ISO400 Privacy Policy
Draft for review, not legal advice. Fill in the parts in [square brackets] before publishing.
Last updated: [DATE]
This policy explains how ISO400 collects and uses personal data when you use the ISO400 app (app.iso400.co.uk and the iOS and Android apps) and the website iso400.co.uk. We have tried to keep it short and plain.
1. Who we are
ISO400 is run by [FULL LEGAL NAME], a sole trader trading as ISO400, based in the United Kingdom.
- Address: [POSTAL ADDRESS]
- Email: hello@iso400.co.uk
- ICO registration number: [ICO NUMBER]
We are the "controller" of your personal data under the UK GDPR and the Data Protection Act 2018. We do not have a Data Protection Officer; please contact us at the email above about anything in this policy.
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Email address, password (stored hashed by our provider), sign-in times | You, when you sign up |
| Profile | Display name, username, profile photo, bio, website, Instagram handle, tier and badge, points | You |
| Places you add | Name, description, category, map position, tips, photos | You |
| Photos | Photos you upload to places, photowalks and challenges | You |
| Community activity | Communities you join or run, photowalks you create or attend, challenge entries, saved places | You |
| Reports | What you reported and why, and reports made about your content | You and other users |
| Business details (Business tier) | Business name, logo, description, link, perks and discount codes | You |
| Device location | Your current position, only when you allow it and use "my location" or place a pin | Your device |
| Technical data | IP address, browser or device type, error logs | Your device and our providers |
| Waitlist | Email address and the role you picked | You, on iso400.co.uk |
| Payments (when live) | Which plan you bought, renewal dates, transaction IDs. We never see your full card details. | Apple, Google or Stripe |
Photo metadata. When you upload a photo, the app re-encodes it and removes all EXIF metadata, including GPS position, camera serial numbers and dates, before it leaves your device.
Device location. We use your live location only to centre the map or to help you place a pin. We do not track you in the background and we do not store your live location. A place you choose to publish is stored with the map position you set, and it is visible to others.
Special category data. We do not ask for sensitive data (such as health, religion or ethnicity). Please do not put it in your profile or posts.
3. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, showing your profile, places, photos, walks and challenges | Contract (providing the service you signed up for) |
| Subscriptions, badges and tier features | Contract |
| Keeping records of payments for tax | Legal obligation |
| Moderation: handling reports, hiding or removing content, preventing abuse, spam and fraud | Legitimate interests (keeping ISO400 safe) and legal obligation (Online Safety Act 2023) |
| Using your device location for "my location" | Consent (your device permission, which you can turn off at any time) |
| Service emails (sign-in links, security, changes to these terms) | Contract and legitimate interests |
| Waitlist and launch news | Consent (you can unsubscribe at any time) |
| Fixing bugs and keeping the service secure | Legitimate interests |
We do not sell your data, we do not show third-party advertising and we do not use your data for automated decisions that have legal or similarly significant effects on you.
4. What other people can see
ISO400 is a community. Your profile (display name, username, photo, bio, links, badge), the places you publish, your photos, your challenge entries and the photowalks you create or attend are visible to other users and may be visible to anyone with the link. Your email address is never shown to other users. Places you mark as private (Supporter Plus and above) are visible only to you.
5. Who we share it with
We use a small number of service providers ("processors") who handle data on our behalf:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, photo storage | London, UK (AWS eu-west-2). Supabase staff may access it from other countries for support. |
| Cloudflare | Hosting the website and web app, security | Global network |
| OpenFreeMap and OpenStreetMap | Map tiles (your device requests map images directly, so they see your IP address) | EU / UK |
| Photon by Komoot | Searching for places by name (your search text and IP address) | Germany |
| Apple, Google, Stripe (when payments go live) | Processing payments and subscriptions | UK, EU and USA |
If you open directions, the app sends you to Google Maps or Apple Maps, and their own privacy policies apply.
We may also share data if the law requires it (for example with the police or a regulator), or to protect people's safety.
6. International transfers
Our main database is in London. Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or on safeguards such as the UK International Data Transfer Addendum, which these providers include in their terms.
7. How long we keep it
| Data | How long |
|---|---|
| Account, profile and content | Until you delete it or your account |
| After you delete your account | Removed from the live system straight away and from backups within [30] days |
| Reports and moderation records | Up to 12 months after a report is closed, longer if needed for a legal claim or a police request |
| Payment and tax records | 6 years (HMRC rules) |
| Waitlist | Until you unsubscribe, or 12 months after launch, whichever is first |
| Technical logs | Up to 90 days |
If you delete your account, photowalks you created may be kept for other attendees but without your name, and places other people saved may be removed.
8. Your rights
You have the right to:
- access a copy of your data;
- correct data that is wrong;
- delete your data (you can delete your account yourself in Profile → Settings → Delete account);
- restrict or object to how we use it, including for legitimate interests;
- data portability (get your data in a common format);
- withdraw consent at any time (for example, turn off location in your device settings, or unsubscribe from emails).
To use any of these rights, email hello@iso400.co.uk. We will reply within one month. We may ask you to prove who you are.
9. Complaints
If you are unhappy with how we use your data, please tell us first at hello@iso400.co.uk. We will acknowledge your complaint within 30 days and tell you what we are doing about it.
You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, phone 0303 123 1113.
10. Children
ISO400 is for people aged 16 and over. If we learn that someone under 16 has an account, we will delete it. If you think a child under 16 is using ISO400, email us.
11. Security
Data is encrypted in transit (HTTPS) and at rest by our provider. Access to the database is limited by row-level security rules, so users can only change their own data. No system is perfectly secure; if a breach affects you, we will tell you and the ICO where the law requires it.
12. Cookies and local storage
The website and app use only what is strictly necessary: storage that keeps you signed in and remembers settings such as dark or light mode. We do not use advertising or tracking cookies. If we ever add analytics that need consent, we will ask first.
13. Changes
We will post any changes here and update the date at the top. If a change is important, we will tell you in the app or by email.