Privacy Policy

This policy explains how Eden & Friends collects, uses, shares and protects your personal data, and the rights you have over it. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

It covers our website at edenandfriends.co.uk, including the waitlist, member and business accounts, and the business directory. It does not cover other websites we link to — including our sister site Eden & Earth, or the businesses listed in our directory — which have their own policies.

1. Who we are

Eden & Friends is run by Luke Martin, a sole trader trading as Eden & Friends. For the purposes of UK data protection law, Luke Martin is the data controller responsible for your personal data.

• By email: contact@edenandfriends.co.uk — the quickest way to reach us about anything in this policy.

If you have a question about your data or want to exercise any of your rights, email us and we’ll help.

2. The personal data we collect

We only collect what we need to run the directory and keep it trustworthy.

When you join the waitlist

• Your email address (required).
• Your name, if you give it (optional).
• Any values you highlight in the values picker, so we understand what matters to our community.
• If you sign up as a business: your business name, category, website or social link, phone number and an indication of whether you’d pay for a listing — all optional, and used to plan the launch.
• Whether you’ve opted in to launch emails (and, for businesses, a phone call) — each a separate, optional choice you can change at any time. Joining the waitlist never depends on opting in.

When you create an account or sign in

• Your email address, and a password if you choose one (we also offer passwordless “magic link” sign-in by email).
• Your display name and whether you’re a member or a business, stored in your profile.

When you list a business

• Business details you provide: name, description, category, website, phone, contact email, address, town, postcode, and photos or a logo you upload.
• Values information: your ethos statement, value tags, ethical practices, whether you’re independent, and your answers to our vetting questions (why you’re joining, what you stand against, when you were founded, your team).

Please remember that an approved business listing is public — anything you put in it can be seen by anyone visiting the directory.

When you save businesses

If you’re signed in, we record which businesses you’ve saved so we can show them on your Saved page. Only you (and our systems) can see your saved list.

When you share an idea or feedback

If you use our Ideas & feedback board, we store the idea or feedback you send, and your name and email if you choose to add them (both optional — your email only so we can reply). Every idea is reviewed by our team before any part of it appears publicly, and your email address is never shown on the public board.

Technical and security data

• To stop spam and abuse on our public forms, we rate-limit sign-ups by storing a one-way hashed (irreversible) version of your IP address — we never keep your raw IP.
• Our hosting provider keeps standard server and security logs (such as request times and approximate location) needed to deliver the site safely.
• A small number of strictly-necessary cookies and local storage keep you signed in and the site working — see our Cookie Policy.

3. How and why we use your data

Under UK GDPR we must have a lawful basis for using your data. Ours are:

• Running the waitlist — saving your place, understanding our early community, and getting ready to launch — basis: our legitimate interests in building Eden & Friends (and taking steps at your request before we launch). You can object at any time.
• Sending you launch updates by email, and (for businesses who opt in and leave a number) calling you about listing — basis: your consent, given by a separate opt-in and withdrawable at any time.
• Creating and running your account, publishing your listing, and showing your saved businesses — basis: performance of a contract with you (our Terms of Use), or taking steps at your request before entering one.
• Vetting and curating the directory so listings are genuine and values-led — basis: our legitimate interests in running a trustworthy community, and performance of our contract with listed businesses.
• Keeping the service secure — preventing spam, fraud and abuse, rate-limiting and protecting our systems — basis: our legitimate interests in security.
• Meeting our legal obligations and handling your requests, complaints or disputes — basis: legal obligation and/or legitimate interests.

We do not make decisions about you using solely automated processing that produces legal or similarly significant effects. Our human team reviews and approves every business listing.

4. Who we share your data with

We never sell your personal data. We share it only with the service providers (“processors”) that help us run Eden & Friends, and only as far as they need it. They act on our instructions under contract:

• Supabase — our database, sign-in and file storage, and the system that sends account emails such as magic-link sign-ins. Your data is hosted in a data centre in London, United Kingdom.
• Vercel — hosts and serves the website.

When we begin taking payments (a later phase), we will use Stripe to process them securely; we’ll update this policy before that goes live. Payment card details are handled by Stripe, not stored by us.

We may also disclose data if the law requires it, to establish or defend legal claims, or to a buyer if the business is ever transferred — in which case your data stays protected by a policy at least as protective as this one.

5. International data transfers

Your account and directory data is stored in the UK. Some of our providers (such as Vercel and Cloudflare) are global services that may process limited data — for example routing requests or running the anti-spam check — on servers outside the UK.

Where data leaves the UK, we make sure it’s protected by an approved safeguard — a UK “adequacy” decision for the destination country, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses — so it has essentially the same protection as in the UK.

6. How long we keep your data

• Waitlist details: until you ask us to remove them or unsubscribe, after which we delete them. We also review the list periodically and clear it when it’s no longer needed.
• Account and profile data: for as long as your account is open. If you close your account, we delete it (and data linked to it, such as your saved list) promptly, except anything we must keep for legal reasons.
• Business listings: while your listing is live. If you delete it, or it isn’t approved, we remove it.
• Security data such as hashed-IP rate-limit records and server logs: kept only for a short rolling period needed for security, then deleted or aggregated.

7. How we protect your data

Security is built in from the start. Among other measures, we:

• enforce row-level security on every database table, so people can only ever reach their own data;
• route every public submission through a rate-limited, bot-checked gateway rather than letting the browser write to the database directly;
• store IP addresses only as an irreversible hash, never in the raw;
• keep our most sensitive keys server-side only, and serve the whole site over encrypted connections (HTTPS).

No online service can promise perfect security, but we take it seriously and review our approach as the directory grows.

8. Your rights

Under UK data protection law you have the right to:

• be informed about how we use your data (that’s this policy);
• access a copy of the personal data we hold about you;
• rectify data that’s wrong or incomplete;
• erase your data (“the right to be forgotten”) in certain cases;
• restrict or object to how we use your data, including for direct marketing and where we rely on legitimate interests;
• data portability — receive certain data in a portable format;
• withdraw consent at any time, where we rely on it (such as the waitlist).

To exercise any of these, email contact@edenandfriends.co.uk. It’s free, and we’ll respond within one month. We may need to confirm your identity first to protect your data.

9. Marketing and unsubscribing

We’ll only send you launch and community updates if you’ve opted in (a separate, unticked choice when you join). Every message includes an unsubscribe link, and you can opt out at any time — instantly from any email, or by emailing us. We don’t share your details with third parties for their own marketing.

10. Children

Eden & Friends is intended for adults (18 and over) and isn’t directed at children. We don’t knowingly collect data from children. If you believe a child has given us their data, please contact us and we’ll remove it.

11. Changes to this policy

We may update this policy as Eden & Friends grows or the law changes. We’ll change the “last updated” date at the top, and for significant changes we’ll let you know directly where we can.

12. How to complain

If you’re unhappy with how we’ve handled your data, please tell us first at contact@edenandfriends.co.uk so we can put it right. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk.

This policy is effective from 28 June 2026.