Who we are
MyLittleEyes is operated by My Little Eye Tech Ltd (UK). We are the data controller for the platform.
Registered office: available on request.
You can also reach us via the contact form on the site.
Data we collect
- Account & identity: name, email, password hash, profile photo, roles/preferences.
- Listings: property addresses/UPRN, descriptions, photos/floorplans, pricing, availability, contact details.
- Messages & enquiries: message content, viewing preferences, support tickets.
- Verification: professional accreditation details, uploaded documents, signature/envelope metadata.
- Payments & orders: order references, Stripe session IDs, amounts (no full card data stored by us).
- Usage & device: IP, logs, referrers, cookie identifiers/consent choices, location you choose on maps.
- Professional profiles: company name, profession, languages, service areas, bios, pricing.
Purposes & legal basis
- Provide the service (accounts, listings, messaging, bookings, orders) - contract.
- Payments and documents (checkout, receipts, signed agreements) - contract and legal obligation.
- Verification and fraud prevention - legitimate interests and legal obligation where applicable.
- Support communications - contract / legitimate interests.
- Marketing updates - consent (opt-in, withdraw anytime).
- Analytics and product improvement - consent for optional analytics cookies.
- Security, abuse monitoring, compliance - legitimate interests and legal obligation.
Sharing & subprocessors
We only share what is necessary to run MyLittleEyes:
- Stripe for payments; we share order references and contact email.
- Google Cloud Storage for hosting uploads (kept private and access-controlled).
- Email provider for verification, receipts, and notifications.
- Signable / e-sign vendor for signature workflows and PDFs.
- Canopy / verification partners for referencing and ID checks when requested.
- Other users when you choose to message or transact with them.
See docs/gdpr/subprocessors.md for the active list and what is shared.
Retention
We keep data only as long as needed, then delete or anonymise it.
- Contact enquiries: typically 12 months.
- Logs/webhooks: typically 90 days.
- Messaging: kept while accounts are active; names anonymised if users delete accounts.
- Listings and professional profiles: while active plus a limited audit window.
- Payments and signed agreements: at least 6 years (legal/financial record keeping).
See docs/gdpr/retention_policy.md for details.
Your rights
You can:
- Access, correct, or delete your data.
- Receive a copy (portability) in a common format.
- Restrict or object to processing based on legitimate interests.
- Withdraw consent for optional uses (e.g., marketing, analytics).
- Complain to the ICO if you are unhappy with our response.
Use Account > Privacy tools or email enquiry@mylittleeyes.co.uk.
Cookies & analytics
We use a cookie banner to collect consent. Analytics (Google Analytics 4) and preference cookies load only after you choose. Manage choices anytime via "Manage cookies" in the footer. See the Cookie Policy.
Security
- Secure cookies with HTTPOnly/SameSite and HTTPS in production.
- Access controls for admin-only areas and document downloads.
- Private storage for uploads with signed URLs or auth checks.
International transfers
Where providers process data outside the UK/EEA, we use recognised safeguards such as SCCs/IDTA and, where relevant, the UK-US Data Bridge. Details are available on request.
Contact & complaints
Email enquiry@mylittleeyes.co.uk for any request. You can complain to the ICO at ico.org.uk.
Changes
We will update this notice when our practices change. Material changes will be highlighted in-app or by email where appropriate.