Privacy notice
This route exists so that the privacy surface is reachable rather than returning a 404. The approved notice has not yet been written.
DRAFT PLACEHOLDER — NOT APPROVED, NOT BINDING
This page is a structural placeholder created during the commercial-readiness reset. Nothing on it has been reviewed or approved, none of it is a contractual or legal commitment, and it must not be relied upon. Approval owner: Management, external legal counsel and the data protection lead. The approved text must be supplied by those owners before this page can be presented to a customer.
Who the controller is
The approved notice must identify the legal entity acting as controller, its registered address, and a contact route for privacy enquiries.
Outstanding before approval
- Confirm the controller entity and registered address
- Publish a monitored privacy contact address
- Decide whether a data protection officer or representative is required
What personal data the service processes
The approved notice must describe the categories actually processed. Known candidates from the current implementation are account identifiers, organisation membership, site addresses and coordinates entered by users, project and report records, and diagnostic logs. This list must be verified against the live schema before approval.
Outstanding before approval
- Complete a data inventory against the live database schema
- Confirm whether any special-category or children's data can be entered
Lawful basis, retention and deletion
No lawful basis, retention period or deletion commitment is stated here because none has been approved. Retention schedules, project deletion, account deletion and data-subject request handling are scheduled work, not current guarantees.
Outstanding before approval
- Legal to determine the lawful basis for each processing purpose
- Define and implement retention, deletion and DSAR export
Processors, sub-processors and AI services
The service depends on third-party infrastructure and on AI services used to draft narrative text. An approved sub-processor list, including what data each receives and where it is processed, must be published before any customer contract is signed. No such list is published here.
Outstanding before approval
- Compile and legally review the sub-processor register
- Confirm AI-provider data-handling and training-exclusion terms
- Publish a customer data processing agreement route
International transfers, cookies and rights
Transfer mechanisms, cookie and similar-technology controls, and the description of data-subject rights all require legal drafting and are intentionally absent rather than approximated.
Outstanding before approval
- Legal drafting of transfer mechanisms and rights section
- Cookie audit and consent controls where applicable
Expert-assisted screening tool — under commercial-readiness review
Urban Nature Audit is an expert-assisted screening tool. Its outputs are screening-level and non-statutory, they are intended to be operated and interpreted by a competent professional, and the product is currently under commercial-readiness review. It does not replace:
- an ecological survey
- the official statutory biodiversity metric
- planning advice
- flood or drainage engineering
- legal advice
- a professional valuation