be needed for — no advertising, no analytics cookies, no third-party tracking. This is also why you are not shown a cookie banner: there is nothing to ask you about. See section 5.

4. Who else sees it

We do not sell personal data, and we do not share it for anyone else's marketing. It is handled by these providers, each acting on our instructions:

• Microsoft — Azure hosts the service and its database, and Microsoft Entra External ID runs the sign-in. Microsoft therefore holds your email address and a record of your sign-ins, including the IP address you signed in from. The service and its database are hosted in Microsoft's West Europe region, in the Netherlands. Microsoft may process sign-in and diagnostic data in other countries under its own terms; transfers out of the UK are covered by the UK's adequacy regulations for the EEA and, where those do not apply, by the standard contractual clauses in Microsoft's data protection agreement.
• The Movie Database (TMDB) — the source of all film data, posters and stills. Worth understanding: poster and backdrop images load into your browser directly from TMDB's servers, so TMDB can see your IP address and which images you requested. We never tell TMDB who you are, and we never send them your ratings.
• YouTube — trailers play in an embedded player, and only once you press play on one. We use YouTube's youtube-nocookie.com mode, which does not set tracking cookies before playback. Once a trailer plays, Google will see your IP address and that you watched it.

Beyond these, we would disclose personal data only where the law requires it. If Soltech Consulting Limited were ever sold or restructured, records would transfer with the service and this policy would continue to apply until you were told otherwise.

5. Cookies and browser storage

MovieFinder sets no advertising cookies, no analytics cookies, and nothing belonging to a third party. There are two cookies, both strictly necessary to sign you in, which is why no consent banner appears:

• __Host-mf_session — your signed-in session. Set after you sign in, lasts 30 days, and refreshes while you keep using the service. It cannot be read by any script, is sent only over HTTPS, and is never sent to another site.
• __Host-mf_auth — a ten-minute cookie that exists only during the sign-in round trip, to make sure the response coming back is the one we sent you. It is discarded the moment sign-in completes.

The site also stores two small values in your browser rather than on our servers: a note of whether you appeared to be signed in last time, so the page can paint the right button before it has finished asking, and — if you use the demo on the front page — the demo's own state. Neither leaves your device, and clearing your browser data removes both.

6. How long we keep it

• Your account, ratings, watchlist and preferences — for as long as your account exists. These are the ones you would actively lose by deleting, so we do not expire them behind your back.
• The record of films you were shown — two years, then it deletes itself. After that a film you were once offered and ignored can come round again.
• Past recommendation runs — 90 days, then deleted automatically.
• Technical logs — 90 days, then deleted automatically.
• Dormant accounts — we may delete an account, and everything filed under it, after two years with no sign-in. We will email you first.

Ask us to delete your account and everything above goes, other than anything we are legally required to keep.

7. Using it without an account

The demo on the front page — rating films and getting a recommendation — runs entirely inside your browser. No account, no sign-in, and nothing about it reaches our servers or is stored by us. Your browser fetches poster images from TMDB, so section 4 applies to those, but that is the extent of it.

8. Your rights

Under the UK GDPR you can ask us to:

• Give you a copy of the personal data we hold about you, in a portable format.
• Correct anything that is wrong.
• Delete your account and everything filed under it.
• Restrict or object to how we use it, including our reliance on legitimate interests for logs.

You can change or remove individual ratings, and edit your preferences, yourself at any time in the app. For a full copy or a full deletion, email privacy@soltechconsulting.co.uk from the address you signed up with. We handle these by hand rather than through a button in the app, and we will complete the request within one month. There is no charge, and you do not have to give a reason.

9. Children

MovieFinder is not aimed at children and is not intended for anyone under 13. We do not knowingly hold data about a child. If you believe a child has created an account, tell us at the address below and we will delete it.

10. Changes

If this policy changes, the date at the top changes with it. If a change materially affects what we do with your data, we will email account holders rather than rely on you noticing a new date.

11. Contact and complaints