Draft — under review
This privacy notice (version privacy-v2) is a draft that a reviewer is finalising. Items [IN BRACKETS] haven't been filled in yet. We'll ask you to agree again if it changes in a way that matters.
Privacy notice
Last updated: [DATE] · Version: privacy-v2
This notice explains what personal data Peabudy collects, why, who we share it with, how long we keep it and what your rights are. It applies to people using Peabudy in London (UK) and Lagos (Nigeria).
1. Who we are
Peabudy is run by [CONTROLLER NAME] ([COMPANY NUMBER OR "a sole trader"]), [REGISTERED ADDRESS]. We're the data controller for the personal data described here.
- Contact for anything about your data: [CONTACT EMAIL]
- Data protection officer: [DPO NAME AND EMAIL, or "We haven't appointed a data protection officer because we're not required to. Contact us at the address above."]
- UK: [ICO REGISTRATION: "We're registered with the Information Commissioner's Office, registration number [NUMBER]" or "We're exempt from the ICO data protection fee because [REASON]"]
- Nigeria: [NDPC STATUS: e.g. "We're registered with the Nigeria Data Protection Commission as [CATEGORY]" or "We're not currently required to register with the Nigeria Data Protection Commission"]
- [UK OR NIGERIAN REPRESENTATIVE, if counsel says one is needed]
2. The short version
- We use your data to find you compatible people to live with, let you talk to them, and help you agree how you'll share a home.
- Before anyone can see other members or be seen, someone from our team checks your photo ID on a short video call. We don't keep a copy of your ID. We record only that the check passed or failed, and when.
- Other members see your public profile only. They never see your email, phone number, gender, who you're open to living with, or any preferred address.
- We don't sell your data, and we don't show adverts.
- Peabudy is for people aged 18 or over.
3. What we collect
| Category | What | Where it comes from |
|---|---|---|
| Account | Email address, display name, sign-in codes (deleted when used or after 10 minutes), session cookie, date you agreed to this notice and its version, date you confirmed you're 18+ | You |
| Profile (public to checked members) | Display name, bio, initials, which journey you're on, city, areas, budget, move-in window, how long you want to stay, your answers to six living-habit questions | You |
| Private matching details (never shown to other members) | Which habit answers you accept from others; your gender (optional, "prefer not to say" is available); the genders you're open to living with; an optional preferred postcode or address (stored but not currently used) | You |
| Identity check | That the check passed or failed, the date, and the reviewer. We may confirm your phone number on the call. We don't store your ID document, ID number, date of birth, photo or a recording | Our team, on a live video call with you |
| [FROM DIDIT GO-LIVE, about 27 Nov; remove until then] Automated identity check | Only the result (passed, failed or needs review), the date, Didit's session reference, a reason category if it failed, and whether you're 18 or over. Peabudy never receives or keeps your ID images, selfie, ID number or date of birth. Didit processes your ID and face image (biometric data) to do the check | You, through Didit |
| Activity | Introductions you send and receive, messages, household agreements and every version you accepted, blocks, reports you make, in-app notifications | You and other members |
| Safety | Reports others make about you, and any action we take (for example a suspension and its reason category) | Other members and our team |
| Feedback and research | Feedback you send in the app (linked to your account if you're signed in), the page you were on, a rating; survey answers you choose to give (through Tally, linked to your account by a pseudonymous reference); waitlist sign-ups (through Tally) | You |
| Survey email choice | Whether you asked us to email you a survey, when, which version of the wording you saw, and when you stopped | You |
| Access request (Peabudy is invite-only for now) | First name, email, city, areas, move-in month, what you're looking for, how you heard about us, an optional note; our decision and invite | You and our team |
| Technical | IP address and browser information in server logs; a random browser ID used to group feedback; [USAGE RECORDINGS: if Microsoft Clarity is switched on, and only with your consent: clicks, scrolls and pages viewed. Text you type, messages, emails and codes are masked] | Your device |
| Emails we send | Whether an email was sent and for which event. Never its content beyond your first name | Our systems |
We don't ask for: religion, ethnicity, nationality, sexual orientation, health, criminal record or income.
4. Why we use it, and our lawful basis
The legal bases are those in the UK GDPR (Article 6) and the Nigeria Data Protection Act 2023 ([NDPA SECTION FOR LAWFUL BASES, counsel to confirm]).
| Purpose | Data | Lawful basis |
|---|---|---|
| Create your account and sign you in | Account | Contract (providing the service you asked for) |
| Show you compatible people and show you to them | Profile, private matching details | Contract |
| Use your gender and who you're open to living with in matching | Gender, gender preference | Consent. It's optional; you can withdraw by choosing "prefer not to say" and "open to anyone" in your profile |
| Check identity and age before anyone can see other members | Identity check outcome | Legitimate interests: keeping members safe from fake profiles and under-18s |
| Introductions, chat and household agreements | Activity | Contract |
| Safety: reports, blocks, suspensions, records of what happened | Safety, activity, technical | Legitimate interests (member safety, preventing fraud and abuse). Legal obligation where the law requires us to keep or share records |
| Service emails: sign-in codes, ID check results, account and safety messages | Account | Contract |
| Activity emails: introductions, replies, your area opening | Account, activity | Legitimate interests. You can turn these off in Settings or with the link in every email |
| Improve Peabudy from feedback and surveys | Feedback and research | Legitimate interests (improving the service) for in-app feedback; consent for surveys and for being contacted for an interview |
| Decide whom to invite while we're invite-only, and email you an invite | Access request | Legitimate interests (opening safely, a few people at a time); steps you asked us to take before joining |
| Email you a short survey about your experience (about once, with at most one reminder; sent by Resend) | Email, first name, city, how far you've got (for example "verified" or "chatting"), survey email choice | Consent. Only if you tick "Email me a short survey" (it's never pre-ticked). Stop any time in Settings or with the link in the email |
| [FROM DIDIT GO-LIVE] Automated identity check | Your ID and a selfie video (processed by Didit only); the result (kept by us) | Explicit consent (UK GDPR Art. 9(2)(a); [NDPA SECTION FOR SENSITIVE DATA, counsel to confirm]), given on the screen before the check. You can choose a video call with our team instead |
| Waitlist | Waitlist answers, email | Consent |
| Usage recordings (Microsoft Clarity) | Technical | Consent. Only if you choose "Allow"; you can change it in Settings |
| Security, preventing abuse, keeping the service running | Technical, account | Legitimate interests |
Matching is automatic but not a "solely automated decision" with legal or similarly significant effects. It applies the rules you set: dates, areas, budget, habits, stay length and housemate preference. You always choose whom to contact. You can see why someone was suggested, and you can change your rules.
5. Who can see your data
- Other checked members: your public profile (section 3), plus your introductions and messages to them.
- Our team: the minimum needed to run identity checks, deal with reports and help you. Staff can't read your private chats. If you report a conversation, we see what you put in the report. Staff access to individual accounts is logged.
- Service providers (processors) who handle data on our instructions under contract:
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the website and app | [VERCEL REGION] / United States |
| Neon (Databricks, Inc.) [CONFIRM ENTITY] | Database | [NEON REGION] |
| Resend (Plus Five Five, Inc.) [CONFIRM ENTITY] | Sending emails | United States (company); emails sent from [RESEND SENDING REGION, e.g. EU (Ireland) if chosen in F-02] |
| Tally BV | Survey forms | Belgium (EU) |
| [MAILBOX PROVIDER, e.g. Google or Zoho] | Our hello@peabudy.com mailbox: booking ID calls, replying to you, sending surveys to people who asked for them | [MAILBOX REGION] |
| [FROM DIDIT GO-LIVE] Didit [CONFIRM ENTITY] | Automated ID document, liveness and face-match check. No national ID (NIN) or bank (BVN) database lookups | [DIDIT REGION, e.g. EU]; kept by Didit for [DIDIT RETENTION] |
| Microsoft (Clarity) | Usage recordings, only with your consent [and currently switched off] | United States [CONFIRM] |
- Others, only when necessary: the police or other authorities where the law requires it or someone is at risk of serious harm; professional advisers; a buyer of the business (you'd be told).
6. International transfers
Some providers store or access data outside the UK and Nigeria (see the table above).
- From the UK, we rely on [TRANSFER MECHANISM: e.g. the UK–US Data Bridge where the provider is certified, the UK International Data Transfer Agreement or Addendum, or UK adequacy regulations for the EU].
- From Nigeria, we rely on [NDPA TRANSFER BASIS: e.g. adequacy, or appropriate safeguards such as contractual clauses, as the NDPA and NDPC guidance permit].
You can ask us for a copy of the safeguards.
7. How long we keep it
| Data | How long |
|---|---|
| Sign-in codes | Until used, or 10 minutes |
| Session cookie | 7 days, or until you sign out |
| Account, profile, matching details, activity | While your account is open. After you delete your account, we remove it within [30] days |
| Identity check outcome (pass or fail, date) | While your account is open, then deleted with it |
| Safety records (reports, actions, suspension reason) | [24] months after the case closes, so we can stop banned people returning and respond to legal claims |
| Audit logs (who did what and when; no message content) | [24] months |
| In-app feedback | [12] months, then anonymised or deleted |
| Survey answers (Tally) | [12] months |
| Survey email choice | While your account is open (a withdrawal is kept so we don't email you again), then deleted with it |
| Record of survey emails sent to you (which survey, when) | While your account is open |
| Access requests not taken further (declined or unanswered) | [30] days |
| Waitlist answers (Tally) | Until we open in your area and invite you, or [12] months, whichever is sooner |
| Usage recordings (if consented) | [CLARITY RETENTION, per Microsoft's settings] |
8. Your rights
Under the UK GDPR, and under the Nigeria Data Protection Act 2023, you can ask us to:
- give you a copy of your data (in Settings, "Export my data", or by email)
- correct it (most of it you can edit yourself in Profile)
- delete it (Settings, "Delete account"; your profile is hidden immediately)
- restrict or object to how we use it, including anything we do on the basis of legitimate interests
- move it to another service (the export is a machine-readable file)
- withdraw consent at any time (gender preference, survey emails, waitlist, usage recordings, and the automated ID check before it's done). Withdrawing doesn't affect what we did before.
How: email [CONTACT EMAIL]. We may ask you to confirm it's you. We'll reply within one month [NIGERIA: confirm the NDPA response period], and we'll tell you if we need longer.
Complaints: please tell us first. You can also complain to:
- the Information Commissioner's Office (UK), ico.org.uk
- the Nigeria Data Protection Commission, ndpc.gov.ng
9. Age
Peabudy is only for people 18 or over. You confirm this when you sign up, and we check it during the ID call. If we learn that someone under 18 has an account, we close it and delete their data, except any safety record we need to keep.
10. Security
We use encrypted connections. Access to our systems is limited to the people who need it. Every change to an account is logged. Sign-in uses one-time codes sent to your email. No system is perfectly secure: if we have a data breach that puts you at risk, we'll tell you and the regulators as the law requires.
11. Cookies
- We use one essential cookie,
hm_session, to keep you signed in. - With your consent only, Microsoft Clarity may set cookies to record usage (section 3). [Currently switched off.]
- We store a few settings in your browser (for example, that you dismissed a tip, or your Clarity choice).
12. Changes
If we change this notice in a way that matters, we'll ask you to read and agree to it the next time you sign in. Earlier versions are available on request.