Privacy Policy

Introduction

My Town Rocks™ ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our websites (mytownrocks.co.uk and our network of local town websites) or use our online services, including the MTR Business Hub and MTR Admin.

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access our sites.

Information We Collect

Information You Provide

We may collect information you provide directly to us, including:

• Contact Information: Name, email address, phone number, and company name when you submit enquiry forms
• Account Information: Email and password if you create an account on our platform
• Communication Data: Information you include in messages you send to us
• Feedback Reports: Problems and ideas you report through our feedback tool, with any screenshot you add. See Feedback and Bug Reports

Information Collected Automatically

When you visit our sites, we automatically collect certain information, including:

• Device Information: Browser type, operating system, device type
• Usage Information: Pages viewed, time spent on pages, click data
• Location Information: General geographic location based on IP address
• Cookies: See our Cookie Policy for details

How We Use Your Information

We use the information we collect to:

• Respond to your enquiries and provide customer support
• Send you marketing communications (with your consent)
• Improve our websites and services
• Handle feedback and bug reports, including sorting them with an AI assistant (see Feedback and Bug Reports)
• Analyze usage patterns and trends
• Protect against fraud and unauthorized access
• Comply with legal obligations

Legal Basis for Processing

We process your personal data on the following legal bases:

• Consent: Where you have given explicit consent (e.g., marketing emails, non-essential cookies)
• Contract: Where processing is necessary to fulfill a contract with you
• Legitimate Interests: Where we have a legitimate business interest that doesn't override your rights (e.g., improving our services, fraud prevention)
• Legal Obligation: Where we need to comply with legal requirements

For feedback and bug reports, we rely on our legitimate interest in finding and fixing problems with our services, improving them, and keeping our feedback tool free from spam and abuse. That covers storing and sorting reports and the technical details sent with them (including with AI), tracking problems in our issue tracker, and emailing you about your report.

Sharing Your Information

We may share your information with:

• Service Providers: Third parties who help us operate our business, such as the providers listed below
• Business Partners: With your consent, we may share information with advertising partners
• Legal Requirements: When required by law or to protect our rights

Our service providers include:

• Amazon Web Services: Hosts our websites and apps, in London
• Resend: Sends our emails
• PostHog: Provides our analytics, hosted in the EU
• Google reCAPTCHA: Helps protect our forms and feedback tool from spam and abuse. Google's Privacy Policy and Terms of Service apply
• Anthropic: Our AI provider, whose AI assistant sorts feedback reports
• Atlassian: Runs Jira, the issue tracker we use to fix problems reported through our feedback tool

We do not sell your personal information to third parties.

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

• Enquiry data: Retained for 3 years unless you request deletion
• Account data: Retained while your account is active, plus 2 years
• Analytics data: Aggregated and anonymized after 26 months
• Account activity records: Retained for 24 months
• Feedback reports: See Feedback and Bug Reports

Your Rights

Under GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request that we limit how we use your data
• Portability: Request a copy of your data in a portable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time where we rely on consent

For feedback reports, including how to get a copy and what happens when you close your account, see Feedback and Bug Reports.

To exercise any of these rights, please contact us at hello@mytownrocks.co.uk.

Cookies

We use cookies and similar tracking technologies to collect information about your browsing activities. You can manage your cookie preferences through our Cookie Settings page.

We use the following types of cookies:

• Essential Cookies: Required for the site to function properly
• Analytics Cookies: Help us understand how visitors use our sites
• Marketing Cookies: Used to deliver relevant advertisements

Feedback and Bug Reports

When you are signed in to one of our sites or apps, you may be able to use our feedback tool to report a problem or suggest an idea. Using it is optional. This section explains what happens to your report.

What We Collect

When you send a report, we store:

• Your Report: The title and description you write, whether it is a problem or an idea, and your answers to any follow-up questions
• Screenshot: One image, if you add one, kept in private storage
• Where You Were: The app and page you sent it from, the last 10 pages you visited, and the site and business you were working on
• Your Account: Which account sent it, and your role and type of account at the time
• Technical Details: Your browser and screen size, your language and time zone, the version of the app, up to 20 recent error messages from the page, an analytics session reference and an analytics visitor ID
• Page Details: A few fixed facts about what the page was showing, such as the type of record and its status. These never include names, text or amounts
• Replies: Messages between you and our team about the report

We don't collect anything you typed into forms on the page. Please don't include other people's names, contact details, payment or health details in your report or screenshot. We may check reports with Google reCAPTCHA to protect the feedback tool from spam and abuse.

How We Use AI

An AI assistant sorts reports. It may ask you questions, raise an engineering ticket or group your idea with similar ones. People decide what is done about your report, except that we may close a report as a duplicate or as one we can't reproduce without a person approving that closure.

Our AI provider is Anthropic. When you send a report, Anthropic receives its title and description, your answers to any questions, the page and site it came from, your role and type of account, your browser and screen size, any error messages, the page details above, and messages between you and our team about it. If you reopen a report, it also receives what we said we fixed before. If you add a screenshot, Anthropic receives it.

To spot repeat reports, the AI assistant also sees the titles and short summaries of similar reports. In the same way, your report's title and the short summary the AI assistant wrote for it may be shown to it when it sorts similar reports from other people.

Before the text is sent, we remove details such as email addresses, UK phone numbers and postcodes, card and bank account numbers, IP addresses and access keys. We don't send the name, email address or ID of your account. We can't reliably remove a name you type, so please leave names out. We can't remove anything shown in a screenshot.

Where the AI check is offered, when you press Next, your title, your description, the page you're on and any answers you give are sent to Anthropic to check for anything missing, even if you don't send the report. It doesn't receive your screenshot or email address.

Anthropic processes this information under its terms.

Who Sees Your Report

Our team reads your report and can see who sent it. If it's a problem we need to fix, we copy the details into Jira, the issue tracker run by Atlassian, with the page and site it came from and a link to its analytics session. We remove email addresses and phone numbers first, and we never add the name or email address on your account, or your screenshot. To check whether a problem is already logged, we search Jira using a few words from each report.

We record how the feedback tool is used, such as reports sent and their progress, in PostHog, our analytics provider. These records are tied to the report, not to your analytics profile.

Emails About Your Report

We email you when we receive your report, if we need more detail, when our team replies, and when a fix is released. These are service messages about your report.

If our team adds your email address to a report, for example because they reported a problem on your behalf, we store your address with that report and email you about its progress. Each of those emails has a link to stop further emails about that report.

How Long We Keep It

• Your Report: Kept, with its technical details and replies, while it helps us fix and improve our services
• Screenshots: Deleted once 90 days have passed since your report was resolved (fixed, released, closed or marked as a duplicate). While a report is still open, or an idea is kept for later, we keep its screenshot
• Recovery Copies: Whenever we delete a screenshot, including when you close your account, earlier copies kept for recovery are removed about 30 days later
• Unsent Screenshots: If you add a screenshot and then remove or replace it, or don't send the report, the image may stay in our private storage. It isn't attached to any report
• AI Check: We keep only what it suggests, such as its questions and any clearer title, and delete our copy within two days unless you send the report. If you do, the questions and your answers are kept with the report

If You Close Your Account

When you close your account yourself, we delete:

• The screenshots on your reports
• The text of your own replies
• Your email address from any report we were emailing you about
• The analytics session reference and visitor ID stored with your reports
• The page details stored with your reports
• Any AI check suggestions we still hold for you

We keep the rest of each report so we can still fix the problem: its title, description and answers, its technical details, your role at the time, our team's replies and our notes on it, and the copy in our issue tracker. These are no longer linked to your account, but anything you typed stays as you wrote it.

If you can't close your account yourself, contact us at hello@mytownrocks.co.uk and we will erase it on request. To ask for a copy of your reports, contact us at the same address.

International Data Transfers

Our websites and apps are hosted in the UK. Some of our service providers are based outside the UK. These include:

• Anthropic: Based in the United States, and may process information in other countries. Protected by the UK Addendum to the EU Standard Contractual Clauses.
• Atlassian: Stores our issue tracker's data in its data centres worldwide, with no fixed region. Protected by the UK Addendum to the EU Standard Contractual Clauses.
• Resend: Based in the United States. Protected by the UK Addendum to the EU Standard Contractual Clauses.
• PostHog: Our analytics are hosted in the EU, and PostHog's parent company is in the United States. Protected by the UK Addendum to the EU Standard Contractual Clauses.
• Google: Based in the United States. Protected by the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework).

Whenever we transfer your data outside the UK, including to our other service providers, such as those for payments, search and sign-in, we use a safeguard recognised under UK law, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK–US data bridge where the provider is certified under it.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

• Email: hello@mytownrocks.co.uk
• General enquiries: hello@mytownrocks.co.uk

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this page. We encourage you to review this Privacy Policy periodically.