Privacy policy

Who we are

FixASB is operated by SafetyScore Limited ("we", "us", "our"), the data controller for personal data processed through this service. We are registered in England and Wales (company number 16671672) and with the Information Commissioner's Office (registration number ZB981868). Our registered address is 128 City Road, London, EC1V 2NX, United Kingdom.

Scope

This privacy policy explains how we collect, use, store, and share personal data when you use FixASB, including when you create or support an issue, publish issue information, add private details for authorised organisations, report abuse on an issue page, recommend an organisation, send a contact-form message, verify your email address, complete a weekly follow-up, sign up to Get Involved events or groups, propose a community listing, or when authorised officials access information through our secure authority portal. It applies to UK users and is written to reflect the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Some information you submit may relate to other people who do not use the service; we treat that as personal data of those people too.

Public issue pages

FixASB exists to enable communities to document persistent public safety issues. Information you submit about an issue may therefore be published on a publicly accessible webpage. These pages are intended to describe places and ongoing issues, rather than identify individuals.

Please do not include unnecessary personal information about yourself or other individuals in issue descriptions. Where possible, describe the issue, location and impact rather than identifying specific people. Identifying details for authorised organisations should be provided only through the private fields, not on the public page.

We do not publish your email address, phone number or other contact details. Public issue pages show an approximate location label and a privacy ring and/or orb to denote the general area. We store a more precise location internally so authorised organisations and moderators can understand where the issue was reported.

Public issue pages do not identify the individual who created or supported the issue. Contact details are stored separately and are only disclosed where you choose to share them with relevant authorities, or where we are legally required to do so.

Personal data we collect

Depending on how you use the service, we may collect:

• your email address (required to verify submissions and send service emails, including confirmations and weekly follow-up or check-in emails);
• your name and phone number, if you choose to provide them (these are optional and separate from whether you allow authorities to be given your contact details - we may keep them on the report even if you answer no to sharing);
• descriptions of issues, impact details, timing patterns, and photographs you upload (you can tell us if you have video available; we do not currently accept video file uploads);
• private narrative and identifying details for authorised organisations (including further description, exact location notes, and details of people or vehicles) - these are encrypted and not published;
• location data (including coordinates you place on a map - we store a precise location internally; public pages show an approximate label and a privacy ring and/or orb);
• technical data such as IP address and browser identifiers, which we hash and also store encrypted so staff can investigate abuse (they are not published); rate limiting uses the IP address on the incoming request;
• campaign or referral information (for example UTM parameters);
• when you report abuse on an issue page, the reason for your report and any supporting details you provide;
• when you recommend an organisation, your name and email (encrypted), the suggested organisation, and your reason;
• when you use the contact form, your name, email, optional phone number, and message (emailed to us, not stored as a report);
• when you sign up to Get Involved, your email (encrypted), optional name, postcode, the events or groups you join, and whether you want alerts about future events or groups near that postcode;
• when you propose a Get Involved event or group, the listing details, organiser name, organiser email (encrypted), postcode or area, and an optional image after you confirm your email;
• a verified support-email address in your browser session until you forget it;
• an SMS verification phone number when that step is enabled;
• email and password used to unlock a preview access gate, when the site is in protected mode (held in the session, not stored as a user account);
• CMS like fingerprints (a hash of IP and browser identifier, cached);
• analytics after you opt in, including privacy-masked PostHog session recording;
• authority users' work email address, login attempts, and access activity.

How we use your data

We use personal data to: operate and secure the service; verify email addresses before publishing an issue or adding your support; create and display public issue pages; send weekly follow-up and check-in emails and record opt-outs; moderate content and investigate abuse reports; review recommendations of organisations who might help; handle contact-form enquiries; list Get Involved events and groups, confirm organiser emails, moderate public proposals, and send Get Involved confirmation and local-alert emails you have opted into; notify relevant police or local authority contacts where appropriate; provide secure access to authorised officials (including private narrative and identifying details, even where you have not consented to share your own contact details); send transactional emails (such as confirmations and verification links); send SMS verification codes when that step is enabled; improve reliability and prevent fraud or misuse; and comply with legal obligations. Staff who moderate FixASB can decrypt contact details, IP addresses, private enrichment, and original photographs in order to review content.

Lawful bases

Under UK GDPR we rely on different lawful bases depending on the processing: consent - where you opt in to share your name, email, or phone number with relevant authorities, where you opt in to Get Involved alerts about future events or groups near you, and where required for non-essential cookies or similar technologies; contract - where processing is necessary to provide the service you request (for example verifying your email so we can publish your issue or support, or confirming a Get Involved sign-up or listing proposal); legitimate interests - to operate, secure, and moderate the platform, prevent abuse, maintain audit logs for authority access, improve the service, maintain an accurate historical record, prevent manipulation of community support, and protect the integrity of public issue records, where those interests are not overridden by your rights; recognised legitimate interests - where processing is necessary for detecting, investigating or preventing crime, as described in the Criminal offence data section; and legal obligation - where we must comply with applicable law.

Criminal offence data

Some information submitted to FixASB may constitute personal data relating to criminal offences or alleged criminal offences, particularly where a report identifies or provides information about a person suspected or alleged to have committed an offence.

Where we process criminal offence data for the purposes of detecting, investigating or preventing crime, or assisting relevant authorities to do so, our lawful basis under Article 6 of the UK GDPR is recognised legitimate interests (Article 6(1)(ea)), where the processing is necessary for the recognised legitimate interest relating to crime.

In addition, as required by Article 10 of the UK GDPR, we rely on the condition in paragraph 10 of Part 2 of Schedule 1 to the Data Protection Act 2018 (preventing or detecting unlawful acts), where the processing is necessary for those purposes and seeking the consent of the person suspected or alleged to have committed the offence would prejudice those purposes.

We apply additional safeguards to this information. Identifying information about alleged offenders is intended for private fields rather than public issue pages, access is restricted to authorised personnel and organisations, and public content is moderated to reduce unnecessary identification of individuals. We retain criminal offence data only for as long as it remains necessary for the purposes for which it is processed and in accordance with our retention policies.

Our Appropriate Policy Document provides further information about the safeguards, retention and deletion arrangements that apply to our processing of criminal offence data.

If you are mentioned in a report

People using FixASB may provide information about other individuals when describing an anti-social behaviour or public-safety issue. This can include descriptions, photographs, vehicle information, location information or, in private fields available to authorised organisations, information identifying a person believed to be involved.

Where this information relates to an identifiable person, we treat it as that person's personal data even though we did not obtain it directly from them.

We use this information to document and understand persistent anti-social behaviour and public-safety issues, to moderate and maintain issue records, and, where appropriate, to enable relevant authorised organisations to understand or respond to those issues. Where information concerns an alleged criminal offence, additional rules governing criminal offence data apply.

We do not routinely notify every person mentioned in a report. In some cases we cannot reasonably identify or contact the individual concerned. We may also withhold or delay privacy information where UK data protection law permits us to do so, including where providing it would involve disproportionate effort, would seriously impair the purposes for which the information is processed, or would be likely to prejudice the prevention or detection of crime or the apprehension or prosecution of offenders.

Where an exception or exemption does not apply and we are required to provide privacy information directly, we will do so in accordance with applicable data protection law.

If you believe FixASB holds personal data about you, you can contact our data protection mailbox. You have the data protection rights described in the Your rights section below. Some rights and information may be restricted where an exemption under UK data protection law applies, including where disclosure would prejudice crime prevention or would improperly disclose personal data relating to another person.

Unnecessary third-party information

Users may occasionally provide personal information about another person that is not necessary for FixASB's purposes, including telephone numbers, email addresses or other private contact or other personal information. We discourage users from providing such information unless it is directly relevant to the issue. Where we determine that third-party information is unnecessary, we may remove or redact it and will not retain it longer than is necessary to carry out that review.

Who we share data with

We do not sell your personal data. We may share data with: relevant police forces, local authorities, and other authorised organisations, where you have consented to share your contact details or where issue information (including private identifying details) is provided through our secure authority access process; staff who moderate the service; service providers who host, send email or other messages, geocode, map, analyse, or protect the platform (acting as processors under contract); and regulators or law enforcement where we are legally required to do so.

Our current processors include Amazon Web Services (hosting, storage, and email), Cloudflare (content delivery, security, and Turnstile bot protection), Geoapify (geocoding and maps), PostHog in the EU (analytics and session recording after you opt in), Bunny.net (fonts), and Divergent Connect (SMS when that step is enabled).

Public issue pages show an approximate location label, a privacy ring and/or orb, and issue content - not your contact details.

International transfers

Some of our processors (for example geocoding, mapping, content delivery, email, analytics, or bot-protection providers) may process limited technical data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or other mechanisms recognised under UK data protection law.

How long we keep data

We retain personal data for three years for the purposes described in this policy, including operating the service, maintaining issue records, handling moderation and abuse investigations, and meeting legal, accounting, or regulatory requirements. Where an issue remains active for longer than three years, we keep the associated personal data until the issue is no longer active and for three years afterwards. We may keep data for longer where the law requires it or where we need it to deal with a legal claim.

Contact details are retained while an issue remains active and for three years afterwards, unless we need to keep them longer to deal with enquiries, legal claims, abuse prevention or regulatory obligations.

Contact-form messages live in email rather than as a report record. Follow-up preferences and opt-outs are kept while we are following the issue and for three years afterwards. To ask us to delete or anonymise your data, contact our data protection mailbox.

Information describing an issue or place may continue to be retained and published even where personal data associated with the submission is removed, where this is necessary to preserve the integrity of the public record and is supported by our legitimate interests.

When the three-year period ends, or sooner if the data is no longer needed, we delete or anonymise it, except where a longer period is required by law.

Moderation

We may edit, reject, remove or hide content where we reasonably believe it is unlawful, defamatory, abusive, inaccurate or otherwise inconsistent with our Terms of Use.

Photographs

We may edit, reject, or remove user-submitted photos that are not considered relevant to the issue, that breach our Terms of Use, or that unnecessarily identify individuals. Editing will typically take the form of cropping, blurring or pixelating the image.

Uploaded photographs or video that identify individuals will typically not be published, and will instead only be made available to authorised organisations. Redacted or otherwise privacy-protected versions may be published.

Original uploads may retain metadata (including EXIF data) for evidential handling. Published versions are processed. We do not currently accept video file uploads through the service. You can still tell us if you have video available.

Security

We apply technical and organisational measures to protect personal data, including encryption of contact details and other sensitive fields at rest, hashing and encrypted storage of certain technical identifiers so staff can investigate abuse, access controls for authority portals, email verification codes, SMS codes when that step is enabled, and authority access via a signed link to an approved work email. Public issue pages show an approximate location label and a privacy ring and/or orb. No method of transmission or storage is completely secure, but we work to protect data proportionate to the risk.

Your rights

Under UK data protection law you have rights including: access to your personal data; rectification of inaccurate data; erasure in certain circumstances; restriction of processing; objection to processing based on legitimate interests; data portability where applicable; and withdrawal of consent at any time (without affecting processing already carried out). To exercise these rights, contact us at [email protected].

We will consider every request carefully. Some rights are not absolute and may not apply in every circumstance. Where we are unable to comply with a request, we will explain why. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data properly.

Where you exercise your right to erasure of your personal data, we will normally remove or anonymise information that identifies you. That right is not absolute. We may refuse or limit erasure where UK data protection law allows, including where keeping the data is necessary to comply with a legal obligation, to establish or defend legal claims, or where the data relates to criminal offences or alleged offences (or related security measures) and an exemption applies. We may also retain issue records, aggregated support, moderation records and other information that no longer identifies you, where this is necessary to maintain the integrity of the platform.

Cookies and similar technologies

We use essential cookies and similar technologies needed to run FixASB securely and to provide the service you request. Optional functional, analytics, and marketing cookies or similar technologies are used only if you opt in through our cookie banner.

The cookies we set are:

• safetyscore-session - keeps your session while you use the site. It typically lasts 120 minutes of inactivity.
• XSRF-TOKEN - helps protect forms against cross-site request forgery.
• fixasb_cc - stores your cookie preferences (necessary, functional, analytics, and marketing) for about 12 months. It is set when you accept, reject, or save your choices.

Necessary cookies always run. An unfinished report draft may also be stored in sessionStorage on your device so you can continue during the same browser session. That draft stays on your device and is cleared when the draft is submitted or discarded.

Functional storage is used only after you opt in. It remembers choices on this device: whether you have liked a news or content page, that you have already added your voice to an issue today, and your preferred create-report layout. The site still works if you turn this off; the server remains the source of truth for likes and for adding your voice.

Analytics loads PostHog only after you opt in to analytics. We configure PostHog to use sessionStorage (and a short-lived campaign tag in sessionStorage) rather than a cookie. If sessionStorage is unavailable, PostHog may fall back to a first-party cookie. Session recording and similar PostHog features also use similar technologies. Some PostHog tools (for example surveys) may use localStorage. Our analytics host may also set a Cloudflare security cookie. Session recording is personal data: it can capture what you do on the page after you opt in.

Marketing cookies are reserved for advertising and similar content. No ad networks load today, and none will load until you opt in to marketing.

You can change or withdraw your choice at any time. Use Cookie settings to update your preferences. We will also ask again if we change the purposes we use cookies for.

We load fonts from Bunny.net on every page. Where Cloudflare Turnstile is enabled on forms, Cloudflare may also set essential security cookies (such as __cf_bm or cf_clearance) to help prevent automated abuse. These are set by Cloudflare for security purposes, not for advertising.

You can control cookies through your browser settings. Blocking essential cookies may prevent parts of the service from working.

Children

FixASB is intended for use by people aged 18 or over. We do not verify age in the form. If you are under 18, please use the service only with the involvement of a parent or guardian. Private identifying fields may describe other people, including minors - do not include children's identities unless that is necessary for the authority-only report. If you believe a child has provided personal data to us without appropriate consent, contact our data protection mailbox and we will take appropriate steps.

Changes to this policy

We may update this privacy policy from time to time. The version published on this page is the current version. Where changes are significant, we may provide additional notice.

Contact

For questions about this privacy policy or how we handle personal data, including to exercise your data protection rights, contact our data protection mailbox.

Email: [email protected]