Privacy notice

Who is responsible for your data?

AuBea Data Tech Limited is the controller responsible for personal data processed through StreetPing. The company is registered in England and Wales under company number 17553247. Registered office: 22 Regent Street, Nottingham, NG1 5BQ. For privacy enquiries or to exercise your rights, email contact@streetping.co.uk.

This notice applies to visitors and people submitting reports. Location-based observations can also affect people at a reported location, even though reports do not ask for their names.

Crowdsourced data notice

The information displayed through StreetPing is crowdsourced from community observations and represents trend indicators only. It does not constitute a formal property valuation, legal survey, or definitive statement of area safety.

Reports reflect individual user perceptions at a specific time and place. Patterns may help indicate recurring local concerns, but they should not be relied upon as evidence in legal, financial, or formal regulatory proceedings without independent verification.

What we collect

• The category and type of nuisance you report.
• The GPS coordinates of the spot you report from, and the nearby street, postcode and town looked up from those coordinates.
• A randomly generated device identifier, stored in your browser, so we can prevent duplicate reports and enforce fair-use limits.
• The date and time the report was submitted.
• A count of submissions grouped into the same nearby event. This is not proof that an incident occurred.
• Technical information received by the website and its providers, such as IP address, browser and device information, requests and diagnostic information.
• If you email us, your email address and the information you choose to include.

The public reporting form does not ask for names, contact details, photographs or written descriptions. There are no public reporting accounts or sign-in. Location and device data can nevertheless be personal data. The separate good-vibes page, if used, records positive categories and location data separately from nuisance reports.

Reports do not accept free-text descriptions of individuals or vehicle registration numbers. StreetPing does not use continuous background location tracking or offer user-to-user messaging. These design limits reduce intrusion; they do not make exact location, time and device records automatically non-identifiable.

No names does not mean fully anonymous

Reports are submitted without giving your name, but the records are not necessarily anonymous under UK data protection law. Device identifiers are pseudonymous: repeated submissions can be linked to the same browser. Exact locations, timestamps and technical information may identify a reporter or someone at a location when combined with other information. We therefore treat potentially identifiable records as personal data rather than claiming that removing names makes them anonymous.

Location comes from your device after you allow browser location access. Address information is obtained by looking up those coordinates. GPS and address lookups can be inaccurate; reports are observations, not verified findings about a person or property. If a matter requires a named report or witness statement, contact the police or local authority directly.

Third-party services

StreetPing uses Google Maps to display the live map. When you open the map, Google receives technical information from your device (such as your IP address and the area of the map you view). Google also receives coordinates for address lookups. Google Fonts supplies the website's fonts and receives technical information when your browser requests them. See Google's privacy policy.

Lovable provides the website platform and Lovable Cloud provides report storage. Hosting, delivery and support providers may process technical information or stored data to operate these services. The website also provides visit and page-view statistics; these are separate from nuisance report records. See Lovable's privacy policy.

Suppliers may process information outside the UK. Any restricted international transfer requires a lawful transfer arrangement, such as an applicable UK adequacy regulation or appropriate contractual safeguards and the required assessment. Contact us for details of the suppliers, processing locations and safeguards applicable to your data. This notice does not claim that all processing takes place in the UK.

Device identifiers and storage on your device

To prevent duplicate submissions and apply reporting limits, the app stores a device identifier and the time and coordinates of your last report in your browser's local storage. The good-vibes page stores its last report separately. These records can remain until you clear that storage. Private dashboard access also uses browser session storage for its access code. These uses are intended for the reporting and access-control services, not advertising or tracking across other websites.

UK rules on cookies and similar technologies also cover local storage. An exemption must apply for storage or access without consent; where consent is legally required for optional analytics or other technologies, it must be obtained before they operate. Browser GPS permission is separate from cookie consent and from our lawful basis for processing report data. You can withdraw location permission in your browser or device settings; without location access, you cannot submit a GPS report.

Optional analytics must not operate before any legally required opt-in consent. This notice does not confirm that a cookie consent interface or consent controls for all optional analytics have been implemented or verified.

Our lawful basis (UK GDPR)

For ordinary report processing, service operation, abuse prevention and responding to enquiries, our intended lawful basis is legitimate interests under Article 6(1)(f) of the UK GDPR. These interests are understanding community nuisance patterns, running a reliable service and protecting it from misuse. This basis requires processing to be necessary and our interests to be balanced against people's rights and reasonable expectations; it does not override them. You have a right to object to processing based on legitimate interests.

Where disclosure or retention is required by law, the applicable basis may be legal obligation. We do not claim to exercise a council's or police force's public authority. Proposed future uses need their own assessment before they begin.

Legitimate interests and impact assessments

The intended community benefit is to understand nuisance trends and, in future, help councils consider community safety and resource allocation. A documented legitimate interests assessment must examine the purpose, necessity and balance against individuals' rights, including less intrusive alternatives and safeguards.

We must assess whether a Data Protection Impact Assessment (DPIA) is required and complete one before processing likely to result in a high risk to people's rights and freedoms. Relevant risks include precise locations, allegations about identifiable people, children's access and proposed sharing. Completion of a formal assessment has not been confirmed here; an assessment is not a guarantee of total privacy or compliance.

Allegations about identifiable people

Some reporting categories may imply criminal conduct. If a report relates to an identifiable person, an allegation can be criminal-offence data even if it is unproven and no name is entered. Processing this data requires both a lawful basis and additional authorisation under Article 10 UK GDPR and the Data Protection Act 2018; legitimate interests alone is not enough. This notice does not assert that a particular additional condition has been met.

StreetPing is not a police reporting service and submissions are not verified criminal records. Do not use it for an emergency or a crime in progress: call 999 in a UK emergency, or 101 for non-emergency police reporting. Outside the UK, use your local emergency number.

How we use reports

Reports are used to understand location-based trends and operate the live map. The public map displays recent category-coded locations for about 60 seconds; it does not display device identifiers or the private report history. A short-lived pin can still reveal information about a location, and disappearing from the map does not delete the stored report.

At the present time, no council, police force or other organisation has been approached or given access to private reports. Detailed records are restricted to the site administrator, with service providers processing data as needed to operate the service. We may have to disclose information when legally required; any request must be assessed for a lawful basis.

Future proposals include aggregated insights for councils, police and housing providers, and paid area summaries for homebuyers. These are not current data-sharing arrangements. Before introducing them, we must assess their lawful basis, privacy risks and recipients and update this notice. Aggregating records does not automatically anonymise them: small groups and precise locations can still identify people. Homebuyer summaries must not expose individual GPS coordinates.

Data retention

Our revised proposed retention schedule replaces the earlier ten-year policy with a maximum five-year horizon from collection for historic, year-on-year comparisons. This schedule is subject to legal review and implementation; it is not a statement that the service already performs these deletions or conversions automatically.

• Up to 12 months from collection: retain precise GPS coordinates and exact timestamps only where necessary for report operation and local trend analysis. No council currently has access to these records.
• After 12 months and up to five years from collection: the proposed process is to permanently remove precise GPS coordinates and convert records into regional aggregate statistics, such as counts by electoral ward, rather than retain individual location logs.
• At five years from collection: delete the retained trend data under the proposed schedule.

Removing GPS coordinates alone does not establish true anonymisation. Exact timestamps, device identifiers, street and postcode detail, rare events and small counts must also be addressed, and the risk of identification using other available information assessed. Information remains personal data unless it is genuinely anonymised. Identifiable fields must be deleted or genuinely anonymised earlier if no longer necessary; the proposed maximum periods do not justify keeping every field until those limits.

Browser records remain until cleared; supplier logs and correspondence may have different retention periods. Contact us for the retention arrangements applicable to your information. Public pins disappear after about 60 seconds, independently of stored-report retention.

Children

StreetPing is not intended for children under 13. However, public reporting does not ask for age, so we cannot verify that children do not use it. An age statement alone does not remove obligations to protect children. Whether the ICO Children's Code applies depends on whether the service is likely to be accessed by under-18s and needs assessment. A parent or guardian concerned about a child's data can contact us; please do not send unnecessary identifying details about the child.

Privacy-protective design choices include no public accounts, no free-text reports, no photographs, no user-to-user messaging and no continuous background location tracking. These choices do not establish compliance with the Children's Code. The assessment must also consider the public location pins, location permission, data minimisation, suitable age-appropriate information and high-privacy defaults before any claim of compliance.

Your data protection rights

Depending on the circumstances, you can request access to your personal data, correction of inaccurate data, erasure or restriction of processing. You can object to processing based on legitimate interests. Data portability applies in certain circumstances when automated processing is based on consent or a contract; it does not apply to all StreetPing records. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. These rights are not absolute: lawful exemptions may apply, and deletion is not guaranteed for every request.

Email contact@streetping.co.uk to make a request. Because we do not have public accounts or names attached to reports, we may need limited additional information to locate records and verify that they relate to you. We do not need to collect new identifying data solely to identify you if it is otherwise unnecessary. We normally respond within one month; where a lawful extension applies, we will explain it. No solely automated decisions with legal or similarly significant effects are made about you; automated checks can reject submissions for reporting limits or suspected abuse.

Complaints and the ICO

Please contact us if you are unhappy with how we handle your personal data. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. Visit ico.org.uk/make-a-complaint or call 0303 123 1113.

No ICO registration number for AuBea Data Tech Limited is stated here until its registration is confirmed. An individual's registration is not evidence that this separate company is registered. ICO registration or payment of the data protection fee is not certification that a service complies with data protection law.

Contact

We will update this notice when our processing changes, including before any proposed new sharing arrangements begin. If you have questions about this notice or the data StreetPing collects, email us at contact@streetping.co.uk.