Privacy policy

Last updated: October 2026

Draft for review. This page was written as a sensible starting point for launch. It isn't legal advice and should be reviewed by a qualified UK solicitor (and completed with your business details) before the site goes live.

This policy explains what personal data In The Loop collects, why, and your rights under UK GDPR and the Data Protection Act 2018. The data controller is In The Loop [legal entity name, address and ICO registration number to be added].

What we collect

• Account details: name, email address and a securely hashed password.
• Profile content you choose to publish: names, biography, general area, images, services, links.
• Activity: opportunities you post, applications you send, Common Room messages and reactions, enquiries and reports.
• Acceptance records: when you agreed to the terms and community guidelines, the version shown, and your confirmation that you are 18 or over.
• Technical data: a session cookie that keeps you logged in, and short-lived security logs (such as IP addresses used for rate-limiting).

We don't use advertising or tracking cookies. Directory statistics are aggregate counts only.

Why we use it (lawful bases)

• To provide the service you signed up for (contract).
• To keep the platform safe, prevent spam and fraud, and moderate content (legitimate interests).
• To send newsletters, only if you opt in (consent — withdraw any time).

Who can see what

• Finished profiles are public. Your email, phone number and address are never shown.
• When someone sends you an enquiry, they agree to share their email with you so you can reply.
• When you apply for an opportunity, the poster sees your application and public profile.

Real Common Room conversations are visible to signed-in members. Visitors may see clearly labelled example conversations, not member posts. Do not put contact details or other sensitive information in a Common Room message.

Processors

We use carefully chosen providers for hosting, database, file storage and email delivery [list providers and where data is stored before launch]. They process data only on our instructions.

How long we keep it

For as long as your account is active. When you delete your account we remove your profile, images and services straight away, anonymise your account record, and remove remaining personal data from backups within [30] days.

Your rights

You can access, correct, export or delete your data, object to or restrict processing, and withdraw consent. Most of this you can do from your dashboard; for anything else, contact us. You can also complain to the Information Commissioner's Office (ico.org.uk).