Privacy
This notice describes what the product actually does, not what a template says a product like this usually does. It has not been checked by anybody qualified.
Registered with the ICO: ZC265534. Wellington Web Co Ltd is on the Information Commissioner's Office register of data protection fee payers from 3 October 2026. You can check the entry at ico.org.uk.
The short version
You tell us where you live, where you are thinking of moving and what matters to you. We use that to build your plan and for nothing else. We do not sell it, we do not build an advertising profile from it and we do not pass it to anybody who wants to sell you a mortgage.
If you buy a data pack, we keep the place and the distance you chose, for the same twelve months and for the same purpose: to build your pack and for nothing else.
If you make an account for job search, we keep what is listed under “Accounts and job search” below, for as long as the account exists and for that purpose and nothing else.
Where you are thinking of moving is sensitive information, even though the law does not formally classify it that way. People tell us things they have not told their employer or their family. We treat it accordingly.
What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Your email | Stripe asks for it when you pay and sends your receipt to it. It stays with Stripe: it is not stored with your plan and we only use it to answer you or to refund you | Performing our contract with you |
| Your current postcode | Your plan compares everywhere else against where you are now. Without it there is no baseline | Performing our contract |
| The areas you are considering | They are what the plan is about | Performing our contract |
| Your three priorities | The plan is built around them | Performing our contract |
| Who is moving, if you choose to say | One of nine kinds of move, such as downsizing or choosing for a parent. The plan puts the figures that bear most on it first. It says nothing about anybody's health | Performing our contract |
| Anything you say would rule a place out | Places it applies to are flagged in the plan | Performing our contract |
| What you write in your own words, if you write anything | One box on the questionnaire, for what the figures do not measure. It sets which limits the next step asks you about and is quoted back to you there, so you can see what it was read as. It is part of your answers and kept with them | Performing our contract |
| The ages and work of the people moving, if you give them | They set which kinds of place, reasons for moving and limits the questionnaire offers you first. They are part of your answers and kept with them | Performing our contract |
| Feedback, if you send any | What you write in “Tell us what’s wrong or missing” on the map, with the place open and what the map was showing, so we can find what you mean. Your email only if you give it, used only to answer you. Never your postcode | Our legitimate interest in correcting the figures and the site |
| Your account, if you make one for job search | Your email address, to sign you in, to confirm it is yours and to send you what you asked for. Your password, which we keep only in hashed form: a scrambled version we can check a password against but cannot turn back into the password. The search you save: the place you chose (its name, its postcode and its map coordinates), how far from it, your work in your own words and the lowest pay, the hours and the kind of contract if you choose to give them. That postcode is kept in the saved search apart from any plan or data pack. It goes when you delete the account. The state of your subscription, with the references Stripe gives us for your customer record and your subscription. Also the date each monthly email was last sent, so nobody is sent two in a month. The dates the account was made, confirmed, had its password changed and had its search saved. Also when we last emailed you a link, so nobody can be sent more than one every few minutes. Also the sign in records (one for each time you sign in, thirty days) and the one time links we email you (one to confirm your address, which lasts twenty four hours; one to set a new password, which lasts one hour). Each is deleted when you sign out or use the link. One that has run out is cleared at our monthly tidy | Performing our contract |
| A job search that came with a pack or plan | When you pay for a data pack or a plan from 12 November 2026, we note against the email address you gave Stripe at checkout that a job search came with it, the date and the reference of the pack or plan. If you later make an account with that address and confirm it, the account picks up the job search. No note is held for a pack or plan bought before then. We note it whether or not you ever make an account | Performing our contract |
| Payment confirmation | To know your order is paid and to refund you if you ask | Performing our contract and our legal obligation to keep records |
We never see your card. Payment is handled entirely by Stripe. We receive a confirmation that an order is paid and the last four digits; the card number does not reach us and we do not store a card for future use, because there is nothing to renew.
Who else sees it
| Who | What they get |
|---|---|
| Stripe | Your payment details and email, which you give them directly. From us, a reference number for your plan and nothing else: not your postcodes or the places you named. For a job search subscription we also give Stripe the email on your account and a reference to the account. They are the payment processor and their own privacy terms apply |
| Netlify, our hosting | Your answers and the plan built from them, which sits on a page with an unguessable address. Netlify builds the plan and stores it. It also stores any feedback you send and, if you make one, your account |
| postcodes.io | Each postcode or place name you type on the order page, passed on by our server so it can show you what it found before you pay. The postcode you choose for a saved job search is checked there the same way when you save it. On the map, each postcode you search for or give as your home, sent from your browser, so postcodes.io also sees your IP address. Nothing else about you goes with either |
| Anthropic | Only the ages and work of the people moving, the kinds of place you add (a school or a station, never which one), the reasons for moving you pick and what you write in your own words, if you write anything at all. Our server sends them to Anthropic's Claude. From the ages, the work and the kinds of place it answers with the order to offer the questionnaire's own kinds of place and reasons for moving in. From all of them together it answers with which of the questionnaire's own limits each reason you picked points to for you. From your own words it answers with which of the questionnaire's own lines they point to and the words of yours that point to each. Nothing else goes with them: we do not add anybody's name, your postcode or address, the names or addresses of the places you named or your email. What you type as someone's work or in your own words goes as you wrote it. We store none of it, because it goes there while you are still filling the questionnaire and is gone from our server when the request ends. Anthropic deletes what it receives within thirty days and its terms do not allow it to train its models on it. It decides nothing about you: it orders the questions and options and can add limits to the ones you are asked about, but never takes one away. You still answer every one of them yourself |
| Resend | Resend sends the emails an account needs: the link to confirm your address, the link to set a new password, the note that an account already exists and the monthly list of jobs. For each one it receives your email address and the email itself, which holds your place, your work as you described it and the jobs chosen. It is an email service and uses them to deliver the email. Resend is a company in the United States and its own terms apply to how it moves data between countries |
| Anthropic, for job search | To choose which jobs fit you, our server sends Anthropic's Claude your work in your own words, as you wrote it. For each job on offer it also sends the reference, the title and a short summary, which come from the job's advertiser. Nothing else goes: not your name, your email address or your postcode, nor the place you chose. Claude answers with a list of the references that fit. Nothing it writes reaches you. If it cannot answer, we match by words in the job titles instead and the email still goes. We store none of what is sent. Anthropic deletes what it receives within thirty days and its terms do not allow it to train its models on it |
| Esri | Only if you switch the map to Satellite: your browser fetches the aerial photographs for the part of the map on screen from Esri's ArcGIS service, which sees that area and your IP address |
| jsDelivr and the Office for National Statistics | When you look closer at a council, your browser fetches its neighbourhood boundaries from jsDelivr, which sees which council that is. To choose the photographs for a town you open, it asks the Office for National Statistics' ArcGIS service for the outline of the town around that town's point, which it sends. Each sees only that and your IP address |
| Geograph | When you open an area on the map or keep it on your shortlist, your browser fetches photographs taken there from Geograph Britain and Ireland. Geograph sees which area that is and your IP address, as any site you load a picture from does, but nothing else about you. That includes the area you give as your home, whose photographs are shown too: Geograph sees a request for photographs of that area, not that it is your home |
Nobody else. We do not share your data with estate agents, mortgage brokers, conveyancers, removal firms or anybody else, whether or not they pay us. If that ever changes, it will change with your explicit consent, asked for separately and not by us updating this page.
What the plan looks up and what it does not
Building your plan means querying public data about places. It is done by software as soon as you pay; nobody at Groundsense reads your answers to do it. Those queries carry a postcode and nothing about you: no name, no email, no indication that anybody is thinking of moving. The organisations behind those sources see a request about an area, which is what they publish the data for.
We do not look you up. No credit reference, no electoral roll, no social media, no data broker.
Some of your answers are read before you pay. The ages and work of the people moving, the kinds of place you add, the reasons for moving you pick and anything you write in your own words are read while you are still on the questionnaire, so the steps after them offer what fits you first. Besides the postcodes and place names postcodes.io checks for you, those are the only parts of your answers that go anywhere before payment. The only place they go is Anthropic.
Accounts and job search
An account is optional and is only for job search. You make one with an email address and a password and we send a link to that address to confirm it is yours. You follow the link and enter your password to confirm it. Until then the account cannot be signed in to. Once it is confirmed you can save a search. Each month, if your job search is active, we email you up to ten jobs near the place you chose that fit your work, each linking to the advertiser's own page. Every email has a link to change your search and one to stop the emails.
Your job search is active if you have a paid subscription. It is also active for three months after a data pack and with no end after a plan. The monthly email of a pack or plan's job search is sent even if you have no paid subscription. To stop those emails, delete your account: the account page has no other way to stop them. If you only have a paid subscription, cancelling it stops the payments and the emails.
Anybody can type any email address when they make an account, so the owner of an address may get an email from us they did not ask for: a link to confirm the address or a note that an account with it already exists. We send no more than one of each every few minutes. Past a daily limit we send no account emails at all until the next day. If nobody follows the link, the unconfirmed account is removed once it is more than thirty days old, at our monthly tidy.
When you subscribe, Stripe takes your payment and your card details, as it does for a plan. We never see the card. Stripe tells us the state of the subscription, whether it is on the monthly or the yearly price and its reference. We keep those with your account.
Your account lives in the same European Union region as your plan. You can change your search, sign out or delete your account from your account page. Deleting it removes your account, your saved search, your sign in records and your links at once and ends any paid subscription at once. We do not refund the rest of the period you paid for. What stays is described under “How long we keep it”.
How long we keep it
- Your plan and the answers behind it: twelve months from the day you buy it, then deleted automatically. People come back to a plan months later and a move takes longer than people expect. After twelve months it is gone.
- Answers you never paid for: two days. The order page keeps your answers while you are on Stripe's payment page. If no payment follows, they are deleted automatically within two days.
- Your account: until you delete it. That covers your email address, your hashed password, your saved search, your subscription references, the dates on the account and when we last emailed you. When you delete the account all of that goes at once, with your sign in records and your links. An account whose address is never confirmed is removed once it is more than thirty days old, at our monthly tidy. Sign in records and links that have run out are cleared then too. What stays is the note that a pack or plan came with a job search. It is held against a code made from your email address, not the address itself. It is kept for six years from the purchase, the same as the payment record described next. Our monthly tidy removes it after that. Stripe keeps its own records of a subscription under its own terms.
- Payment records: six years, because HMRC requires it. That is the fact of a transaction, not your postcodes.
- Emails you send us: two years.
- Feedback you send from the map: two years, then deleted automatically.
Ask and we delete it sooner. Email us and we will remove your plan and your answers and confirm when it is done. The payment record has to stay, because we are not allowed to destroy it.
Your rights
You can ask for a copy of everything we hold about you, ask us to correct it, ask us to delete it or object to what we are doing with it. Email finlay@wellingtonwebco.com and we will answer within thirty days, usually much sooner because we are small.
If you are not happy with how we handle it, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you came to us first, but you do not have to.
Cookies
This site sets no cookies unless you sign in to an account or reset your password. It runs no advertising or tracking scripts. If you go through to checkout, Stripe sets what it needs to process the payment and to prevent fraud.
When you sign in to an account or reset your password we set one cookie, called gs_session, which holds a random code that lets us know it is you. It is needed for the account to work and is set only when you sign in or reset your password. It lasts thirty days or until you sign out, can be read only by our server and is sent only to this site. It does not track you and we do not use it for anything else.
The order page keeps your answers in your browser's session storage while you are on Stripe's page, so they are still there if you come back to change something. It never leaves your device and your browser clears it when you close the tab.
Where the data lives
Your answers and your plan are stored in the European Union, in Netlify's Frankfurt region. Accounts are stored there too. The software that checks your places and builds your plan runs on Netlify's servers in London. Stripe processes payments under its own terms, which cover how it moves data between countries. Resend, which sends our account and job emails, is in the United States and its own terms cover the same. If any of this changes, this page is updated first.
Some of your answers leave the United Kingdom and the European Union. The ages and work of the people moving, the kinds of place you add, the reasons for moving you pick and what you write in your own words are read by Anthropic's Claude, which runs in the United States, under Anthropic's own terms for how it moves data between countries. They are the only parts of your answers that go there and they are not stored there beyond the thirty days Anthropic takes to delete them. For job search, your work in your own words and the title and summary of each job on offer go there in the same way. Nothing else does. We never add a name, your postcode or an address to them, nor anything else about you, though what you type as someone's work or in your own words goes as you wrote it.
Changes
If this notice changes in a way that affects a plan you have bought, we tell you at the email address you paid with rather than quietly updating the page and relying on you to notice.