↳ Privacy policy

What we collect & why.

Last updated: May 2026

Short version: we collect the minimum data we need to make Arch City work. We don't sell it. You can ask for a copy or have it deleted.

Who we are

Arch City is operated by Heather, sole trader (UK). The data controller for this site is Heather, at hello@archcity.co.

What we collect

If you subscribe to the newsletter (free):

  • Email address
  • When you subscribed, where you signed up from
  • Open and click activity on emails we send you

If you join the Locals Club (paid):

  • Email address, name, payment details (handled by Stripe; we never see your card number)
  • Which discount codes you've redeemed at participating venues
  • Which venues you've saved

If you claim a business page (paid):

  • Email address, name, phone, business details
  • Payment details via Stripe
  • Anything you upload to your page (story, hours, photos, updates, replies to reviews)

For everyone who visits:

  • Basic visit data (browser, country, page viewed) via our hosting logs
  • Cookie consent state (whether you accepted analytics cookies)

Why we collect it

  • To send you what you signed up for (newsletter, member emails, account confirmations)
  • To process payments and run subscriptions (legal basis: contract)
  • To improve the site (which pages people read, what's broken)
  • To prevent abuse (spam reviews, fake signups)

Who we share it with

We use a small number of third parties to run the site. Each gets only what they need:

  • Stripe — payments. They see your card details, we don't.
  • Brevo — email sending (newsletter, transactional emails).
  • Hetzner — hosting and server backups.
  • Let's Encrypt — TLS certificates for the site.

We don't sell your data. We don't share it with advertisers.

How long we keep it

  • Newsletter subscribers: until you unsubscribe. Unsubscribed addresses are kept hashed for 12 months so you don't get re-added by mistake, then deleted.
  • Member / owner accounts: for as long as your account is open, plus 12 months after cancellation for tax records.
  • Payment records: 7 years (UK tax requirement).
  • Server logs: rotated and deleted after 90 days.

Your rights

Under GDPR (and equivalent laws like CCPA), you can:

  • Ask for a copy of the data we hold about you (data access)
  • Correct anything that's wrong
  • Ask us to delete your account and your data (right to be forgotten)
  • Object to certain processing
  • Take your data with you (data portability)
  • Complain to your local data regulator (in the UK: the ICO at ico.org.uk)

Email hello@archcity.co and we'll handle it within 30 days.

Cookies

We use a small number of cookies. Detail at archcity.co/cookies.

Children

Arch City isn't aimed at children under 16. If you think we've accidentally collected data from a child, please email us.

Changes

We'll update this page if our practices change. The “Last updated” date at the top will reflect that.