Privacy policy

1.1Curcle is operated by Curcle Technologies Limited, a company registered in England and Wales under company number 17399519. Our registered office is 124 to 128 City Road, London EC1V 2NX.

1.2For anything about your data, email support@curcle.uk. A person reads it.

1.3We have not appointed a Data Protection Officer, and we are not required to. The person responsible for data protection is the director of Curcle Technologies Limited, reachable at the address above.

2.1If you put your area forward we collect: your email address; the name of your parliamentary constituency; whether you ticked the optional updates box; the fact that you ticked the declaration that you are 16 or over and live in the constituency, and when; whether you have confirmed your email address, and when; and the date and time of your signup.

2.2Your postcode is typed into your browser and sent by your browser directly to postcodes.io, which returns the constituency it belongs to. The postcode never reaches our servers, is never stored, and is never logged by us. Only the constituency name is kept.

2.3Your IP address is counted against a short rate limit when you submit the form, so one connection cannot flood us. The counter expires within one hour and is never stored with your signup.

2.4Our hosting provider keeps short-lived operational logs of requests to the site, which can include IP addresses. We run no analytics and set no cookies, so there is nothing else.

3.1Your email and constituency, to tell you when Curcle is available where you live and to decide where to launch first: consent, Article 6(1)(a). You give it by submitting the form and confirming your email, and you can withdraw it at any time by asking us to delete your details.

3.2Occasional news about Curcle, only if you ticked the separate updates box: consent, Article 6(1)(a). The box is never pre-ticked, and you can withdraw at any time.

3.3The confirmation status and its timestamp, and the residency and age declaration and its timestamp: legitimate interests, Article 6(1)(f). Our interest is keeping the counts honest, so that when a constituency total reaches an MP it means real, willing people, and being able to show that a signup was genuinely made.

3.4IP-based rate limiting: legitimate interests, Article 6(1)(f). Our interest is protecting the service from abuse and flooding. The counter is short-lived and identifies a connection, not a person.

3.5Hosting logs: legitimate interests, Article 6(1)(f). Our interest is running a secure, working website.

4.1A signup you never confirm is deleted automatically after seven days. Each six-digit code lives for ten minutes and at most five wrong tries, and you can ask for a fresh one; the stored code hash is cleared the moment you confirm.

4.2A confirmed signup is kept until we have emailed you that Curcle is live in your constituency, and is deleted within three months after that. If you ask us to delete it sooner, we do.

4.3If Curcle has not launched anywhere within 24 months of your signup, we delete the list rather than keep it indefinitely.

4.4Rate-limit counters expire within one hour. Hosting logs are short-lived operational records kept by our hosting provider, not an archive we build.

5.1Vercel hosts the website. Requests to the site pass through it, including IP addresses in its short-lived operational logs.

5.2Upstash stores the signup list described above, on our behalf.

5.3Resend delivers the six-digit code email. It processes your email address and the message content, which contains the code.

5.4Postcodes.io receives your postcode directly from your browser to look up your constituency. It gets no name, no email, and nothing else that identifies you from us.

5.5All four act as processors or independent services with their own duties. We do not sell your details, share them with anyone else, or run any advertising or analytics.

6.1Vercel and Resend are US companies, and Upstash can host databases in several regions, so personal data may be processed outside the UK.

6.2Where a transfer out of the UK happens, it relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified.

6.3We choose the closest sensible storage region available and keep the data with these named providers only.

7.1Access: ask what we hold about you and get a copy.

7.2Rectification: ask us to correct anything wrong.

7.3Erasure: ask us to delete your details, and we do.

7.4Restriction: ask us to hold your data but stop using it while something is sorted out.

7.5Portability: ask for your data in a machine-readable form to take elsewhere.

7.6Objection: object to any use we base on legitimate interests, and we stop unless the law lets us continue.

7.7Withdrawing consent: withdraw it at any time for anything based on it, without affecting what happened before.

7.8To use any of these, email support@curcle.uk. We do not make you fill in a form, and we will not make it hard.

8.1If you think we have handled your data badly, email support@curcle.uk with the word complaint in the subject and tell us what happened. We will acknowledge your complaint within 30 days of receiving it, as the Data (Use and Access) Act 2025 requires, and answer it properly as quickly as we can.

8.2You also have the right to complain to the Information Commissioner's Office at any time: ico.org.uk, telephone 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

9.1We do not profile you. We do not analyse or infer anyone's political views, and we never will.

9.2We make no automated decisions about you with legal or similarly significant effects. The only automation is mechanical: confirming your email when you click the link, and deleting unconfirmed signups after seven days.

10.1When the app launches, one of its disclosed purposes will be aggregate reporting: anonymised statistics about the themes and volume of public issues raised in a constituency, supplied to that constituency's MP's office as part of the office's subscription. The purpose is disclosed at registration; this section describes it ahead of launch.

10.2Producing aggregate statistics is itself processing of the underlying personal data, with its own lawful basis: legitimate interests, Article 6(1)(f). The interest is giving an office an honest picture of what its constituency is raising, without exposing anyone in it. Where a public issue reveals special-category data, such as a political opinion, we rely on Article 9(2)(e), because the person raising a public issue has manifestly made it public. Both assignments are for the solicitor to confirm.

10.3Only output that meets the anonymisation standard in our disclosure control plan ever leaves the company: minimum cell thresholds, suppression of small counts with secondary suppression, rounding, and minimum geography and population floors. Anything short of that standard, including pseudonymised data, remains personal data and stays inside the company under this policy.

10.4Private casework is excluded from reporting entirely. It never enters the reporting pipeline at any stage.

10.5No report identifies, describes or concerns any individual. We do not build or supply profiles of identifiable individuals, and we do not report on the political views of any individual.

11.1Providing data is not a requirement of any contract or law. You can read everything on this site without giving us anything.

11.2The only consequence of not providing an email address is that we cannot count your area or tell you when Curcle arrives, because there would be nobody to tell.

12.1The signup is for people aged 16 or over. You confirm this with the declaration at signup; we do not collect your date of birth, deliberately, because we do not need it.

12.2Because sixteen and seventeen-year-olds can use Curcle, this policy is written to be readable by them, our defaults are the most private option for everyone, and we profile nobody. If we learn a signup came from someone under 16, we delete it.

13.1When we change this policy we update the date at the top and add a line to the changelog below. If a change matters, and you have a confirmed signup, we will email you about it.

13.2This policy sits alongside the terms of service.