Privacy Policy

This privacy policy explains how LocalShout ("we", "us", "our") collects, uses, and protects your personal data when you use our website at localshout.co.uk and its subdomains.

We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data we collect

Information you provide

• Contact information — if you contact us via email, we store your email address and message content to respond to your enquiry.
• Account information — if you sign in via Google, we receive your name, email address, and profile picture from Google. This is used solely to identify your account and personalise your experience. We do not access your Google contacts, calendar, or any other Google services.

Information collected automatically

• Location data — with your explicit consent, we use your device's geolocation API to show events near you. This data is processed in your browser only and is not sent to our servers or stored.
• Usage data — we use Umami, a privacy-friendly analytics tool, to collect anonymised usage data including pages visited, referring URLs, browser type, and device type. Umami does not use cookies and cannot identify you personally. We self-host Umami on our own infrastructure, so your data is never shared with third parties.
• Local storage — we store your filter preferences (such as hidden tags and distance radius) in your browser's local storage. This data stays on your device and is never transmitted to us.

2. Cookies

We use strictly necessary cookies to ensure the website functions correctly. These do not require consent under UK GDPR as they are essential for the service.

We do not use advertising cookies or tracking cookies. If we introduce analytics cookies in the future, we will update this policy and obtain your consent before setting them.

3. How we use your data

We use the data we collect to:

• Display events relevant to your location and preferences
• Respond to your enquiries
• Improve the website through anonymised usage analytics
• Ensure the security and performance of our service

4. Legal basis for processing

We process your data on the following legal bases:

• Consent — for geolocation data (you can revoke this at any time through your browser settings)
• Legitimate interests — for anonymised analytics and service improvement
• Contractual necessity — for responding to your enquiries

5. Data sharing

We do not sell your personal data. We may share anonymised, aggregated data with hosting and analytics providers to operate the service. Our infrastructure providers include:

• Vercel — website hosting (servers in the EU/UK)
• Supabase — database hosting and authentication (servers in the EU)
• Sentry — error monitoring. When an application error occurs, technical details (browser type, error message, page URL) may be sent to Sentry to help us diagnose and fix issues. This does not include your personal information unless you are signed in, in which case your user ID may be attached to help us investigate account-specific problems.
• Google — if you sign in with Google, authentication is processed through Google's OAuth service. See Google's Privacy Policy.

6. Data retention

• Account data — retained for the lifetime of your account. You can request deletion at any time via our contact page.
• Contact enquiries — retained for up to 12 months after your last communication, then deleted
• Analytics data — anonymised and retained for up to 26 months
• Local storage data — remains on your device until you clear your browser data

7. Your rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restrict processing — ask us to limit how we use your data
• Data portability — receive your data in a portable format
• Object — object to processing based on legitimate interests
• Withdraw consent — at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at the details below.

8. Children's privacy

Our service is not directed at children under 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

9. Changes to this policy

We may update this privacy policy from time to time. We will post the revised policy on this page with an updated "last updated" date. Material changes will be highlighted on the website.

10. Contact

If you have questions about this privacy policy or wish to exercise your data rights, please contact us. See also our Terms of Service.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.