Privacy policy · Updated 2 June 2026
This policy explains what personal data OneGoodArea collects, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
01 · Controller
OneGoodArea is operated as a sole trader based in the United Kingdom. For data protection enquiries, contact us at operation@onegoodarea.co.uk.
02 · What we collect
We collect the following categories of personal data:
Name, email address, and hashed password (for email/password accounts). For OAuth users, we receive your name, email, and profile image from the provider.
The endpoints you call, the postcodes and area codes you query, the request counts, and the timestamps of each request. Stored against your account and used for billing and usage analytics.
Page views, feature usage events, and dashboard interactions. Tracked internally for product improvement and associated with your account.
Billing details are collected and processed by Stripe. We do not store your card number, CVC, or full payment details. We retain your Stripe customer ID and subscription status.
Every account can generate API keys (Sandbox included). We store the key fingerprint plus a hashed form of the secret; the raw secret is shown to you once at generation and never persisted in plaintext.
Temporary tokens generated during account verification, stored until used or expired (24-hour window).
03 · How we use it
We process your personal data for the following purposes:
To authenticate you, execute API requests, track your usage against plan limits, and maintain your audit trail. Legal basis: performance of a contract.
To manage subscriptions, process payments, and handle billing queries through Stripe. Legal basis: performance of a contract.
To understand how the Service is used, identify issues, and improve features. Legal basis: legitimate interest.
To send account-related emails, including verification, password resets, and material changes to the Service or terms. Legal basis: performance of a contract and legitimate interest.
We do not sell your personal data to third parties. We do not use your data for advertising or profiling.
04 · Third-party services
We share data with the following third-party processors, each acting under data processing agreements:
Payment processing and subscription management. Data shared: Email, billing details, payment method.
Web application hosting and edge delivery. Data shared: Request logs, IP addresses.
API host (apps/api Fastify service). Data shared: Request logs, IP addresses.
PostgreSQL database hosting. Data shared: Account data, usage records, audit trail.
Intelligence query plane (planner only; never sees the rows). Data shared: Natural-language question text; no personal data is sent.
Transactional email delivery. Data shared: Email address, email content.
Authentication provider. Data shared: Name, email, profile image (provided by Google).
Police.uk, the IMD 2025 / WIMD 2019 / SIMD 2020 deprivation datasets, HM Land Registry, Ofsted, Companies House, OpenStreetMap, the Environment Agency, the ONS National Statistics Postcode Lookup, and Postcodes.io are queried server-side using only postcode or area-code data. No personal information is sent to these government or open data sources.
06 · Data retention
Account data is retained for as long as your account is active. If you request account deletion we will erase your personal data within 30 days, except where retention is required by law (for example, financial records for tax purposes are retained for up to 7 years).
is retained with your account for as long as the account is active, then deleted with the account.
expire and are deleted after 24 hours.
in Stripe are retained in accordance with Stripe's data retention policies and UK financial regulations.
07 · Your rights
Under the UK General Data Protection Regulation, you have the following rights:
You can request a copy of all personal data we hold about you.
You can ask us to correct inaccurate or incomplete data.
You can request deletion of your personal data. We will comply within 30 days, subject to legal retention obligations.
You can request your data in a structured, machine-readable format (JSON).
You can ask us to limit how we use your data in certain circumstances.
You can object to processing based on legitimate interest. We will stop unless we have compelling grounds to continue.
To exercise any of these rights, email operation@onegoodarea.co.uk with the subject "Data Request". We will respond within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
08 · Data security
We implement appropriate technical and organisational measures to protect your personal data, including: encrypted connections (HTTPS) for all traffic, passwords hashed with PBKDF2-SHA256 (600,000 iterations with a unique per-password salt), encrypted database connections to Neon Postgres, fingerprint + SHA-256 hash storage for API keys (raw secret shown once and never persisted), and environment-variable-based secret management on Vercel and Render.
While we take reasonable precautions, no method of transmission over the internet or electronic storage is 100 percent secure. We cannot guarantee absolute security.
09 · International transfers
Some of our third-party processors (Vercel, Stripe, Anthropic) may process data outside the UK. Where this occurs we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or equivalent mechanisms approved under UK data protection law.
10 · Children's privacy
OneGoodArea is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a user is under 16 we will delete their account and associated data promptly.
11 · Policy changes
We may update this Privacy Policy from time to time. Material changes will be communicated to registered users via email. The "Last updated" date at the top of this page indicates the most recent revision.
12 · Contact
For any privacy-related questions or data requests, contact us at operation@onegoodarea.co.uk.
See also our Terms of Service for the full terms governing use of the platform.