Privacy Policy

We collect as little as possible, we never sell it, and we explain plainly what each piece is for. This policy explains how Check Local Ltd ("we") handles your personal data under the UK GDPR and the Data Protection Act 2018.

1. What we collect

• Account data. Email, name, password (hashed with bcrypt) — to identify you and let you sign in.
• Activity. Your saved shortlist and compare requests — to make the product work.
• What you look at, when you're signed in. The places you open and the searches you make — at most your 200 most recent places and 50 searches — so your homepage can show you where you left off and suggest places near where you've been looking. It's on by default. You can switch it off, or clear it, under "Your homepage" in your dashboard. It's included in your data export and deleted with your account.
• Your answers about your move. If you tell us your situation, when you're moving and what matters most to you, we use them to decide what your homepage shows. They're optional, and you can change them in your dashboard at any time.
• Billing. If you subscribe, Stripe handles your card. We only ever see masked card details and the subscription status.
• Technical logs. IP, browser, requested URL — kept for 30 days for abuse prevention and debugging.
• Listing clicks. When you click an estate or letting agent listed on a place, we add one to that agent's daily count of views and clicks. The count carries no information about you, and we take no commission.
• What you need from a home (only if you tell us). Your budget, bedrooms, commutes, priorities and deal-breakers, used to show how each place matches. Signed out, they stay in your browser; signed in, on your account. You can change or clear them at any time, and they're deleted with your account.
• Agent links. If you arrive from an estate agent's listing, we record the details the agent put in the link (postcode, price, bedrooms, type), the place it resolved to, the page you came from and an anonymous session id — and, if you then sign up, that the sign-up followed the link. We keep this for 30 days, then delete it; the agent only ever sees daily counts, never who you are.
• Business accounts. If you register a firm, we keep its details, its branches and the staff it chooses to publish (with the firm's confirmation that each person agreed), plus the names and emails of the people who manage it.
• Usage analytics (only if you accept). If you accept analytics cookies, Google Analytics records which pages you visit and events like searches and checkout starts, tied to a random browser ID — never your name or email. Microsoft Clarity records how pages are used (clicks, scrolling, where people get stuck) as anonymised recordings with all page text hidden; it never captures what you type, and does not run on sign-in, account or saved-places pages, or on a page reached by searching a postcode. Nothing is collected if you choose "Essential only".
• Alerts you set up. If you ask us to watch your home or a place, we keep the postcode (and the map point for it), the distance and how often you want to hear, so we can email you when something changes there — a sale, a planning application, a school inspection. We record which items we have emailed you so we never send the same one twice. You can pause, change or remove each alert on your dashboard, and every alert email has a one-click unsubscribe.
• Monthly area updates (only if you opt in). If you ask for them and confirm by clicking the link we email you, we send at most one email a month about places you've watched, saved or — if homepage personalisation is on — looked at. We keep your email, when you confirmed, and those places. A request you never confirm is deleted after 30 days. If you unsubscribe we keep your address only to make sure we don't email you again.
• Newsletter signup. If you sign up to the newsletter, your email address is stored with Mailchimp. We use double opt-in — you're only subscribed after confirming by email — and every email has an unsubscribe link.

2. What we don't collect

• We don't track you across the web.
• We don't sell your data to anyone.
• We don't use third-party advertising cookies.
• We don't profile you for risk scoring or any automated decision-making.

3. Lawful bases

• Contract — to provide the account, shortlist and Moving Mode you signed up for.
• Legitimate interests — for service security, fraud prevention, product analytics aggregated to a level that cannot identify you, and tailoring your signed-in homepage to what you look at (you can switch this off at any time).
• Consent — for any optional cookies or marketing email (you can withdraw at any time).
• Legal obligation — to keep accounting records and respond to lawful requests.

4. Sub-processors

We share data only with the providers that operate the Service for us:

• Stripe Payments Europe — payments and subscription management.
• Anthropic — generates Rundowns from area statistics. We do not send your personal data, only the area's public numbers.
• Google LLC (Google Analytics) — aggregated usage analytics, only if you accept analytics cookies. IP addresses are not logged or stored by Google Analytics 4.
• Microsoft Corporation (Microsoft Clarity) — page-usage recordings and heatmaps with all page text hidden, only if you accept analytics cookies. IP addresses are masked.
• Intuit Inc. (Mailchimp) — stores newsletter subscriber emails and sends the newsletter, only if you sign up.
• Sinch (Mailgun) — sends email: verification codes, the contact-form relay, the alerts you set up and, if you opt in, monthly area updates. It tells us when an email bounces or is marked as spam, and we stop emailing that address.
• Our hosting provider — runs the servers and database within the UK / EEA.

5. How long we keep it

• Account — for as long as your account is active, plus 6 months after deletion to handle disputes.
• Billing — 7 years (UK accounting requirement).
• Technical logs — 30 days.
• What you look at — until you clear it or delete your account, and never more than your 200 most recent places and 50 searches. Switching it off stops us recording anything new; use "Clear" to delete what's already there.
• Agent link visits — 30 days, then deleted. Daily counts per branch, which identify no one, are kept for the firm's dashboard.
• Listing view and click counts — daily totals per branch; they identify no one.
• Referral clicks recorded before September 2026 — 24 months from the click. We no longer record them.
• Analytics — Google Analytics event data is retained for 14 months, then deleted. Microsoft Clarity keeps recordings for 30 days and its aggregated heatmaps for up to 13 months.
• Newsletter — until you unsubscribe (one click in any email) or ask us to delete you.
• Alerts — while the alert exists; removed when you delete it or your account. The record of what we've already emailed you goes with them.
• Local changes we detect (sales, planning applications, inspections — public records, not about you) — 24 months, then deleted.
• Monthly area updates — until you unsubscribe or delete your account; unconfirmed requests are deleted after 30 days.

6. Your rights

You can ask us to:

• Access the data we hold about you.
• Correct anything that's wrong.
• Delete your account and personal data (subject to legal retention above).
• Export your data in a portable format.
• Object to a particular processing.

Email [email protected] and we'll act within one calendar month. If you're not happy with our response you can complain to the Information Commissioner's Office at ico.org.uk.

7. International transfers

Primary processing happens in the UK / EEA. Where a sub-processor (e.g. Anthropic, Stripe, Google, Mailchimp) operates outside, transfers rely on UK Adequacy Regulations (including the UK Extension to the EU–US Data Privacy Framework) or the ICO's International Data Transfer Agreement.

8. Changes

We'll tell you by email about any material change before it takes effect.

9. Controller

Data controller: Check Local Ltd, a company registered in England and Wales under company number 17165781, with its registered office at 66 Paul Street, London, England, EC2A 4NE. Contact: [email protected].