Privacy & Cookies

Island Graph is operated by Island Graph Limited, a company incorporated in Guernsey (registration no. CMP78596), whose registered office is at Ashridge, Ruette De La Croix, Castel, GY5 7NN, Guernsey. Island Graph Limited is the data controller for the personal data described on this page. The company was founded and is run by Niki Wiles. Questions, corrections and data requests can be sent to hello@island.gg.

The applicable framework is The Data Protection (Bailiwick of Guernsey) Law, 2017, supervised by the Office of the Data Protection Authority (ODPA). The Law is GDPR-equivalent, which is why Guernsey holds adequacy status with the EU and the UK. Island Graph Limited is registered with the ODPA as a data controller under registration number DPA11733.

Island Graph is a directory of businesses, not of people. However, some named individuals appear on the site because they are publicly associated with those businesses — typically directors, partners, principals, owner-operators, or named professionals (e.g. a sole-trader plumber whose business trades under their own name).

Where the information comes from

Names and roles published on Island Graph are drawn from information that is already in the public domain. Typical sources include:

• the public register maintained by the Guernsey Registry (company officers, beneficial-ownership disclosures where public);
• regulatory registers operated by the GFSC and similar bodies;
• business websites, “About” / “Team” pages, and other materials the business itself publishes;
• press releases, news articles, and public LinkedIn or business profiles where the individual has chosen to associate themselves with the business publicly.

We do not publish private contact details, home addresses, or personal information unrelated to a person’s public business role.

Lawful basis

For the publication of names tied to public business roles, we rely on legitimate interests under Article 6(1)(f) of the Guernsey Law: namely, the public interest in a navigable, evidence-linked directory of the island’s businesses, balanced against the limited privacy impact of republishing information that a data subject has already chosen to make public in a professional capacity. Where a record incidentally includes information that goes beyond what is reasonably necessary for that purpose, we will remove or redact it on request.

Your rights

If you are named on the site, you have the right to:

• see what we hold about you and where each fact came from (every claim on Island Graph is linked to its source);
• correct anything that is wrong or out of date;
• object to your name being published, and ask for it to be removed or redacted;
• complain to the ODPA if you are not satisfied with how we have handled your request — details at odpa.gg.

To exercise any of these, email hello@island.gg. We aim to respond within a few working days and, in any event, within the statutory one-month window.

Island Graph does not show a cookie banner. It also does not set marketing, advertising, or cross-site tracking cookies, and it does not sell or share visitor data with any third party for advertising.

What we use, and what we don’t

• No advertising cookies. We do not run ads and we do not use ad-tech tracking.
• No third-party social trackers. No Facebook pixel, no LinkedIn Insight tag, no TikTok pixel, nothing of that kind.
• No account, no logins. The site has no user accounts, so there is nothing to associate a visit with a person.
• Search queries are recorded anonymously.What you type into the search box is kept as the bare phrase, a count, and a timestamp — with no IP address, session, cookie, or any other identifier attached, so a query cannot be traced to a person. We use these aggregates for one purpose: finding the businesses people look for that we don’t yet list. Queries are truncated to 200 characters and retained for no more than 12 months.
• Strictly-necessary cookies only, plus aggregate analytics. The site may set small functional cookies needed to make pages work (for example, to remember a UI preference within a session). These are exempt from consent requirements.

Analytics — Cloudflare Web Analytics

For aggregate visit counts we use Cloudflare Web Analytics, chosen specifically because it is the lightest-touch option short of having no analytics at all:

• No cookies, no stored identifiers of any kind. The measurement script sets no cookies and writes nothing to your browser — no localStorage, no fingerprinting.
• No cross-site or cross-device tracking. It cannot stitch your visit here to anything else, because it assigns you no identifier to stitch with.
• Aggregate only.What we see is page views, referrers, countries, and page-performance timings — counts, not people. We cannot look up an individual visitor, and neither can Cloudflare on our behalf.
• Internal use only.The numbers tell us which parts of the directory are useful. Nothing is shared with advertisers — there are no advertisers.

Cloudflare, Inc. processes the measurement requests on our behalf as a data processor. Because the script is cookieless and stores nothing on your device, it sits within the Guernsey ePrivacy Ordinance’s consent exemptions — which is why there is no banner. If you would still prefer not to be counted, any browser content blocker will block the script (served from static.cloudflareinsights.com) without affecting the site in any way.

The site is served from a server hosted with Amazon Web Services in its London region (the closest to Guernsey), with data stored on Neon, a managed database service, in the same region. Delivering a page necessarily involves your IP address and standard request headers; these are used in transit and not retained by us as browsing records.

To protect the site from abuse, we enforce per-visitor rate limits using Upstash, a managed Redis service, also hosted in the London region. This holds short-lived request counters keyed by IP address; the counters expire within minutes and are not used for any other purpose.

Island Graph is built by software agents that read public webpages and structured registers, extract factual claims, and link each claim back to its source. Large language models are used in that extraction pipeline, but they operate on already-public material and they do not receive any data about you as a visitor.

The site is aimed at an adult, business-and-research audience. It is not directed at children, and we do not knowingly collect information about children.

If we change how the site handles personal data or analytics, this page will be updated and the “last updated” date at the top will change. Material changes will be flagged on the homepage for a reasonable period.