Privacy Policy

Home Social Network Last updated: [date]

1. Who we are

Home Social Network ("HSN", "we", "us", "our") provides branded social media content to UK estate agents via our website and dashboard (the "Service"). We are the data controller for the personal data described in this policy.

Data controller details: [Company legal name] [Registered company number] [Registered address] Contact: [email address, e.g. privacy@homesocialnetwork.com]

[If applicable: ICO registration number]

2. What personal data we collect

We collect the following categories of personal data when you register for and use the Service:

• Identity data — first name, last name.
• Contact data — mobile number, office number, email address, registered business address.
• Business data — legal entity name, trading name, website address.
• Account data — login email, password (stored in encrypted/hashed form, never in plain text).
• Content data — your uploaded logo, and any content or captions you interact with in the dashboard.
• Usage data — which pieces of content you download or view, when you log in, and general interaction with the dashboard, used to understand what content is useful to you.
• Payment-related data — we do not process or store your card or bank details directly. Payment is handled via GoCardless, a third-party payment provider; see Section 6.

We do not knowingly collect any special category data (e.g. health, religious belief, ethnicity) and ask that you do not submit any such information to us.

3. How we collect your data

• Directly from you, when you register an account, update your account settings, or contact our support team.
• Automatically, through your use of the website and dashboard (see our separate Cookie Policy).

4. Why we use your data, and our legal basis

| Purpose | Legal basis under UK GDPR | |---|---| | Creating and managing your account | Performance of a contract (Article 6(1)(b)) | | Generating and delivering branded content to your dashboard | Performance of a contract | | Processing payment for paid plans | Performance of a contract | | Sending you service-related emails (e.g. "your content is ready," logo issues) | Performance of a contract | | Sending you marketing communications (if you've opted in) | Consent (Article 6(1)(a)) — you may withdraw this at any time | | Verifying the legitimacy of Free Seasonal tier sign-ups | Legitimate interests (Article 6(1)(f)) — preventing fraudulent or fake registrations | | Improving our Service, understanding which content is useful | Legitimate interests | | Complying with our legal and tax obligations | Legal obligation (Article 6(1)(c)) |

5. Automated decision-making

We do not use your personal data for any automated decision-making or profiling that produces legal or similarly significant effects on you. Content delivery to your dashboard is rules-based (driven by your selected plan) rather than an automated decision about you as an individual.

6. Sharing your data with third parties

We share limited personal data with the following categories of third party, solely to operate the Service:

• Supabase (database, authentication, and file storage provider) — hosts the personal data described in this policy.
• `[Image-generation provider, e.g. Bannerbear/Placid]` — processes your uploaded logo in order to generate branded content.
• GoCardless — processes payment where you're on a paid plan. GoCardless has its own privacy policy governing your payment data; we do not receive or store your bank details.
• `[Email service provider, e.g. Postmark/Resend]` — used to send you automated service emails.
• `[Dataloft / PriceHubble]` — if you subscribe to Dataloft market-data content, your local area is used to source relevant local market data; no other personal data is shared with Dataloft.
• Trusted Estate Agent Network ("TEAN") — [complete once TEAN's data-sharing arrangement is finalised — e.g. if you are a TEAN member, limited account status data may be shared between HSN and TEAN to administer your combined membership].
• Partner networks (e.g. Martin & Co, eWeMove) — [complete: if you are onboarded via a partner network, describe what, if anything, is shared with that network].

We do not sell your personal data to any third party.

We may also share data with professional advisors, regulators, or law enforcement where required by law.

7. International data transfers

[Complete based on actual hosting: e.g. "Our data is hosted within the UK/EU via Supabase's UK/EU data region. Where any provider processes data outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an adequacy decision."]

8. How long we keep your data

• Active account data is retained for as long as your account remains active.
• After account cancellation, we retain your data for [X months/years — confirm with legal/accounting requirements, e.g. 6 years for UK tax/accounting records] to meet our legal, accounting, and tax obligations, after which it is securely deleted.
• Published content history relating to your account is retained as a permanent record for quality-control and support purposes, per our data retention schedule.

9. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erasure ("right to be forgotten"), subject to our legal retention obligations (Section 8).
• Restrict processing in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at [privacy email]. We will respond within one month, as required by law.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data appropriately.

10. Data security

We take appropriate technical and organisational measures to protect your personal data, including encrypted storage, access controls restricting data access to authorised HQ staff only, and secure hosting via Supabase.

11. Children's data

The Service is intended for use by business professionals (estate agents) and is not directed at, or intended for use by, children. We do not knowingly collect data from anyone under 18.

12. Changes to this policy

We may update this policy from time to time. We will notify you of material changes via email or a notice on the dashboard.

13. Contact us

If you have any questions about this policy or how we handle your data, contact: [privacy email / postal address].