Where in

Privacy policy & cookies

This policy explains what Where in London collects when you use the site, what it does not, which third parties are involved, and how to control all of it.

Last updated

Who is responsible

Where in London is an independent website operated by a sole individual based in the United Kingdom, acting as the data controller for the purposes of UK GDPR and the Data Protection Act 2018. For any privacy question or request, contact dojostack@proton.me.

The short version

  • There are no user accounts, and you are never asked to register.
  • Salary and lifestyle choices stay in your browser. A place or postcode search is sent to the location provider described below, and only its resulting coordinates are sent to this site’s commute service.
  • Your shortlist is saved in your own browser, not in a database.
  • Optional analytics and advertising storage are only used for the categories you accept, and you can change your mind at any time.
  • Your data is never sold.

What is stored on your device

Your shortlist.When you save neighbourhoods, the list is written to your browser ’s local storage so it survives a refresh. It stays on your device, is never transmitted to this site, and clearing your browser data removes it.

Your privacy choices. Your answer to the consent banner is stored locally so you are not asked on every page. This is strictly necessary to honour your preference and cannot be switched off.

Advertising (Google AdSense)

This site is funded by advertising served by Google. Google is an independent data controller for the advertising it delivers.

Advertising scripts and cookies load only after you accept them. If you decline, or have not yet answered the banner, the Google advertising script is not loaded and no advertising cookies are set by it.

If you accept, Google and its partners may use cookies and similar technologies to serve contextual, non-personalised ads, measure their performance, and limit how often you see the same ad. Ad selection can use the page you are viewing and a coarse location derived from your IP address, but this site asks Google not to base ads on your past activity on other websites.

You can opt out of personalised advertising at any time through Google Ads Settings, and review how Google handles data from sites that use its services in Google’s partner-sites notice and its privacy policy. Broader industry opt-outs are available at aboutads.info and Your Online Choices.

Analytics

The site uses Vercel Web Analytics to count page views and see which guides are useful. It does not set analytics cookies or use a persistent cross-site identifier. It reports aggregate information such as page path, referrer, country and device type.

If you accept Anonymous analytics, Google Analytics also records a small set of finder milestones: starting and completing the finder, viewing a recommendation, changing or viewing a shortlist, sharing results, and viewing or submitting the reviewed-shortlist offer. It also records the entry page, broad source type, city, broad price band and counts of recommendations or saved areas where relevant.

Exact addresses, postcodes, salary, email address and free-text form answers are not sent to analytics. Google Analytics is not loaded until you accept that category. Testing traffic marked by the operator is labelled as internal so it can be excluded from reporting.

Reviewed-shortlist requests

If the reviewed-shortlist experiment is available and you submit its form, the site sends the information you provide to the operator’s configured request receiver. This includes your email, budget, approximate workplace, travel pattern, household, moving timescale, selected priorities, deal-breakers and any areas carried over from your shortlist.

That information is used only to assess and respond to your request and, if you proceed, fulfil the review. It is not sent to analytics or sold. Enquiries that do not proceed will be deleted within 90 days; fulfilment and payment records may need to be retained longer where tax or legal rules require it.

Hosting and server logs

The site is hosted by Vercel Inc., which processes requests on its infrastructure and keeps standard operational logs. See the Vercel privacy policy.

A small number of interactive features call this site’s own API. To stop those endpoints being abused, requests are rate-limited using a one-way SHA-256 hash of connection details such as IP address and browser user-agent. The hash is held in memory only, expires within minutes, is never written to a database, and cannot be reversed to identify you. The lawful basis is legitimate interests — keeping the service available.

Location search

When you search for a London place, station, street or postcode, the text you enter is sent directly from your browser to a location lookup service. UK postcodes are looked up through Postcodes.io; other searches use the OpenStreetMap Foundation’s Nominatim service. The provider receives the search text and ordinary connection information such as your IP address. Do not enter confidential information into the location box.

After a place is selected, this site’s own commute and map services receive its latitude and longitude so they can calculate results. The original search text is not stored by this site, and the coordinates are cached only as part of general route results, not against an account or user profile.

What is never collected

There is no account system, so no names or passwords are collected. An email address and planning details are collected only if you deliberately submit the reviewed-shortlist request described above. The salary, commute and lifestyle inputs you enter into the neighbourhood finder are not stored against you. Location search and coordinate processing are described above. If you use the contact form, it composes a message in your own email application — the form does not send anything to this site, and only what you actually choose to send reaches the inbox above.

Legal bases

  • Consent — optional Google Analytics, advertising cookies and any non-essential storage. Withdrawable at any time.
  • Legitimate interests — Vercel’s cookieless aggregate page analytics, responding to shortlist enquiries, abuse prevention, and keeping the site secure and available.
  • Strictly necessary — remembering your cookie choice.

Changing or withdrawing consent

Use the Cookie settings link in the footer of any page to reopen the banner and change your answer. Declining stops optional analytics and advertising scripts loading on subsequent pages. To remove cookies already set by Google, clear cookies for this site in your browser settings, and use the Google opt-out links above.

Your rights

Under UK GDPR you have the right to access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent at any time. Because the site holds no account and no identifiable records about visitors, most requests can be answered simply by explaining what is described here.

To make a request, email dojostack@proton.me. If you are unhappy with the response, you can complain to the Information Commissioner’s Office, the UK supervisory authority.

International transfers

Google and Vercel are US-headquartered and may process data outside the UK. Both rely on recognised safeguards for such transfers, including the UK extension to the EU-US Data Privacy Framework and/or standard contractual clauses.

Children

This site is aimed at adults looking for somewhere to live and is not directed at children. No personal data is knowingly collected from anyone under 13.

Changes to this policy

If this policy changes materially, the date at the top will be updated and the consent banner will be shown again where the change affects what you previously agreed to.

Questions

Anything here unclear, or want to make a data-protection request?