Legal
Privacy notice
This page is not finished, and we would rather say so than publish something that reads like a legal document but has not been reviewed as one.
Awaiting legal review
The reviewed notice is a launch requirement and will replace this page before accounts are generally available. Until then, the sections below set out what it will cover. If you have a question about your data in the meantime, write tohello@cirluma.comand a person will answer it.
What follows is the structure of the notice and, for each section, what it has to establish. It is published in this form so the gaps are visible rather than papered over.
1. Who we are
Registered company name and number, registered address, the data-controller identity, and how to contact the person responsible for data protection.
2. What we collect
Account details, the photos and files you upload, the stories and recordings you contribute, Circle membership and permissions, consent records, payment records held by our payment processor, and basic technical logs.
3. Why we hold it, and on what legal basis
Each purpose mapped to its lawful basis: contract for running your account and Circles, legitimate interests for security and service improvement, consent where a recognisable person’s likeness is involved, and legal obligation for financial records.
4. Who can see your material
That a Circle is visible only to its members, that permissions vary by member, that staff access is limited and logged, and the named categories of processor we rely on to run the service.
5. Where it is stored, and transfers
Storage locations, and the safeguards used for any transfer outside the UK or EEA.
6. How long we keep it
Retention periods for account data, uploaded material, consent records, security logs and payment records, and what happens after a deletion request or account closure.
7. Your rights
Access, rectification, erasure, restriction, portability and objection. How to exercise each, how long we take to respond, and the right to complain to the Information Commissioner’s Office.
8. Consent and likeness
How consent is captured, versioned and withdrawn, and what happens to existing created versions when consent is withdrawn.
9. Children
Whether under-18s may hold accounts, and how a Circle handles photos of children contributed by adults.
10. Cookies and analytics
What is set, why, which are strictly necessary, and how to refuse the rest.
11. Changes to this notice
How changes are notified and how previous versions can be seen.
The plain-English summary of how Circles, permissions and consent work is on the Trust page, and that page is accurate today.