Privacy & Data Retention Policy.
Version: 20 October 2026. Your Local HMO Directory is a privately operated, non-commercial personal project hosted at chillinlounge.co.uk; it is not a registered business or a government/council service. The individual responsible for operating this website determines how its personal data are processed. The public contact point for privacy questions, legal notices and data-subject requests is [email protected]. To request the operator's legal identity or appropriate correspondence details, contact that address. The site name and domain identify the service rather than a separately incorporated legal entity.
1. What information we retain
Website use: Public connection IP, server request time, requested page or API route, status/response size, referring website's domain (where sent), and browser-reported User-Agent. These generate approximate device, OS and browser categories and daily activity groups. Automated requests and likely scanning may also be labelled. Daily groups are not proof of a unique person. The searchable 30-day database excludes form contents, passwords, precise GPS, full query strings and confirmation tokens, though original Apache technical logs may contain URL parameters until rotated.
Optional location and network context: when suitable local databases are installed, country, region, city and network/ASN organisation inferred from the public IP, plus possible VPN, proxy or Tor listings. This information is fallible, can be unknown and cannot reliably identify a person, device owner or physical address. The site's visitor logger does not transmit IP addresses to third-party IP lookup APIs.
Members: name, email, optional organisation, whether joining the ordinary community or separately applying for confidential HMO access, any HMO safeguarding purpose and requested/granted access levels, password hash (not plain password), email verification, reviews, access grants, account status, timestamps and pseudonymous registration/security hashes. Reports: chosen council, issue category, message text, optional reply address, submission date and pseudonymous IP hash. Reports may contain personal data supplied by contributors; do not submit names of occupants or unnecessary sensitive information.
Community membership and bans: ordinary accounts are created without any confidential HMO permission; verification of the registered email automatically activates ordinary community eligibility unless a ban or earlier rejection applies. Existing verified HMO members may separately opt in. Staff can record eligibility restrictions, global bans and moderated decisions in an audit. Those decisions affect future trade adverts, reviews and ratings, independently of the protected HMO access level. Decisions are recorded only as needed to operate and protect the service; they do not grant HMO safeguarding permissions. Verified community members can save private trade advert drafts, including the business name, work category, service area, description, and optional public-facing phone, contact email and HTTPS website. Draft edits are recorded with a revision history to support moderation and security review. These records are restricted to the member's account and authorised administration; no draft is published or endorsed. Verified members can also submit private advert photographs. Original bytes enter a restricted quarantine, are virus-scanned and re-encoded without embedded camera metadata, and the sanitised file is held privately for separate human review. Submission timestamps, photo caption, scan outcome, staff decision and purpose-specific pseudonymous upload rate hashes are recorded. No uploaded photograph is published by this workflow. Eligible community members can also submit private first-hand customer reviews containing 1–5 stars and text about an approved trade advert. The original, revisions and moderation decisions are retained for legitimate review purposes; edits and bans exclude stars from eligible rating calculations while inactive. Public trade adverts, published reviews, rating display and photo display remain disabled. Separately, authenticated eligible customers and traders can now exchange private, text-only conversations tied to approved adverts. Participant IDs, advert association, message text, created/read timestamps, blocked/closed state and any independent safety-hide decision are held in restricted MariaDB tables. The receiving member gets an email containing only the first line of the message and a site link; full conversations require participant sign-in. Emails and their previews may remain in recipients’ mailboxes and external mail systems. Only the particular message that a participant formally reports may be inspected by authorised staff for an active safety case, not all private conversations. Its message body is not automatically loaded in staff case lists. Staff must explicitly request access to that reported message; each access is attributed to an authorised moderator, recorded in a private audit with the case number, and expires for display after two minutes. The access audit records the action, not the message text.
Terms: version/time of an acknowledgement, temporary daily-hashed IP and User-Agent values for acceptance evidence, and the signed first-party acknowledgement cookie. Logged-in members may also have the last accepted version/time recorded against their account. Source records: dated council licensing, planning and other historical HMO evidence, kept with provenance and reviewed for accuracy, not as allegations against current occupants.
2. What we do with the information and why
We operate the directory, verify and protect accounts, moderate submissions, monitor service errors, investigate security incidents, prevent abuse, validate source information and control access to safeguarding cases. Where appropriate and proportionate, the operator relies on legitimate interests under UK GDPR Article 6(1)(f), subject to a documented balancing assessment; some services may rely on contractual steps or specific legal obligations as relevant. A terms acknowledgement is not presented as GDPR consent for analytics.
We do not sell personal data or use these logs to harass, dox, threaten, discriminate against or target individuals. VPN/device classifications are informational rather than decisions or proof of wrongdoing.
3. Retention by category
UK GDPR does not require every record to have the same fixed storage period. We use the following time limits or necessity-based review triggers; a documented lawful preservation obligation or investigation may justify a limited exception.
| Record category | Retention / review rule |
|---|---|
| Detailed visitor records and connecting IPs | 30 days; deleted automatically from the searchable database. |
| Apache technical access logs | Daily rotation, 14 daily retained rotations under the current configuration, plus the current log. Backup copies must be managed separately. |
| Unsuccessful login/security-attempt hashes | 30 days once the maintenance task is installed. |
| Logged member access to protected resources | 180 days once the maintenance task is installed, unless a specific incident requires preservation. |
| Anonymous terms acknowledgement evidence | 90 days once maintenance is installed. |
| Essential acknowledgement cookie | 90 days, or until a material terms-version change. No separate analytics tracking cookie. |
| Existing member community eligibility and ban/unban decisions, moderator reasons and linked audit events | While the account needs to operate or an evidenced moderation review is open. Audit events are account-linked and deleted with the active account under the existing account-deletion workflow, except records independently and lawfully retained elsewhere subject to separate controls. Review unnecessary notes regularly. |
| Private trade photo submissions, scan results and moderation records | Original image bytes are discarded by the scanner following processing. Sanitised WebP images, captions and decisions remain in restricted storage while the advert, member account or justified moderation review needs them. Orphan sanitised WebP files and completed/rejected private scan-result directories without any matching photo database record are removed by a restricted maintenance worker only after a 30-day grace period; all files linked to a retained photo record are preserved for account needs and justified moderation cases. This is a conservative orphan cleanup, not an expiry policy for active photos. Members can request removal, and no image is currently served publicly. Purpose-separated pseudonymous upload security hashes are subject to the existing authentication-attempt maintenance policy. |
| Site-wide community ban notices, invitation hashes, appeal explanations and independent case review | Private, account-linked restrictions and formal appeals are limited to authorised Full Administrators and the affected account through its one-use invitation. Emails describe relevant restrictions and their appeal route; a 256-bit random invitation is stored only as a hash, normally expires after 14 days and cannot be reused once submitted. Review case data is kept while necessary for fairness, genuine complaints, legal preservation or proportionate audit. Closed cases require periodic minimisation and erasure review, and linked records are affected by member-account deletion and backup retention rules. |
| Private customer-to-trader messages, restricted participant history, read markers and message reports | Held only while the participant accounts, customer-service conversation, safety investigation or substantiated dispute reasonably require it. Blocking prevents new replies but preserves existing visible history; banning participants suspends inbox visibility. Case-limited reported-message evidence and reasoned takedown audits may be retained for a proportionate safety investigation. Deleted member accounts cascade associated conversation/message records under the present schema; backup and legal holds must be considered. No automatic fixed message expiry has been implemented; review retention and erasure procedures before opening the public directory. Mail notifications containing the first line may exist independently in recipient inboxes. |
| Private member safety reports, reporter identity, evidence explanation and case outcomes | Visible only to authorised safety staff and to the reporting member for the report status. Retained while the case, a genuine dispute, safeguarding concern or lawful preservation is active; closed/dismissed cases require periodic minimisation and deletion review, not an automatic fixed expiry. Reports and staff decisions are not automatically sent to the person reported. Reporter account deletion may remove linked reports by the current schema foreign key; separate lawful preservation must be considered. Reports are not continuously monitored and are not a replacement for emergency services. |
| Private customer trade reviews, 1–5 star ratings and revision/moderation history | Retained privately while the reviewer account and independent moderation/dispute review need them. Edits preserve earlier text privately for audit; bans, hidden or pending states exclude those stars from any future displayed average. Subject-linked review and revisions follow member-deletion rules, applicable lawful preservation and backups. Public review publication is not yet enabled. |
| Private trade advert drafts, optional contact details and content-revision history | Retained while the associated account and future review process need them. Nothing is publicly displayed until separately approved. Draft content and related subject-linked revisions are deleted through the existing member-account deletion workflow, subject to lawful retention exceptions and backup schedules. There is not yet an automated draft-expiry task. |
| Ordinary community registration, password hash, email verification, display name, HMO permissions where separately requested, and safeguarding-case authorisations | While the account/application needs to operate or be reviewed; review accounts after closure or refusal and delete when no longer required, subject to applicable legal holds. Account-linked audit records may be deleted with the account where appropriate. |
| Public housing reports, submitted text and reply details | While pending review, correction, genuine follow-up or dispute. Closed reports are to be periodically reviewed and deleted/anonymised once unnecessary; unusually sensitive submissions need prompt attention. |
| Published HMO licence/planning-source evidence | While historically relevant with source/date and periodic accuracy, minimisation and correction review; not automatically erased just because a licence expires. |
| Gmail verification/support messages and backups | Subject to separate mailbox and backup retention; not covered by the visitor database 30-day deletion job. Unnecessary correspondence and obsolete backups must be reviewed and removed. |
Retention may be shortened in response to a valid request. Information reasonably necessary for a specific claim, regulatory request or legal duty may be preserved with restricted access and review. A pseudonymous hash can still be personal data; we do not treat hashing as automatic anonymisation.
4. Cookies, providers and international processing
The essential ylhmo_session session cookie supports form security and account login. The essential ylhmo_terms signed cookie avoids repeated acknowledgement prompts for up to 90 days. Neither is a marketing cookie; the visitor-log system adds no fingerprint or extra analytics cookie. You can block cookies in your browser, but sign-in and forms may stop working. If optional cookies or marketing tracking are introduced, we will assess PECR consent requirements separately.
Map pages may request scripts/tiles from external resources including OpenFreeMap, OpenStreetMap-based services and public JavaScript/CDN providers, which can receive request IPs and browser information. A user-initiated postcode lookup may contact postcodes.io with the searched postcode and request metadata. Google handles outgoing and incoming Gmail messages; email and third-party services may process information internationally. Appropriate supplier contracts and transfer safeguards require independent checking; this policy does not promise every provider is UK-hosted.
5. Access, security and permitted disclosure
Individual visitor activity is visible only to the authenticated admin dashboard; account and property information is role-gated. Passwords use non-reversible password hashes and access is protected with HTTPS. No technical system is perfectly secure. Information may be disclosed to processors or where lawfully required; protected member data must not be republished without prior written permission, except where legislation or protected disclosures permit or require it. Public records are also subject to third-party source terms and statutory rights.
6. Your rights and objections
You may have the right to access, rectify, erase or restrict personal information, to object to processing, and in applicable circumstances to portability. Right to object: if we rely on legitimate interests, you can object at any time; we will assess the objection and stop processing unless a valid overriding lawful reason applies. We do not make solely automated decisions with legally significant effects based on VPN, location or device estimates.
Contact [email protected] with “Data protection request”. We may seek proportionate verification before disclosing account data. You can complain to the Information Commissioner's Office. The statutory response period applies, including any lawful extension or exemption.
7. Accountability and policy changes
The operator must periodically review data collected, security, controller contact details, processors, retention, legitimate-interest assessments and the necessity of safeguard records. If material terms change, users will be asked to acknowledge the new version. No policy or checkbox removes your statutory rights.