Privacy Policy

Who is responsible for your data

ShedMap is the data controller for the personal data described in this policy. That means we decide how and why it is used, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For anything to do with your data, email privacy@shedmap.com.

What we collect and why

• Account: your name, email address and an optional profile photo. We use these to run your account, sign you in and contact you about the service.
• Saved sheds and preferences: the sheds you save, your notification choices, your chosen search radius and sort order. We store these so they appear on every device you sign in on.
• Location: either an approximate device location or the postcode you type in. It is used only to sort sheds by distance and to draw the map around you. Device location is read only while the app is open and is never sent to shed owners. The last postcode you chose is stored on your phone so the app opens where you left it.
• Owner listings: if you list a shed, we collect its address and coordinates, your contact details, your opening times and your photos. Location metadata is stripped from photos when you upload them. Your phone number is shown to buyers only if you switch that on in your listing.
• Payments: annual listing fees are handled by Stripe. We receive confirmation that a payment went through, the last four digits of the card and the renewal date. We never see or store your full card number.
• Reports: when you report a listing, we keep what you send us, including any message and photo, so we can act on it and, if needed, show the owner what was reported.
• Technical data: crash logs and basic device information (model, operating system version, app version) so we can fix bugs. These are not linked to your name.

Our lawful bases

• Contract: running your account, showing your saved sheds, publishing your listing and taking payment for it.
• Legitimate interests: keeping the directory accurate, handling reports, preventing abuse and fixing bugs. We have weighed these against your interests and believe they are proportionate.
• Consent: using your device location, and sending you the weekly email digest. You can withdraw consent at any time from Search location and Notifications in the app, or from your phone's settings.
• Legal obligation: keeping payment records for tax purposes.

Who we share data with

We share data only with services we need to run ShedMap, and only the minimum they need.

• postcodes.io, to turn a postcode into coordinates. They receive the postcode you type, and nothing else about you.
• MapTiler, which serves the map tiles, drawn from OpenStreetMap data. Their servers receive the map area you are viewing and your IP address, like any website.
• Stripe, to process owner payments. Stripe is a data controller in its own right for the payment details you give it.
• Apple and Google, if you choose to sign in with them. They tell us your name and email; we tell them nothing about how you use ShedMap.
• Shed owners see only what you send them: a report, or a message if you contact them directly. They never see your location, saved list or email.

What we never do

• We do not sell your data, and we never will.
• We do not use advertising networks or tracking pixels.
• We do not share your location with shed owners or anyone else.
• We do not send marketing email unless you have asked for the weekly digest.

How long we keep it

We keep your data while your account exists. When you delete your account, we erase your profile, saved sheds, preferences and listing within 30 days.

Payment records are kept for six years after the payment, because HMRC requires it. Reports may be kept in anonymised form so we can spot repeat problems with a listing.

If you use ShedMap as a guest, the only data on our side is the technical data above. Your chosen postcode and radius stay on your phone.

Your rights

Under UK GDPR you can ask us to:

• Give you a copy of the personal data we hold about you (access).
• Correct anything that is wrong (rectification).
• Delete your data (erasure). You can do this yourself from Profile.
• Send you your data in a machine-readable format (portability).
• Stop processing based on legitimate interests (objection), or restrict processing while we check something.
• Withdraw consent for location or email at any time.

How to exercise them

Email privacy@shedmap.com from the address on your account. We reply within one month. We do not charge for this unless a request is clearly excessive.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO), the UK regulator. We would appreciate the chance to put things right first, but you do not have to come to us before going to the ICO.

Children

ShedMap is not designed for children under 13 and we do not knowingly collect data from them. You must be 18 or over to list a shed. If you believe a child has created an account, email privacy@shedmap.com and we will remove it.

Security

Data travels between the app and our servers over encrypted connections. Passwords are hashed and cannot be read by us. Access to account data is limited to the people who need it to run the service, and we review that access regularly.

No system is perfectly secure. If we discover a breach that affects you, we will tell you and the ICO as the law requires.

Changes to this policy

When we change this policy we update the date at the top. If a change affects your rights or how we use your data, we will tell you in the app before it takes effect.

Contact

Data requests and privacy questions: privacy@shedmap.com.

Everything else: hello@shedmap.com.

This policy is governed by the law of England and Wales.