Skip to content
Our Town Our Skills

Privacy Notice

This is a draft Privacy Notice with placeholders. It has not been legally reviewed or approved. Do not open public sign-up until the operator has completed and reviewed this notice.

Data controller

[LEGAL_ENTITY_OR_PERSON_NAME — to be supplied] is the data controller for Our Town Our Skills. You can contact us at [CONTROLLER_CONTACT_EMAIL — to be supplied] or [CONTACT_POSTAL_ADDRESS — to be supplied].

What data we collect and why

  • Account data: your email address, to create and manage your account. Lawful basis: contract.
  • Identity and address: your full name, full address, and postcode, to verify you live within the eligibility area. Lawful basis: legitimate interests for community safety.
  • Proof of address: a redacted document showing your address, to verify residency. Lawful basis: legitimate interests. This is retained only for a set period after review and then purged.
  • Public profile: your chosen display name, optional avatar, general area, and bio, visible to other verified members. Lawful basis: contract.
  • Exchange and points data: records of exchanges, messages, points transactions, and reviews, to operate the service and resolve disputes. Lawful basis: contract and legitimate interests.
  • Reports and moderation: reports you make about other members, and records of any moderation actions. Lawful basis: legitimate interests and legal obligation.
  • Usage data: technical data such as access logs, for security and service improvement. Lawful basis: legitimate interests.

Verification vendor

We use Postcodes.io (or a licensed equivalent) to validate postcodes and resolve coordinates. This is a server-side operation — your postcode is sent to the API from our server, not directly from your device.

Automated document checking

When you upload a proof-of-address document, an automated system reads the document and checks that the name, address, and postcode match the details you gave us. It also checks the document type, date, and whether it appears genuine. This uses a language model provided by Anthropic. Your document image is sent to Anthropic for extraction only — the model does not make any decision about your application. The decision to approve or not is made by our code, and a person reviews anything the system cannot confirm. Nobody is refused by automation alone.

If you do not want your document checked automatically, you can press the “Request a human review” button on the onboarding screen. A human reviewer will then look at your application from the start.

Storage, hosting, and subprocessors

Your data is stored in Supabase (PostgreSQL database and file storage), hosted in [REGION — to be supplied]. We use the following subprocessors:

  • Supabase — database, file storage, authentication, and edge functions.
  • Anthropic — language model API used to extract text from uploaded proof-of-address documents for automated verification.
  • Resend — transactional email delivery (verification decisions, notifications).
  • Postcodes.io — postcode validation and coordinate lookup.

International transfers, if any, will be documented here with appropriate safeguards.

Retention

Proof-of-address documents are purged [RETENTION_PERIOD — to be supplied] after residency review is completed. Transaction and audit records are retained for as long as necessary for legal compliance and dispute resolution. Account data is retained while your account is active and minimised or deleted when you close it, except where retention is legally required.

Automated decision-making

We use automated checking to help verify proof-of-address documents. The system reads the document and checks that the details match what you told us. However, nobody is refused by automation alone. If the automated system cannot confirm your details, your application is sent to a human reviewer. You can also request a human review at any time while your application is pending. Postcode eligibility checks are automated but can be appealed through the manual review process.

Sharing and moderation

Your private identity and address data is shared only with authorised administrators for verification and moderation purposes. We do not sell your data. We may share data with law enforcement or safeguarding authorities where required by law or to protect safety.

Your rights

You have the right to access, rectify, erase, restrict, object to, and port your personal data, and to withdraw consent where applicable. To exercise these rights, see our Data Rights Request page. You can complain to the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your data. [RELEVANT_ICO_DETAILS — to be supplied].

Effective date

[EFFECTIVE_DATE — to be supplied]. Version 1.0.