Privacy Policy

Registered name: Same Street Ltd (Company No. 17239608)
Registered address: Monomark House, 27 Old Gloucester Street, London, WC1N 3AX, England
ICO registration: ZC153840
Privacy contact: Privacy Lead, Same Street Ltd — privacy@samestreet.co.uk

Same Street Ltd is the data controller for the personal information described in this notice. Our Privacy Lead is the named contact for all privacy questions, data subject requests, and complaints. You can write to the Privacy Lead at the registered address above or email the address above, and we will respond within one month.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. This includes life experience categories, interests, location, mood check-in responses, and free text you voluntarily provide.

Do we process any sensitive personal information? We may process sensitive personal information — such as life experiences relating to loss and life changes, finding companionship, staying active and independent, and care home transitions — when necessary with your consent.

Do we collect any information from third parties? We do not collect any information from third parties.

How do we process your information? We process your information to provide, improve, and administer our Services, suggest connections and groups, communicate with you, for security and fraud prevention, for safeguarding purposes, and to comply with law.

How do you exercise your rights? The easiest way to exercise your rights is by submitting a data subject access request, or by contacting us.

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information we collect may include: names, email addresses, usernames, passwords, contact or authentication data, profile photos, location (town or postcode), age, a short biography, account type (such as care home resident, community member, family member, or care home staff), and calendar events including personal events, group events, and significant personal dates such as birthdays and anniversaries that you choose to add.

Life Experience and Interest Data. You may voluntarily select life situation categories (such as loss and life changes, finding companionship, and staying active and independent, and others), interests, and advice areas. You may also enter free text descriptions of your interests or the type of guidance you are seeking or offering. This information is sensitive in nature and is used exclusively to suggest connections, mentors, and support groups that may be relevant to you. It is never shared externally or used for commercial purposes. You may remove or change this information at any time by editing your profile. On Wisdom Bridge, mentees may create a public listing describing the type of guidance they are seeking. This listing is visible to mentors on the platform. You are responsible for what you include in this listing — we recommend not including specific personal details you would not want other platform members to see. You may edit or delete your listing at any time from your profile.

Daily Wellbeing Check-In. We offer a voluntary daily check-in where you can share how you are feeling (for example: Great, Good, Okay, Not great, or Struggling). This data is stored against your profile. Participation is entirely optional — you may skip it at any time. See Section 2 for how this data may be used for safeguarding purposes.

Sensitive Information. With your consent, we process information you voluntarily share about your life experiences and personal circumstances, including but not limited to loss and life changes, finding companionship, staying active and independent, and personal circumstances relating to care home transitions. This is processed exclusively for matching and connection purposes as described in this notice.

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details. If you choose to register in this way, we will collect certain profile information about you from the social media provider.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Most information on Same Street is optional. The fields below are required, and here is what happens if you choose not to provide each one:

• Email address — we cannot create or verify your account, so you will not be able to sign up or sign in.
• Password (or social sign-in) — we cannot secure your account, so sign-up cannot be completed.
• First name and last name — we cannot create your profile, so sign-up cannot be completed.
• Display name — we cannot show you to other members safely, so your account cannot be activated.
• Age or age range — we cannot confirm you are 18 or over, so we must refuse access to the Services.
• Location (town or postcode) — we cannot suggest nearby members, groups, or events, so those features will be unavailable.
• Account type — we cannot apply the right safeguarding and privacy settings, so onboarding cannot be completed.
• Mobile number (mentors, guidance seekers, and volunteers only) — we cannot meet our safeguarding duty for these roles, so mentoring and volunteering features will stay switched off until a number is added.
• Onboarding consents — without them we have no lawful basis to process your information, so you cannot finish setting up your account.
• Care home name and staff verification details (care home staff and managers only) — we cannot verify your role, so staff dashboard access will be refused.
• Mentor application answers and professional register details (mentor applicants only) — we cannot assess your application, so it cannot be reviewed or approved.
• Reason text for safeguarding, dispute, or moderation decisions (staff and admins only) — we cannot keep an auditable record, so the action cannot be saved.

Not providing optional information (such as a profile photo, biography, interests, life experience categories, calendar events, or daily wellbeing check-ins) has no effect on your account — it only means fewer personalised suggestions.

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This includes your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Services.

Last Active Date. We automatically record the date you last accessed the platform. This is used for safeguarding purposes and to support the wellbeing of our users. See Section 2 for full details.

Like many businesses, we also collect information through cookies and similar technologies. You can find out more about this in our Cookie Notice: https://samestreet.co.uk/cookie-policy.

In Short: Sometimes information about you reaches us from someone else — care home staff, a family member, a public professional register, or a resident naming you as a trusted contact. This section explains each case.

Capacity and eligibility flags entered by care home staff

Source: verified care home staff at the resident’s care home, entered through the care home dashboard.

What we collect: a Wisdom Bridge capacity and eligibility flag indicating whether a resident is assessed as able to take part in mentoring or pairing, the consent gates recorded for that resident (resident consent, staff or family consent, monthly check-ins), the staff member’s identity and the date and time of the entry, and any reason or note the staff member provides.

Lawful basis: legitimate interests (Article 6(1)(f)) in ensuring people are only matched into relationships they can meaningfully consent to and safely sustain. Cognitive and capacity data is special category health data and is not processed on the basis of consent. For this data we rely on Article 9(2)(b), 9(2)(g) and 9(2)(h) UK GDPR, met by the conditions in Schedule 1 paragraph 18 of the Data Protection Act 2018 (safeguarding of children and of individuals at risk) and Schedule 1 paragraph 2 (health or social care purposes). The purpose recorded against each capacity or eligibility record is safeguarding and care planning for an adult at risk, and every record stores the exact condition relied on so it can be shown to our safeguarding lead on request. Because we do not rely on consent for this data, withdrawing consent does not remove it — but you can still object, ask us to correct it, or ask for it to be reviewed by emailing privacy@samestreet.co.uk. Where a note attached to a flag reveals health information beyond the safeguarding and care purpose, we rely on Article 9(2)(c) vital interests where a person is physically or legally incapable of giving consent and there is a risk to their wellbeing.

Family and carer linking of residents

Source: a family member or carer with a Same Street family account, or care home staff confirming the link.

What we collect: the identity of the resident the family account is linked to, the stated relationship, the fact and date of the link, and any confirmation or rejection of that link by the resident or by care home staff.

Lawful basis: legitimate interests (Article 6(1)(f)) in allowing families to stay involved in a relative’s wellbeing, balanced against the resident’s control over who can see their activity; consent (Article 6(1)(a)) where the resident approves the link and chooses what the family account can see. Links can be refused or withdrawn at any time through Profile → Privacy, or with the help of care home staff.

Mentor professional register lookups

Source: publicly accessible UK professional registers (for example the HCPC, NMC, GMC, SWE and BACP registers), searched using the registration details the mentor applicant gives us.

What we collect: whether a matching registration exists, the registered name, registration number, profession or category, registration status and any recorded restrictions or sanctions, the date and outcome of our check, and an audit record of the lookup.

Lawful basis: legitimate interests (Article 6(1)(f)) in verifying that anyone offering guidance to vulnerable adults holds the credentials they claim, and in preventing fraud and safeguarding harm. Applicants are told at the start of the mentor application that we will carry out register checks, and can dispute any result from their badge using the “This looks wrong” option.

Trusted contact phone numbers submitted by residents and members

Source: the member or resident who names you as their trusted contact; care home staff may assist a resident in providing it.

What we collect: your name, your relationship to the member, your mobile phone number, and the record of the verification message we send to that number and your response to it.

Lawful basis: legitimate interests (Article 6(1)(f)) in being able to reach someone who can check on a member’s welfare, and vital interests (Article 6(1)(d)) where there is a risk to a person’s life or health. We contact you first to confirm you are willing to act as a trusted contact; if you decline or do not respond, the number is not used for ongoing contact and is removed. We never share the member’s content with you.

Our commitment to telling you

Where we obtain personal information about you from someone other than you, and Article 14 of the UK GDPR requires us to tell you, we will provide the required information — who we are, what we hold, why, our lawful basis, how long we keep it and your rights — within one month of obtaining it, or at the point of our first communication with you if that is sooner. In practice this usually means the verification message we send to a trusted contact, or the notice a family member and resident receive when a link is created. We may not be able to provide this where doing so would be impossible, would involve disproportionate effort, or would prejudice an active safeguarding investigation; where we rely on such an exemption we record the reason, and you can ask us about it at any time by emailing privacy@samestreet.co.uk.

In Short: We process your information to provide, improve, and administer our Services, communicate with you, suggest connections and groups, for security and fraud prevention, for safeguarding, and to comply with law.

We process your personal information for a variety of reasons, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To suggest connections, mentors, and support groups. We use an automated category overlap scoring system to compare your selected life situation categories, interests, and advice areas with those of other users. This scoring identifies potential matches and surfaces the most relevant suggestions to you on the Friends page and Wisdom Bridge. All matching is performed within the platform's own infrastructure. No external AI service or third party receives your personal data for matching purposes. You can update your matching preferences at any time through your profile settings. See "When and With Whom Do We Share Your Personal Information?" below for details of our infrastructure providers and the safeguards in place for sensitive data specifically.
• To process free text for matching purposes. Where you voluntarily enter free text descriptions of your interests or advice areas, this text may be processed to identify common themes and improve match suggestions between users. This information is used only for matching purposes and is not shared externally.
• To send you notifications about platform activity. We send automated notifications by email and via in-app bell alerts for events including new messages, connection requests, Wisdom Bridge activity, support group updates, calendar reminders, daily check-in prompts, and wellbeing check-ins. You can control these preferences at any time from your Notification Preferences page.
• To support safeguarding and user wellbeing. We record the date you last accessed the platform and your voluntary daily wellbeing check-in responses. If you have not been active for an extended period, or if a pattern of low mood responses is identified, a welfare alert may be sent to your care home’s designated activities coordinator or manager as part of our duty of care to all residents. This is standard practice under CQC safety requirements. Recording your last active date for safeguarding purposes cannot be disabled as it protects your safety. You may skip the daily check-in at any time — it is never compulsory.
• To share engagement data with your care home (with consent). If you identified yourself as a care home resident during onboarding and gave explicit consent, your engagement activity on the platform — such as connections made, support groups joined, and sessions completed — may be shared with your care home’s designated activities coordinator or manager. This helps your care home support your wellbeing and contributes to CQC regulatory evidence. Your private messages are never shared. This consent is recorded with a timestamp. You may withdraw your consent at any time by contacting us at privacy@samestreet.co.uk.
• To respond to user enquiries and offer support. We may process your information to respond to your enquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user. Where a user sends a first message to someone they are not yet connected with, that message is held in a message requests inbox until the recipient accepts or declines. If the recipient declines the request, the message is permanently deleted from both inboxes and is not retained in our systems. Users may block other users at any time. Blocking relationships are stored to prevent the blocked user from contacting or viewing the blocking user's profile. This data is deleted when either account is deleted.
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To moderate the platform and protect our community. A designated Same Street safeguarding administrator may access user profiles, issue written warnings, suspend accounts, or delete accounts where necessary to enforce our community guidelines. All moderation actions are permanently logged with a timestamp, reason, and outcome. This log may be exported for regulatory purposes. Users subject to moderation action are notified by email with the reason and their right to appeal. Appeals must be submitted to safeguarding@samestreet.co.uk within 14 days for written warnings and within 30 days for suspensions or account deletions. Appeals are reviewed within 5 working days. If an appeal is successful, the action is reversed and the user is notified.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• To save or protect an individual’s vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on. We may rely on the following:

• Consent. We may process your information if you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time. We rely on consent for processing sensitive life experience categories, care home engagement data sharing, and the daily wellbeing check-in.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfil our contractual obligations to you, including providing the core matching and connection features of the platform.
• Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests, including improving our Services, identifying usage trends, and fraud prevention.
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, including recording last active dates for safeguarding purposes.

Where we rely on legitimate interests, we carry out and publish a Legitimate Interests Assessment recording the purpose, why the processing is necessary, and the balancing test. You can read our full assessments for content moderation and safeguarding screening, fraud prevention, and platform improvement and trend analysis in our Legitimate Interests Assessments.

Our screening and moderation of user content is also assessed under the Online Safety Act 2023. See our Online Safety Act Risk Assessment for the illegal content risk assessment, our children’s access assessment, and the senior person accountable for online safety.

Lawful basis by data collection point

The table below maps each specific data collection point on Same Street to its UK GDPR Article 6 lawful basis, the purpose of the processing, and the category of data involved.

In Short: We may share information in specific situations and with the following third parties.

The third parties we may share personal information with include:

• Allow Users to Connect to Their Third-Party Accounts: Google account, Google Cloud Computing Services, Google Cloud Platform
• Website Building and Hosting: Lovable — the platform used to build and host the Same Street website, under a signed data processing agreement. Lovable provisions a managed database (Supabase) as part of this service. This arrangement covers the processing of your account, profile, and general platform data.
• User Account Registration and Authentication: Google Sign-In
• Special Category Data (Health-Related Information): For certain categories of sensitive personal information you may choose to share — such as mood check-in responses, certain support group and Wisdom Bridge content, and welfare concern reports — we are in the process of moving this data to dedicated infrastructure with its own data processing agreement specifically appropriate for this type of information, to ensure the strongest possible protections. We will update this notice once this transition is complete. In the meantime, this data remains protected by restricted access controls, encryption, and human-review-only safeguarding processes as described elsewhere in this notice.
• Email Communications: Zoho Mail — used to send transactional and notification emails from privacy@samestreet.co.uk. Zoho processes email content on our behalf and does not use your data for any other purpose.
• Care Home Coordinators and Managers (consent-based only): If you are a care home resident and gave explicit consent during onboarding, your engagement activity summary (not private messages) may be shared with your designated care home coordinator or manager. This sharing is strictly limited to consenting residents and is used to support your wellbeing and care home’s CQC obligations.
• Safeguarding Purposes: In cases where your wellbeing may be at risk — such as extended inactivity or patterns of low mood check-in responses — relevant care home staff may be notified as part of our safeguarding duty of care. This is standard practice under CQC safety requirements.

Business Transfers. We may share or transfer your information in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business.

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice: https://samestreet.co.uk/cookie-policy.

In Short: We use automated category-based scoring to suggest connections, mentors, and groups. AI assists the scoring of mentor applications, but a human reviewer always makes the final decision. We also use Anthropic's Claude AI for content moderation — see Section 15 for full details.

Same Street uses an automated category overlap scoring system to suggest friends, mentors, and support groups based on the life situation categories, interests, and advice areas you select on your profile. This system calculates a compatibility score by comparing your selections with those of other users and surfaces the most relevant suggestions. It does not involve any external artificial intelligence service — all processing is performed within the platform's own infrastructure.

Where you voluntarily enter free text in advice or interest fields, this text may be processed to identify common themes and improve match suggestions. You are in control of this information and may update or remove it at any time through your profile settings.

This automated matching does not produce legal or similarly significant effects — it only suggests potential connections. You are never required to connect with anyone the system suggests, and no decisions are made about you automatically. Under UK GDPR Article 22, you have the right not to be subject to solely automated decisions that produce significant legal effects. Our matching system does not meet that threshold, but we disclose it here in the interest of full transparency.

Mentor application AI scoring. If you apply to become a mentor, your written interview answers and any supporting documents are assessed with the assistance of an AI model (Anthropic’s Claude) as part of our verification process. The AI produces indicative scores and summaries only — it never decides the outcome of your application. Every application is reviewed and decided by a trained human reviewer, who can agree with, adjust, or disregard the AI assessment. Because a human makes the final decision, this is not solely automated decision-making under UK GDPR Article 22. If your application is unsuccessful, you may request the reasons for the decision and challenge the outcome by emailing safeguarding@samestreet.co.uk. We will respond within 5 working days, and you may also ask for your application to be reviewed again by a different reviewer.

To opt out of appearing in other users’ match suggestions, you can remove your life situation categories and interests from your profile settings, or contact us at privacy@samestreet.co.uk.

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details. Where you choose to do this, we will receive certain profile information about you from your social media provider, such as your name, email address, and profile picture. We will use the information we receive only for the purposes described in this Privacy Notice.

In Short: We may transfer, store, and process your information in countries other than your own.

Our platform infrastructure is operated within the United Kingdom and European Union. We do not transfer your personal data outside the UK/EEA, except where a specific third-party service (such as Google, for Google Sign-In) requires it — in which case that transfer is governed by Standard Contractual Clauses or an equivalent legal safeguard. If you are a resident in the EEA, UK, or Switzerland, please be aware that limited categories of data may be transferred to, stored by, and processed by such third-party services under these safeguards.

We have implemented measures to protect your personal information, including by using the European Commission's Standard Contractual Clauses with relevant processors where applicable. Our Standard Contractual Clauses can be provided upon request.

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law.

If an account has been inactive for 12 months, we will send a reactivation email. If no response is received within 30 days, the account and all associated data will be permanently deleted. If a user passes away, their account will be deleted within 30 days of Same Street being notified by a family member or care home at privacy@samestreet.co.uk.

Daily wellbeing check-in data is retained for as long as your account is active and is deleted when your account is deleted. When an account is deleted — either by the user or by an administrator following a moderation decision — it is immediately deactivated and data is retained for 30 days to allow recovery or appeal. After 30 days with no recovery or successful appeal, all data is permanently and irreversibly deleted in compliance with UK GDPR.

Care home consent records are an exception to the 30-day deletion rule. After full account deletion, a minimal consent record is retained for 6 years containing only: the user’s email address, the timestamp consent was given, the exact wording of the consent shown, and the consent version number. No other personal data is retained beyond the 30-day window. This retention is required under the Limitation Act 1980, which allows civil claims to be brought up to 6 years after an event, and ensures Same Street can demonstrate lawful consent was obtained if required by a court or the ICO.

In Short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. These include row-level security controls on our database infrastructure and access controls limiting who can view sensitive data. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. You should only access the Services within a secure environment.

Wisdom Bridge messaging. Messages sent via Wisdom Bridge are not end-to-end encrypted. Same Street’s safeguarding team may occasionally review Wisdom Bridge message content where a concern has been flagged or a member may need support. This is done to protect our members, particularly those who are elderly or vulnerable, and is consistent with our safeguarding obligations. Users are informed of this at the point of first sending a Wisdom Bridge message.

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age. By using the Services, you represent that you are at least 18. If you become aware of any data we may have collected from children under age 18, please contact us at privacy@samestreet.co.uk.

In Short: In regions such as the UK, EEA, and Switzerland, you have rights that allow you greater access to and control over your personal information.

In some regions (like the EEA, UK, and Switzerland), you have certain rights under applicable data protection laws, including the right to request access, rectification or erasure, restrict processing, data portability, and not to be subject to automated decision-making.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your UK data protection authority.

Withdrawing your consent: You have the right to withdraw your consent at any time by contacting us at privacy@samestreet.co.uk. This includes withdrawing consent for care home engagement data sharing, which you can also do by contacting us directly. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Residents: withdrawing consent to share data with your care home. If you live in a care home, you can withdraw or refuse consent to share your data with your care home staff at any time, without giving a reason and without needing to contact us. Go to Profile → Privacy, where you can turn each sharing setting on or off individually — including your mood check-ins, your wellbeing and activity participation, your Wisdom Bridge transparency settings, and your feedback privacy settings. Changes take effect immediately, your care home is not told why you changed a setting, and refusing or withdrawing consent will never affect the care you receive or your access to Same Street.

Opting out of matching: You may remove your life situation categories, interests, and advice areas from your profile at any time to opt out of the automated matching system.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can log in to your account settings and update your user account, or contact us. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases in accordance with Section 9.

Cookies and similar technologies: Most web browsers are set to accept cookies by default. For further information, please see our Cookie Notice: https://samestreet.co.uk/cookie-policy.

If you have questions or comments about your privacy rights, you may email us at privacy@samestreet.co.uk.

Same Street is a community platform designed primarily for elderly individuals living in UK care homes, as well as community members, family members, care home staff, and younger people seeking mentorship. Given the deeply personal nature of our users’ circumstances — such as loss and life changes, finding companionship, and the transition into care — we treat all personal data with the highest sensitivity.

We will never use personal data for advertising. We will never sell data to third parties. We will never share sensitive profile information beyond what is necessary for the platform’s connection and matching functionality, or what you have explicitly consented to.

Sensitive information you share — such as life experiences, personal circumstances, or care home transitions — is used exclusively for companion matching and group suggestions. It will never be shared outside the platform, sold, or used for any commercial purpose. You may remove it at any time by editing your profile.

We take our safeguarding obligations seriously. Where we have reason to believe a user’s wellbeing may be at risk, we may notify their care home’s designated staff as part of our duty of care. This is explained in full in Sections 2 and 4 of this notice.

Safeguarding the dignity and privacy of our members is central to everything we do.

In Short: All user-generated content is automatically screened for safeguarding risks using keyword matching and AI analysis. This is a condition of platform access.

Same Street operates a two-layer automated content moderation system to protect our users, particularly care home residents and vulnerable older adults.

What is screened. All user-generated content on the platform is automatically screened, including direct messages, message requests, support group posts and comments, Café chat messages, and Wisdom Bridge messages. Profile fields and system-generated content are not screened.

How screening works. Content is screened using two layers that run simultaneously:

• Layer 1 — Keyword screening: Content is checked against a safeguarding keyword and phrase list maintained by Same Street's safeguarding team. Matching is case-insensitive.
• Layer 2 — Semantic AI screening: Content is analysed by Anthropic's Claude AI model to detect contextual safeguarding risks including grooming, financial abuse, exploitation, and expressions of self-harm or suicidal ideation. The AI returns a risk type, confidence level (HIGH, MEDIUM, or LOW), and a brief explanation.

What happens when content is flagged. Content flagged by either layer is placed on hold and not delivered or published until reviewed by Same Street's safeguarding team. The sender is not notified that their content has been held. All moderation decisions are logged to a permanent safeguarding audit log retained for 3 years.

Legal basis. This screening is carried out under our legitimate interests and legal obligations as a safeguarding platform serving vulnerable adults, consistent with the Care Act 2014 and the Safeguarding of Vulnerable Groups Act 2006. For private messages specifically, we rely on vital interests (UK GDPR Article 9(2)(c)) and legitimate interests given our duty of care to vulnerable users.

Third-party processor. The semantic AI layer uses Anthropic PBC (United States) as a data processor. Content sent to Anthropic's API is processed solely for the purpose of safeguarding classification and is subject to Anthropic's Data Processing Agreement including Standard Contractual Clauses. Anthropic does not retain or use this content for model training. Anthropic's privacy policy: anthropic.com/privacy.

Your rights. This screening is a condition of platform access and cannot be disabled individually, as it exists to protect all users including the most vulnerable. If you have concerns about a specific moderation decision, contact us at safeguarding@samestreet.co.uk.

Message safety screening

To keep our members safe, first messages from people you haven't connected with yet are reviewed for safety before reaching you. Messages from your connections are private.

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated date at the top of this Privacy Notice. Where changes are material, we will notify users by email or via an in-app notification. We encourage you to review this Privacy Notice periodically to stay informed of how we are protecting your information.

If you have questions or comments about this notice, you may email us at privacy@samestreet.co.uk or contact us by post at:

Same Street Ltd
Monomark House
27 Old Gloucester Street
London
WC1N 3AX
England

If you are a resident in the United Kingdom, the data controller of your personal information is Same Street Ltd (Company No. 17239608). You can contact us at privacy@samestreet.co.uk or by visiting https://samestreet.co.uk.

In Short: We use the following third-party processors and sub-processors to operate Same Street. Each is bound by data processing obligations consistent with UK GDPR Article 28.

• Lovable Technologies Inc. (United States) — Platform hosting, application build environment, and managed database services. Acts as our primary data processor. Supabase is listed as a named sub-processor on Lovable’s sub-processor list at https://trust.lovable.dev/subprocessors. Lovable’s privacy policy: lovable.dev/privacy. Lovable holds SOC 2 Type II and ISO 27001:2022 certifications.
• Supabase Inc. (United States, AWS infrastructure) — Database hosting, authentication, and data storage. Engaged by Lovable as a sub-processor for storing and securing Same Street’s data. SOC 2 Type II certified. Supabase’s privacy policy: supabase.com/privacy.
• Twilio Inc. (United States) — SMS delivery (including one-time passcodes and trusted-contact messages), voice calls, and safeguarding call handling. Processes mobile numbers, call metadata, and call recordings where applicable. International transfers are covered by the UK International Data Transfer Addendum (IDTA) to the European Commission’s Standard Contractual Clauses. Twilio’s privacy policy: twilio.com/legal/privacy.
• Zoho Mail (United States / European Union data centres) — Transactional and notification email delivery. Processes email addresses and notification content only. Where data is transferred outside the UK, the transfer is covered by the UK International Data Transfer Addendum (IDTA) to the European Commission’s Standard Contractual Clauses. Zoho’s privacy policy: zoho.com/privacy.
• Google (Sign-In) — Authentication only. We receive your name, email address, and profile picture when you use Google Sign-In. Governed by Google’s privacy policy: policies.google.com/privacy.
• Anthropic PBC (United States) — Semantic AI content moderation. Processes user-generated content solely for safeguarding classification purposes. Content is not retained or used for model training. Governed by Anthropic's Data Processing Agreement including Standard Contractual Clauses. Anthropic's privacy policy: anthropic.com/privacy.

We will provide notice of any sub-processor changes at least 10 days before they take effect by updating this page and notifying users via email where the change is material.