Privacy notice
Area reports are built from published open data at postcode level. They do not identify you. An account is optional, and we collect as little as we can if you create one.
Last updated 15 September 2026. This notice explains how bythenumbers uses personal data. Area reports are about places, not people. An account is optional.
Who we are
The data controller is One Rectangle Limited, a UK company registered under number 15416016. It operates bythenumbers.uk under the trading name bythenumbers. For data protection requests, write to hello@bythenumbers.uk.
We do not publish a postal address here. Email is the contact method for privacy requests. The registered office is on the Companies House record. If a request legally needs a postal reply, we will arrange that.
The law this notice follows
We handle personal data under the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). The UK supervisory authority is the Information Commissioner's Office.
This notice covers bythenumbers.uk and the optional account on it. It does not cover other websites we link to, such as property portals or government source pages. Those sites have their own notices.
What we collect
When you browse
Our hosts keep standard server logs so the site can run and stay secure. Those logs can include your IP address, browser type, the page requested, and the time of the request. This is technical data about the visit, not a profile of you.
We also keep first-party counts of pages viewed and postcodes looked up: the kind of event, the path, an optional place slug, whether someone was signed in, and the time. We do not store an IP address, user agent, or account id on those rows. A search is recorded only when you submit the box or pick a suggestion, not on each keystroke.
If you accept analytics, Vercel Web Analytics records page views. It does not use advertising identifiers. It may still process the page path, referrer, a coarse location such as country, and the type of browser or device.
When you look up a postcode
You can read any area report without an account. The figures on those pages come from UK public bodies and OpenStreetMap. They describe places, not named people, and we do not treat a typed postcode as your address unless you save it to an account.
When you create an account
We store:
- your email address and a password you choose
- an account identifier created by our authentication provider
- postcodes you choose to watch
- comparisons you save
- how you want to be emailed about changes
- a record of alert emails we have queued or sent
We do not ask for your name, phone number, home address, payment card, or date of birth.
When you write to us
If you email hello@bythenumbers.uk, we receive whatever you put in that message, including your email address. There is no contact form and no phone line.
How we collect it
We collect personal data in three ways:
- directly from you, when you sign in, save a postcode, or email us
- automatically, through server logs, first-party page and search counts, and, if you consent, analytics
- from public datasets, for area reports. Those datasets are about places. We do not buy personal data or scrape social profiles.
Providing an email address is optional. Without it you can still use the public reports. You cannot keep a watch list or receive alerts unless you give us an email address.
Why we use it
UK GDPR requires a lawful basis for each use of personal data. These are the ones we rely on.
| Purpose | Data | Lawful basis |
|---|---|---|
| Run and secure the website | Server logs, including IP address and user agent | Legitimate interests (Article 6(1)(f)): keeping the service available and investigating abuse |
| Create and run your account | Email address and account id | Contract (Article 6(1)(b)): the account is a service you asked for |
| Remember watched postcodes and saved comparisons | Those lists, tied to your account | Contract (Article 6(1)(b)) |
| Send a password-reset email | Email address | Contract (Article 6(1)(b)). This is a service message, not marketing |
| Send score, price, or digest alerts you turned on | Email address, watched postcodes, preferences | Contract (Article 6(1)(b)). You can change or stop these from the account page |
| Reply to an email you sent us | The message and your address | Legitimate interests (Article 6(1)(f)): answering you. For a partnership or advertising enquiry, also steps toward a contract |
| Understand which pages are used | Page views through Vercel Analytics | Consent (Article 6(1)(a)), and PECR for the analytics script. Off until you accept |
| Meet a legal duty | Whatever we must keep or disclose | Legal obligation (Article 6(1)(c)) |
Where we rely on legitimate interests, we have weighed those interests against your rights. Security logs and answering an email you started are things people reasonably expect from a website. You can still object. See Your rights below.
International transfers
Some processors are based outside the UK, or can access data from outside the UK. Vercel and Resend are US companies. Supabase runs on cloud infrastructure that may not be in the UK.
Where personal data leaves the UK, we rely on a UK-approved transfer tool: the UK Addendum to the EU standard contractual clauses, the UK International Data Transfer Agreement, or an adequacy regulation. We do not send account data to a country without one of those safeguards.
How long we keep it
| Data | How long |
|---|---|
| Account, watched postcodes, saved comparisons, alert preferences | Until you delete the account or we uphold an erasure request |
| Alert event records | Until the account is deleted. They exist so we do not send the same alert twice |
| Emails you send us | As long as needed to answer you and keep a record of the request, then deleted |
| Server logs | Only as long as needed to operate and secure the site, typically no more than 90 days unless we are investigating abuse |
| First-party page and search counts | Kept to operate the site. They do not identify you. We review whether older counts can be dropped as the product grows |
| Analytics page views | Held by Vercel under its retention rules. We stop sending new views if you reject analytics |
| Cookie consent cookie | 180 days, then we ask again |
| Sign-in session cookies | Until you sign out, or 5 minutes idle for staff / 24 hours idle for a public account |
Your rights
Under the UK GDPR you can ask us to do the following. These rights are not always absolute. We will say so if a legal exception applies.
- Access. A copy of the personal data we hold about you.
- Rectification. Correct data that is wrong or incomplete.
- Erasure. Delete your account and the data attached to it. You can do this yourself on the account page, or email us.
- Restriction. Ask us to stop using your data while a complaint or correction is sorted.
- Portability. Receive account data you provided (email, watched postcodes, saved comparisons, preferences) in a common machine-readable format.
- Object. Object to processing that uses legitimate interests, including security logs beyond what is needed to run the site.
- Withdraw consent. Where we use consent (analytics), you can withdraw it from the cookie policy. Withdrawal does not affect use before you withdrew.
To use these rights, email hello@bythenumbers.uk with enough detail for us to find you. For account data that is usually the address you signed in with. We may need to confirm it is you before we release or delete anything.
We will answer within one month. If the request is complex we can take up to two further months, and we will tell you why. There is no fee unless a request is manifestly unfounded or excessive.
How to complain
If you are unhappy with how we have used your data, email hello@bythenumbers.uk first and we will try to put it right.
You also have the right to complain to the Information Commissioner's Office, which regulates data protection in the UK. You can use the ICO complaint form at https://ico.org.uk/make-a-complaint/, or call 0303 123 1113. More contact routes are on https://ico.org.uk.
Automated decisions
The Area Score is an automated summary of published infrastructure and amenity data about a place. It does not measure the people who live there. It is not a decision about you, and it is not used to approve or refuse a tenancy, mortgage, or insurance application. We do not carry out automated decision-making that produces legal or similarly significant effects on an individual, as described in Article 22 of the UK GDPR.
Children
bythenumbers is for people researching where to live, rent or buy in the UK. It is not aimed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, email us and we will delete it.
Marketing
We do not send marketing emails. Alert and digest messages are service emails about postcodes you asked us to watch. You can turn them off from the account page without deleting the account.
We do not run advertising cookies, social-media pixels, or third-party advertising profiles on this site.
Security
Access to account data is limited to the signed-in user and to the systems needed to send alerts. The database uses row-level rules so one account cannot read another. The site is served over HTTPS.
No internet service can promise perfect security. If we become aware of a personal data breach that must be reported, we will tell the ICO within 72 hours where required, and we will tell you without undue delay if the breach is likely to put your rights at high risk.
Changes
If we change how we use personal data, we will update this notice and the date at the top. If a change is material, we will also say so on the site or by email to account holders where we can.
Contact
Privacy requests: hello@bythenumbers.uk. General contact is on the contact page. The figures behind reports are listed on sources.