Privacy Policy

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. This includes life experience categories, interests, location, mood check-in responses, and free text you voluntarily provide.

Do we process any sensitive personal information? We may process sensitive personal information — such as life experiences relating to loss and life changes, finding companionship, staying active and independent, and care home transitions — when necessary with your consent.

Do we collect any information from third parties? We do not collect any information from third parties.

How do we process your information? We process your information to provide, improve, and administer our Services, suggest connections and groups, communicate with you, for security and fraud prevention, for safeguarding purposes, and to comply with law.

How do you exercise your rights? The easiest way to exercise your rights is by submitting a data subject access request, or by contacting us.

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information we collect may include: names, email addresses, usernames, passwords, contact or authentication data, profile photos, location (town or postcode), age, a short biography, account type (such as care home resident, community member, family member, or care home staff), and calendar events including personal events, group events, and significant personal dates such as birthdays and anniversaries that you choose to add.

Life Experience and Interest Data. You may voluntarily select life situation categories (such as loss and life changes, finding companionship, and staying active and independent, and others), interests, and advice areas. You may also enter free text descriptions of your interests or the type of guidance you are seeking or offering. This information is sensitive in nature and is used exclusively to suggest connections, mentors, and support groups that may be relevant to you. It is never shared externally or used for commercial purposes. You may remove or change this information at any time by editing your profile. On Wisdom Bridge, mentees may create a public listing describing the type of guidance they are seeking. This listing is visible to mentors on the platform. You are responsible for what you include in this listing — we recommend not including specific personal details you would not want other platform members to see. You may edit or delete your listing at any time from your profile.

Daily Wellbeing Check-In. We offer a voluntary daily check-in where you can share how you are feeling (for example: Great, Good, Okay, Not great, or Struggling). This data is stored against your profile. Participation is entirely optional — you may skip it at any time. See Section 2 for how this data may be used for safeguarding purposes.

Sensitive Information. With your consent, we process information you voluntarily share about your life experiences and personal circumstances, including but not limited to loss and life changes, finding companionship, staying active and independent, and personal circumstances relating to care home transitions. This is processed exclusively for matching and connection purposes as described in this notice.

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details. If you choose to register in this way, we will collect certain profile information about you from the social media provider.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This includes your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Services.

Last Active Date. We automatically record the date you last accessed the platform. This is used for safeguarding purposes and to support the wellbeing of our users. See Section 2 for full details.

Like many businesses, we also collect information through cookies and similar technologies. You can find out more about this in our Cookie Notice: https://samestreet.co.uk/cookie-policy.

In Short: We process your information to provide, improve, and administer our Services, communicate with you, suggest connections and groups, for security and fraud prevention, for safeguarding, and to comply with law.

We process your personal information for a variety of reasons, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To suggest connections, mentors, and support groups. We use an automated category overlap scoring system to compare your selected life situation categories, interests, and advice areas with those of other users. This scoring identifies potential matches and surfaces the most relevant suggestions to you on the Friends page and Wisdom Bridge. All matching is performed within the platform's own infrastructure. No external AI service or third party receives your personal data for matching purposes. You can update your matching preferences at any time through your profile settings. See "When and With Whom Do We Share Your Personal Information?" below for details of our infrastructure providers and the safeguards in place for sensitive data specifically.
• To process free text for matching purposes. Where you voluntarily enter free text descriptions of your interests or advice areas, this text may be processed to identify common themes and improve match suggestions between users. This information is used only for matching purposes and is not shared externally.
• To send you notifications about platform activity. We send automated notifications by email and via in-app bell alerts for events including new messages, connection requests, Wisdom Bridge activity, support group updates, calendar reminders, daily check-in prompts, and wellbeing check-ins. You can control these preferences at any time from your Notification Preferences page.
• To support safeguarding and user wellbeing. We record the date you last accessed the platform and your voluntary daily wellbeing check-in responses. If you have not been active for an extended period, or if a pattern of low mood responses is identified, a welfare alert may be sent to your care home’s designated activities coordinator or manager as part of our duty of care to all residents. This is standard practice under CQC safety requirements. Recording your last active date for safeguarding purposes cannot be disabled as it protects your safety. You may skip the daily check-in at any time — it is never compulsory.
• To share engagement data with your care home (with consent). If you identified yourself as a care home resident during onboarding and gave explicit consent, your engagement activity on the platform — such as connections made, support groups joined, and sessions completed — may be shared with your care home’s designated activities coordinator or manager. This helps your care home support your wellbeing and contributes to CQC regulatory evidence. Your private messages are never shared. This consent is recorded with a timestamp. You may withdraw your consent at any time by contacting us at hello@samestreet.co.uk.
• To respond to user enquiries and offer support. We may process your information to respond to your enquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user. Where a user sends a first message to someone they are not yet connected with, that message is held in a message requests inbox until the recipient accepts or declines. If the recipient declines the request, the message is permanently deleted from both inboxes and is not retained in our systems. Users may block other users at any time. Blocking relationships are stored to prevent the blocked user from contacting or viewing the blocking user's profile. This data is deleted when either account is deleted.
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To moderate the platform and protect our community. A designated Same Street safeguarding administrator may access user profiles, issue written warnings, suspend accounts, or delete accounts where necessary to enforce our community guidelines. All moderation actions are permanently logged with a timestamp, reason, and outcome. This log may be exported for regulatory purposes. Users subject to moderation action are notified by email with the reason and their right to appeal. Appeals must be submitted to safeguarding@samestreet.co.uk within 14 days for written warnings and within 30 days for suspensions or account deletions. Appeals are reviewed within 5 working days. If an appeal is successful, the action is reversed and the user is notified.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• To save or protect an individual’s vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on. We may rely on the following:

• Consent. We may process your information if you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time. We rely on consent for processing sensitive life experience categories, care home engagement data sharing, and the daily wellbeing check-in.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfil our contractual obligations to you, including providing the core matching and connection features of the platform.
• Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests, including improving our Services, identifying usage trends, and fraud prevention.
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, including recording last active dates for safeguarding purposes.

In Short: We may share information in specific situations and with the following third parties.

The third parties we may share personal information with include:

• Allow Users to Connect to Their Third-Party Accounts: Google account, Google Cloud Computing Services, Google Cloud Platform
• Website Building and Hosting: Lovable — the platform used to build and host the Same Street website, under a signed data processing agreement. Lovable provisions a managed database (Supabase) as part of this service. This arrangement covers the processing of your account, profile, and general platform data.
• User Account Registration and Authentication: Google Sign-In
• Special Category Data (Health-Related Information): For certain categories of sensitive personal information you may choose to share — such as mood check-in responses, certain support group and Wisdom Bridge content, and welfare concern reports — we are in the process of moving this data to dedicated infrastructure with its own data processing agreement specifically appropriate for this type of information, to ensure the strongest possible protections. We will update this notice once this transition is complete. In the meantime, this data remains protected by restricted access controls, encryption, and human-review-only safeguarding processes as described elsewhere in this notice.
• Email Communications: Zoho Mail — used to send transactional and notification emails from hello@samestreet.co.uk. Zoho processes email content on our behalf and does not use your data for any other purpose.
• Care Home Coordinators and Managers (consent-based only): If you are a care home resident and gave explicit consent during onboarding, your engagement activity summary (not private messages) may be shared with your designated care home coordinator or manager. This sharing is strictly limited to consenting residents and is used to support your wellbeing and care home’s CQC obligations.
• Safeguarding Purposes: In cases where your wellbeing may be at risk — such as extended inactivity or patterns of low mood check-in responses — relevant care home staff may be notified as part of our safeguarding duty of care. This is standard practice under CQC safety requirements.

Business Transfers. We may share or transfer your information in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business.

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice: https://samestreet.co.uk/cookie-policy.

In Short: We use automated category-based scoring to suggest connections, mentors, and groups. We do not use external AI services to process your personal data.

Same Street uses an automated category overlap scoring system to suggest friends, mentors, and support groups based on the life situation categories, interests, and advice areas you select on your profile. This system calculates a compatibility score by comparing your selections with those of other users and surfaces the most relevant suggestions. It does not involve any external artificial intelligence service — all processing is performed within the platform's own infrastructure.

Where you voluntarily enter free text in advice or interest fields, this text may be processed to identify common themes and improve match suggestions. You are in control of this information and may update or remove it at any time through your profile settings.

This automated matching does not produce legal or similarly significant effects — it only suggests potential connections. You are never required to connect with anyone the system suggests, and no decisions are made about you automatically. Under UK GDPR Article 22, you have the right not to be subject to solely automated decisions that produce significant legal effects. Our matching system does not meet that threshold, but we disclose it here in the interest of full transparency.

To opt out of appearing in other users’ match suggestions, you can remove your life situation categories and interests from your profile settings, or contact us at hello@samestreet.co.uk.

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details. Where you choose to do this, we will receive certain profile information about you from your social media provider, such as your name, email address, and profile picture. We will use the information we receive only for the purposes described in this Privacy Notice.

In Short: We may transfer, store, and process your information in countries other than your own.

Our platform infrastructure is operated within the United Kingdom and European Union. We do not transfer your personal data outside the UK/EEA, except where a specific third-party service (such as Google, for Google Sign-In) requires it — in which case that transfer is governed by Standard Contractual Clauses or an equivalent legal safeguard. If you are a resident in the EEA, UK, or Switzerland, please be aware that limited categories of data may be transferred to, stored by, and processed by such third-party services under these safeguards.

We have implemented measures to protect your personal information, including by using the European Commission's Standard Contractual Clauses with relevant processors where applicable. Our Standard Contractual Clauses can be provided upon request.

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law.

If an account has been inactive for 12 months, we will send a reactivation email. If no response is received within 30 days, the account and all associated data will be permanently deleted. If a user passes away, their account will be deleted within 30 days of Same Street being notified by a family member or care home at hello@samestreet.co.uk.

Daily wellbeing check-in data is retained for as long as your account is active and is deleted when your account is deleted. When an account is deleted — either by the user or by an administrator following a moderation decision — it is immediately deactivated and data is retained for 30 days to allow recovery or appeal. After 30 days with no recovery or successful appeal, all data is permanently and irreversibly deleted in compliance with UK GDPR.

Care home consent records are an exception to the 30-day deletion rule. After full account deletion, a minimal consent record is retained for 6 years containing only: the user’s email address, the timestamp consent was given, the exact wording of the consent shown, and the consent version number. No other personal data is retained beyond the 30-day window. This retention is required under the Limitation Act 1980, which allows civil claims to be brought up to 6 years after an event, and ensures Same Street can demonstrate lawful consent was obtained if required by a court or the ICO.

In Short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. These include row-level security controls on our database infrastructure and access controls limiting who can view sensitive data. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. You should only access the Services within a secure environment.

Wisdom Bridge messaging. Messages sent via Wisdom Bridge are not end-to-end encrypted. Same Street’s safeguarding team may occasionally review Wisdom Bridge message content where a concern has been flagged or a member may need support. This is done to protect our members, particularly those who are elderly or vulnerable, and is consistent with our safeguarding obligations. Users are informed of this at the point of first sending a Wisdom Bridge message.

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age. By using the Services, you represent that you are at least 18. If you become aware of any data we may have collected from children under age 18, please contact us at hello@samestreet.co.uk.

In Short: In regions such as the UK, EEA, and Switzerland, you have rights that allow you greater access to and control over your personal information.

In some regions (like the EEA, UK, and Switzerland), you have certain rights under applicable data protection laws, including the right to request access, rectification or erasure, restrict processing, data portability, and not to be subject to automated decision-making.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your UK data protection authority.

Withdrawing your consent: You have the right to withdraw your consent at any time by contacting us at hello@samestreet.co.uk. This includes withdrawing consent for care home engagement data sharing, which you can also do by contacting us directly. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Opting out of matching: You may remove your life situation categories, interests, and advice areas from your profile at any time to opt out of the automated matching system.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can log in to your account settings and update your user account, or contact us. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases in accordance with Section 9.

Cookies and similar technologies: Most web browsers are set to accept cookies by default. For further information, please see our Cookie Notice: https://samestreet.co.uk/cookie-policy.

If you have questions or comments about your privacy rights, you may email us at hello@samestreet.co.uk.

Same Street is a community platform designed primarily for elderly individuals living in UK care homes, as well as community members, family members, care home staff, and younger people seeking mentorship. Given the deeply personal nature of our users’ circumstances — such as loss and life changes, finding companionship, and the transition into care — we treat all personal data with the highest sensitivity.

We will never use personal data for advertising. We will never sell data to third parties. We will never share sensitive profile information beyond what is necessary for the platform’s connection and matching functionality, or what you have explicitly consented to.

Sensitive information you share — such as life experiences, personal circumstances, or care home transitions — is used exclusively for companion matching and group suggestions. It will never be shared outside the platform, sold, or used for any commercial purpose. You may remove it at any time by editing your profile.

We take our safeguarding obligations seriously. Where we have reason to believe a user’s wellbeing may be at risk, we may notify their care home’s designated staff as part of our duty of care. This is explained in full in Sections 2 and 4 of this notice.

Safeguarding the dignity and privacy of our members is central to everything we do.

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated date at the top of this Privacy Notice. Where changes are material, we will notify users by email or via an in-app notification. We encourage you to review this Privacy Notice periodically to stay informed of how we are protecting your information.

If you have questions or comments about this notice, you may email us at hello@samestreet.co.uk or contact us by post at:

Same Street Ltd
Monomark House
27 Old Gloucester Street
London
WC1N 3AX
England

If you are a resident in the United Kingdom, the data controller of your personal information is Same Street Ltd (Company No. 17239608). You can contact us at hello@samestreet.co.uk or by visiting https://samestreet.co.uk.

In Short: We use the following third-party processors and sub-processors to operate Same Street. Each is bound by data processing obligations consistent with UK GDPR Article 28.

• Lovable Technologies Inc. (United States) — Platform hosting, application build environment, and managed database services. Acts as our primary data processor. Supabase is listed as a named sub-processor on Lovable’s sub-processor list at https://trust.lovable.dev/subprocessors. Lovable’s privacy policy: lovable.dev/privacy. Lovable holds SOC 2 Type II and ISO 27001:2022 certifications.
• Supabase Inc. (United States, AWS infrastructure) — Database hosting, authentication, and data storage. Engaged by Lovable as a sub-processor for storing and securing Same Street’s data. SOC 2 Type II certified. Supabase’s privacy policy: supabase.com/privacy.
• Zoho Mail — Transactional and notification email delivery. Processes email addresses and notification content only. Zoho’s privacy policy: zoho.com/privacy.
• Google (Sign-In) — Authentication only. We receive your name, email address, and profile picture when you use Google Sign-In. Governed by Google’s privacy policy: policies.google.com/privacy.

We will provide notice of any sub-processor changes at least 10 days before they take effect by updating this page and notifying users via email where the change is material.