Privacy Policy

Placey Address Ltd is the controller of the personal data described in this policy. You can reach us about anything in it at hello@placey.io.

Account information

When you create an account we collect your name, email address and a password. If you sign in with GitHub or Google instead, that provider shares basic profile information with us: your name, email address, profile picture and an account identifier. We never see or store your GitHub or Google password.

API request data

When your systems call the API we process the request itself (the postcode or address text being looked up and the API key used) along with technical details such as IP address, user agent, timestamp and response status. We use this to return results, count usage, enforce limits and keep the service secure.

Billing information

Card payments are handled by our payment provider. We don't receive or store full card numbers; we keep a record of your top-ups, invoices and balance.

Messages you send us

If you email us or use the contact form, we keep your message and contact details so we can reply and follow up.

We use personal data only where we have a lawful basis under UK data protection law:

• To perform our contract with you: creating your account, serving API requests, tracking usage and balance, and providing support.
• For our legitimate interests: keeping the service secure, preventing abuse and fraud, fixing problems, and understanding how the service is used so we can improve it.
• To meet legal obligations: for example keeping tax and accounting records.

We'll send you service messages about your account, such as low-balance warnings, security notices and changes to our terms. We don't sell personal data, and we don't use lookup queries to build profiles of individuals.

If you build Placey into your own website or app, the people typing addresses there are your users, not ours. You're responsible for telling them how their information is used. We process the lookup queries we receive from you only to provide and protect the service.

We only use cookies that are strictly necessary to sign you in: a session cookie that keeps you logged in to the dashboard, and short-lived security cookies set while you complete sign-in. Because these are essential, they don't require consent.

We don't use advertising cookies or third-party tracking cookies. If that ever changes, we'll update this policy and ask for your consent first.

We share personal data only where it's needed to run Placey:

• Service providers who host our infrastructure, process payments and deliver email on our behalf, under contracts that require them to protect the data and use it only on our instructions.
• Sign-in providers (GitHub or Google), to the extent needed to authenticate you when you choose to sign in with them.
• Authorities or advisers where the law requires it, or where it's necessary to establish, exercise or defend legal claims.
• A successor business, if Placey is ever sold or merged, subject to the commitments in this policy.

Some providers may process data outside the UK. Where that happens we rely on safeguards recognised under UK law, such as adequacy regulations or approved contractual clauses.

• Account information is kept while your account is open and deleted or anonymised within a reasonable period after you close it.
• API request logs are kept for a limited period for security, troubleshooting and billing, then deleted or aggregated so they no longer identify anyone.
• Billing records are kept for as long as tax and accounting law requires.
• Support and contact messages are kept for as long as needed to deal with your enquiry and maintain a record of it.

We use technical and organisational measures appropriate to the risk, including encryption in transit, restricted access to production systems and signed, encrypted session cookies. No system is perfectly secure; if you think you've found a vulnerability, please tell us at security@placey.io.

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that's inaccurate or incomplete;
• ask us to delete your data, or to restrict how we use it;
• object to processing that's based on our legitimate interests;
• receive the data you gave us in a portable format.

To use any of these rights, email hello@placey.io. We'll respond within one month. There's no charge in most cases.

If you're unhappy with how we've handled your data, please talk to us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Placey is a developer service and isn't directed at children. We don't knowingly collect personal data from anyone under 18.

We'll update this policy when what we do with personal data changes. The date at the top of the page shows the latest version, and we'll email account holders about significant changes.

For privacy questions or requests, email hello@placey.io or use our contact page. To report a security concern, write to security@placey.io. Our Terms of Service cover the rest of your relationship with us.