Privacy Notice

Rooted Networks Ltd, a private limited company registered in England and Wales (company number to follow), trading as Rooted Common Ground, based in Scunthorpe, Lincolnshire, United Kingdom.
We are not yet a registered charity; we intend to establish Rooted Common Ground Wellbeing as a registered charity in the future.
Data controller contact: safety@rooted-common-ground.world
ICO Registration Number: ZC179658

Members may disclose health conditions, disabilities, religious beliefs or other sensitive information in their profiles or posts. We do not ask for this. If you share it voluntarily, it is processed under your explicit consent (by choosing to post it publicly) or under substantial public interest (for safeguarding purposes). You can remove it at any time.

• Other Rooted Common Ground members: first name, photo, town/region, trust tier, exchange history and interests only.
• Stripe: payment processing — a data processor under contract with us.
• Twilio: SMS delivery — a data processor under contract with us.
• Supabase: database and storage hosting — a data processor under contract with us.
• UK Police or law enforcement: only in response to a valid legal request (production order, court order, or s.29 DPA request). We log every such request and notify you when legally permitted.
• We never sell your data. Ever.

Each mobile number can be linked to only one active account at a time. When an account is deleted, we keep a one-way hash (an irreversible scramble that can't be reversed into your details) of the phone number and address for up to 24 months. We use this only to stop removed members re-registering and to flag genuine returners for a human to review. The lawful basis is our legitimate interest in preventing fraud and abuse and keeping members safe. See the Data Retention Policy for details.

You have the right to:

• Access your personal data (Subject Access Request).
• Correct inaccurate data.
• Delete your data (some data must be kept for legal reasons).
• Object to certain processing.
• Restrict processing in some circumstances.
• Portability — receive your data in a machine-readable format.
• Withdraw consent at any time for consent-based processing.

To exercise any right, use our Your Rights form or email safety@rooted-common-ground.world. We respond within 30 days and verify your identity before acting on any request.

Deletion is not always immediate or complete. Where the law or member safety requires it, we may keep certain records after you ask us to delete your account — for example to meet legal obligations, resolve disputes, or support a safety or safeguarding investigation. Where we keep records, we delete or anonymise them once they are no longer needed (see the retention table above). We may also disclose information to the police or other authorities where we are lawfully required or permitted to do so.

You can complain to the ICO at ico.org.uk or 0303 123 1113.

Supabase may store data in the EU/EEA. Twilio and Stripe operate globally. All transfers are covered by appropriate safeguards (Standard Contractual Clauses or equivalent). Details available on request.

Trust tiers involve automated calculation but with human oversight. No purely automated decision significantly affecting you is made without human review and an appeals route.

We will notify you by email of material changes 30 days before they take effect.