What we keep. What we don’t.

1. Who we are

The data controller for the personal data described in this notice is Not Another Brand Limited (Companies House 17074425), trading as Eavesdrop, a company registered in England and Wales with its registered office at 37 Sheen Road, Richmond, TW9 1AJ. Our ICO registration is in progress; we will publish the number here once issued. We are responsible for deciding how and why your personal data is used in connection with Eavesdrop reports, account management and the public website. Where the law requires it, references in this notice to UK GDPR are to the United Kingdom General Data Protection Regulation as it forms part of retained EU law, read with the Data Protection Act 2018.

2. What we collect

• Account data — the email address you sign in with, a hashed identifier, and (if you set one) a display name.
• The listing URL or address you submit for each report, plus any UPRN we resolve from it.
• Buyer-profile answers — the six short questions we ask before generating a report (priorities, household, intended length of stay, etc.).
• Order data — the report you bought, the price, the date, and the consent text you ticked at checkout. We do not see or store your card details; Stripe handles that under its own controller terms.
• Operational data — an audit trail of consent events, signed-in sessions, and error reports needed to run the service.
• Analytics data — aggregate page-view counts via Plausible (cookieless) and, if you accept the analytics cookie, event data via PostHog. We also record a server-side purchase event without cookies for order analytics.

We do not knowingly collect special-category data (Article 9), and we do not target advertising at any user.

3. Why we’re allowed to hold it

• Performance of a contract (Article 6(1)(b)) — account, order data, listing URL, buyer-profile answers, the report itself. Without these we cannot generate a report you have asked us to generate.
• Legitimate interests (Article 6(1)(f)) — short-lived caching of public-source responses for up to twenty-four hours so that two buyers researching the same address do not each force a fresh fetch on the same council planning portal, and aggregate analytics needed to operate the website. Our legitimate interest is throttling load on public registers and understanding how the site is used; your interest is a faster report and a working site; we have balanced the two and concluded the impact on you is negligible because we hash any direct identifiers before caching.
• Legal obligation (Article 6(1)(c)) — retention of your CCR 2013 regulation 37 consent record for the statutory limitation period; tax and accounting records.
• Consent (Article 6(1)(a)) — analytics cookies, marketing email signup, and any other optional processing where we expressly ask you to opt in.

4. How long we keep it

• Raw HTML from listing portals and council registers — purged within twenty-four hours of fetch. We retain only the structured fields the report needs.
• The canonical report JSON and rendered PDF — retained on your dashboard so you can download it again, for the lifetime of your account. You can delete a report at any time.
• Buyer-profile answers — written once at order time, read during render, and purged on render-complete. We do not retain a profile after the report is delivered. This is how we operationalise the “profiling” activity defined in Article 4(4) without holding a longitudinal profile of you.
• CCR 2013 regulation 37 consent records — retained six years from the date of purchase to evidence statutory compliance.
• Audit logs — ninety days, then aggregated.
• Account email — retained while you have an account, plus thirty days after closure for fraud and chargeback resolution, then deleted.

5. Profiling, and how we delete it

Eavesdrop re-ranks the flags inside your report based on the six-question buyer profile you provide at order time. This is profiling within the meaning of Article 4(4) of the UK GDPR. It does not produce a decision that has legal effects on you, so it is not Article 22 automated decision-making, but we are upfront about it because it tailors the report.

We hold the buyer profile only long enough to render the report — write-once, read-during-render, purge-on-render-complete. The purge is automatic and unconditional; there is no buyer-profile database to interrogate after a report is delivered. If you would prefer no profile-based re-ranking at all, you can request a profile-free report by emailing hi@geteavesdrop.com and we will deliver one at no extra charge.

6. Who we share it with

We do not sell your personal data to anyone. We use a small number of processors who act on our written instructions. Where data leaves the UK we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the ICO’s International Data Transfer Agreement/Addendum.

• Supabase — primary database, authentication, and file storage. Hosted in eu-west-2 (London). Holds account data, orders, and report artefacts.
• Stripe Payments UK Ltd — payment processing. Stripe is a separate controller for card data and a processor for the order metadata we pass to it. Reads its own UK privacy notice at stripe.com/gb/privacy.
• Vercel Inc. — web hosting and CDN. Holds short-lived request logs and serves the website. DPA-bound.
• Vercel AI Gateway — routes report-generation requests to our LLM providers.
• Anthropic and OpenAI — LLM providers that receive report facts and buyer-profile answers to write narrative summaries. US; transfers under the UK Extension to the EU-US Data Privacy Framework or the International Data Transfer Agreement/Addendum, as applicable.
• Proxy providers, including Bright Data — retrieve the listing page you submit.
• Ordnance Survey — UK address-to-UPRN lookup.
• Vercel Blob — public asset storage, including watermarked report copies intended for public access.
• Railway — backend worker hosting (the service that fetches public registers and renders your PDF). DPA-bound.
• Resend — transactional email (sign-in links, consent confirmations, order receipts). DPA-bound.
• Sentry — error monitoring. Receives stack traces and a hashed user identifier; we strip personal data from error payloads before they leave our servers. DPA-bound.
• PostHog — browser product analytics, only after you accept analytics. We also record a server-side purchase event, without cookies, for order analytics. EU-hosted region.
• Plausible — cookieless aggregate page-view counts. EU-hosted.
• Upstash — short-lived cache and queue infrastructure. Holds hashed cache keys and source responses for up to twenty-four hours. EU-region.

7. Your rights

Under UK GDPR you have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — ask us to correct anything that’s wrong.
• Erasure — ask us to delete your account and data, subject to the retention schedule in clause 4.
• Restriction — ask us to pause processing while a complaint is investigated.
• Portability — ask for your account and report data in a machine-readable format.
• Objection — object to processing based on legitimate interests, including the twenty-four-hour source cache described in clause 3.
• Withdraw consent — for any processing we do on the basis of consent (analytics cookies, marketing email).

Email hi@geteavesdrop.com and we will respond within thirty days. If you are not happy with our response you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.

If you are a company officer whose name appears on the Companies House public register and you have a question about how Eavesdrop uses that data in leasehold reports, see our leasehold officer data notice.

8. Cookies

We use a small set of strictly-necessary cookies to keep you signed in and to protect against cross-site request forgery, and (with your consent) one analytics cookie. The full breakdown is on the cookies page.

9. Contact

Eavesdrop is a product of Not Another Brand Limited · Companies House 17074425 · Registered office: 37 Sheen Road, Richmond, TW9 1AJ. All queries (privacy, support, anything else) to hi@geteavesdrop.com. You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.