Privacy Policy & UK GDPR

The categories below reflect the most recent updates to the platform, including business listings, business analytics, the live community feed and the messaging service.

• Personal account details: full name, date of birth (to confirm you are 18+), email address, hashed password, optional phone number.
• Member profile: display name, avatar, postcode / approximate location, bio, reliability score and review history.
• Business listings (sellers/traders): business name, trading address, contact details, opening hours, category, description, photos, website / social links, and (where you choose to provide them) company number, VAT number or proof of trading address used for verification.
• Business analytics: aggregated counts of profile views, listing impressions, inquiries received, reviews and reply rates. These metrics are derived from interactions on the platform and shown only to the business owner in their dashboard.
• Listings & trades: titles, descriptions, photos, prices, offers, meet-up arrangements and transaction status.
• Messaging service: chat messages, image attachments, delivery and read timestamps, and reports of abuse. Messages are stored so conversations can be resumed across devices and to support dispute resolution and safety investigations.
• Reviews, inquiries & replies: star ratings, written reviews, business inquiries you send or receive, and replies — these feed both public profiles and the business analytics dashboard.
• Live community feed: public listings you publish appear in a rolling feed for up to 24 hours from the time of posting and are then automatically removed from the feed (the underlying listing remains until you end or delete it).
• Technical data: device type, browser, IP address, app/website version, crash and error logs, and basic security telemetry.
• Location data: only when you tap "Near me" or set a postcode — used to sort nearby listings. Precise GPS location is used in-session and is not stored.

We rely on one or more of the following legal bases for every processing activity on TrueLocal, in line with UK GDPR Art. 6 and ICO guidance.

• Contract (Art. 6(1)(b)): processing necessary to perform our contract with you — e.g. creating and running your account, publishing listings, delivering chat messages, processing inquiries, reviews and trades, and verifying a business so it can appear on the platform.
• Legitimate interest (Art. 6(1)(f)): fraud and scam prevention, safety moderation, calculating reliability scores, generating business analytics for the business owner, debugging and improving the service. A balancing test is recorded for each use; you have the right to object (see section 11).
• Legal obligation (Art. 6(1)(c)): retaining tax / accounting records, responding to lawful requests from UK authorities, complying with consumer protection law for businesses on the platform.
• Consent (Art. 6(1)(a)) and PECR: marketing emails, non-essential cookies/analytics, and precise device location. You can withdraw consent at any time.

The table below sets out the specific legal basis we rely on for each major processing activity.

• If you list as a business, certain information is treated as published business information rather than private personal data (e.g. trading name, business address, opening hours, public contact details) and is shown on your public profile.
• Sole traders should be aware that a trading name or address tied to an individual may still constitute personal data under UK GDPR; only publish what you are comfortable making public.
• Verification documents (e.g. proof of address, company number checks) are used only to confirm legitimacy, are access-restricted, and are deleted once verification is complete or your business listing is removed.
• Businesses acting as separate data controllers for customers they meet through the platform are responsible for their own UK GDPR compliance with those customers.

• Messages, image attachments and offers are stored on our UK/EEA hosted infrastructure so conversations sync across your devices and remain available for dispute resolution.
• We do not read private messages routinely. Automated systems scan for prohibited content, scams and safety risks. Human moderators only access a conversation when it is reported, flagged by automated systems, or required by law.
• Delivery and read receipts are processed to provide reliability scoring and to confirm that messages have been received.
• You can delete your own messages; copies may remain in encrypted backups for up to 90 days before being purged.

• Analytics shown to business owners (views, inquiries, reviews, reply rate, reliability) are computed from real-time interactions on their own listings.
• We show businesses aggregated metrics — not the personal identity of every visitor. Where an inquiry, review or reply is shown, it is shown because the other user chose to interact with the business publicly or directly.
• Analytics are used to help businesses improve their service; they are not sold to third parties or used for cross-site advertising.

• Other members — only your public profile, listings, reviews and the chat messages you choose to send.
• Trusted processors acting on our instructions under UK GDPR-compliant data processing agreements: cloud hosting, database, email delivery, image storage, error monitoring and (where you have consented) analytics.
• UK authorities and law enforcement, where we are legally required to disclose.
• Professional advisers (legal, accounting, insurance) bound by confidentiality.

• Account data: for as long as your account is open + 30 days after deletion.
• Live community feed entries: visible in the feed for up to 24 hours, then auto-removed.
• Listings, reviews, inquiries and chat history: 24 months for safety and dispute resolution.
• Business analytics records: 24 months, then aggregated/anonymised.
• Business verification documents: deleted once verification is complete or the listing is closed.
• Financial / tax records: 6 years (UK legal requirement).
• Encrypted backups are purged on a rolling 90-day cycle.

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your account and data.
• Restriction — ask us to pause processing while issues are resolved.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interest, including profile reliability scoring.
• Withdraw consent — for marketing, analytics or precise location at any time.
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or call 0303 123 1113. You may also complain to your local supervisory authority if you are based outside the UK.

We respond to all verified requests within one calendar month, as required by the UK GDPR. To request deletion of your account and all associated data, visit our account deletion request page or email truelocaluk@outlook.com.

• TLS 1.2+ encryption in transit, AES-256 encryption at rest.
• Row-level security policies on all user, listing, message and business tables.
• Passwords hashed with industry-standard algorithms; multi-factor authentication available.
• Least-privilege access controls, audit logging and regular security reviews.
• Personal data breaches notified to the ICO within 72 hours where required, and to affected users without undue delay where the risk is high.

• Meet in public places and share trip details with someone you trust.
• Never share bank PINs, full card details, ID numbers or one-time codes in chat.
• Report suspicious behaviour using the report button on any listing, profile or chat.
• We use automated and human moderation to detect scams and prohibited items.