Privacy Policy

Last updated: 2026-10-19 Effective: 2026-09-01

1. Who we are

Noisy Neighbour is operated by ANSONBY LTD ("Noisy Neighbour", "we", "us", "our"), a private limited company registered in England and Wales.

• Registered name: ANSONBY LTD
• Company number: 14649743, registered at Companies House
• Registered office: C/O N R Betts & Co, 2 Victoria Square, Fountain Court, St Albans, Hertfordshire, United Kingdom, AL1 3TF
• Service domain: noisy-neighbour.com
• Contact: info@noisy-neighbour.com

We are the data controller for personal data we process about you in connection with the Noisy Neighbour service ("the Service").

EU representative

We are established in the United Kingdom, so we are not required to appoint a UK representative under Article 27 of the UK GDPR. If we offer the Service to individuals located in the European Economic Area, we may be required to appoint a representative in the EEA under Article 27 of the EU GDPR.

• EU representative (if and when required): [NAME / ADDRESS / CONTACT — to be appointed before the Service is offered to individuals in the EEA]

Until then, please contact us directly at info@noisy-neighbour.com for any data-protection enquiry.

2. Who uses the Service, and the data we collect

The Service is a portal that keeps the neighbours of a building site informed and gives them a way to raise problems with the site team. Two kinds of people use it:

• Builders — the site team that sets up a site on Noisy Neighbour, publishes notices and documents, and responds to issues. The person who creates a site holds the account that is responsible for it.
• Neighbours and other stakeholders — people who live or work near the site and join its portal, usually by scanning the QR code on the site hoarding. There are four kinds: a neighbour, the property's homeowner, and — for a block of flats — the building manager and the porter.

Data builders give us directly

• Account data: your name, email address and/or phone number, and a hashed password. You may provide either an email address or a phone number (or both) when you register; we use whichever you choose as your identifier when you sign in. The registration form also asks, optionally, how you heard about the Service; if you answer, we keep your answer with your account and use it only to understand where our customers come from.
• Company data (optional): your company name, company phone number, company address. You can add or omit this.
• Site data: the site's name and address, a short description of the works, expected start and completion dates, and a site photograph. The site's address and description appear on its public page — that is the point of the page — so do not use the Service for a site whose location must stay private.
• The site-manager profile: the site manager's name, role and photograph, and the contact phone numbers you choose to give, including an out-of-hours number. The name and photograph appear on the public page; the phone numbers are shown only to people who have joined the portal (see "Who sees what" below).
• Notices: the text, dates and any photographs of the notices you publish about upcoming or changed works. The works calendar is a view over those notices.
• Documents you publish: paperwork you choose to make visible to neighbours — for example a Party Wall Agreement, a Licence to Alter or an insurance certificate — together with any expiry date you record. A document is private to the site team unless an administrator publishes it.
• Responses and messages: your replies on issues, your private messages to individual stakeholders, and any photographs attached to either.
• Team data: the email addresses of the team members you invite to a site.
• Billing data: if you buy credit packs, the email address you provide for billing, a record of your purchases and your credit balance, and a Stripe customer identifier. We do not see, store, or process your full payment card details — those are handled directly by Stripe (see "Subprocessors" below).
• Communications: the contents of any messages you send us by email or other channels.

Data neighbours and other stakeholders give us directly

• Account data as above (name, email address and/or phone number, hashed password).
• An address line you choose to give (for example "No. 14" or "Flat 3, 22 Elm Rd"), so the site team knows which property is raising an issue.
• Issue reports and follow-ups: the text of the issues you raise, your replies and confirmations, and any photographs or short videos you attach as evidence.
• A contact phone number, if you give one. This is optional. For a building manager or a porter it may additionally be shown to the other people on that portal, but only if you have agreed to be listed — the setting is off unless someone turns it on. A neighbour's number is never shown to other neighbours.
• The text of private messages between you and the site team, and any photographs attached to them. These are visible to you and the site team only — not to the homeowner, not to the building manager, and not to any other neighbour.
• Notification preferences, and — transiently — your IP address for rate-limiting, as for any user.

Feedback you send us

Every page of the Service ends with a box for bug reports and suggestions. What you type there is stored so that we can read and act on it, together with the page you sent it from. If you are signed in, the report is linked to your account so that we can reply; if you are not, you may leave an email address for a reply — it is optional, and a report with no address is kept anonymously.

Data we collect automatically

• Usage data: dates and times of issues, notices, messages and other actions on a site, their processing status, and similar operational metadata used to run the Service.
• Authentication data: a session cookie, and a per-user revocation counter (tokenVersion) used to invalidate outstanding sessions when you reset your password or delete your account.
• IP address: captured transiently for rate-limiting and abuse-prevention purposes via our rate-limiting subprocessor.
• Error / diagnostic data: when an error occurs in your session, we may log technical details (the request URL, browser information, error context) to help us debug.
• Website analytics and advertising measurement — only with your consent: if you accept analytics cookies, we use Google Analytics 4 on every page of the Service to understand how it is used — which pages are visited, in what order, from what kind of device and browser, and roughly where in the world. Google Analytics 4 does not log or store IP addresses, and we do not link analytics data to your account. If you accept advertising cookies, an advertising pixel from OpenAI tells OpenAI when a sign-up follows one of our adverts shown in ChatGPT, so we can see which adverts work. We do not use either for personalised advertising. Neither is set until you choose in the cookie banner; Section 10 lists the cookies and how to change your choice.

Information about third parties

When a builder sets up a site, publishes a notice, or logs an issue on behalf of a neighbour who telephoned or called at the site, personal data about other people may be processed by us — for example a neighbour's name and address line entered by the site team, or a person who appears in a photograph attached to an issue.

The builder is responsible for the lawful basis on which they enter that information — see Section 6 ("Your responsibilities"). A stakeholder who attaches a photograph or a video is responsible for what it shows.

Resident lists. A managing agent, residents' trust or other site operator may upload a list of the people who live in a building (flat, name, email address, telephone number) so that they can be invited to the site page. We hold that list on the operator's behalf and use it only to send the invitations the operator asks us to send and to show the operator who has joined. The operator is responsible for having a lawful basis to share it with us and to contact the people on it. A person on such a list who has not joined the site page may ask us, or the operator, to remove their details; joining creates an account governed by the rest of this policy. (Draft clause added 2026-09-25 for ADR-0051 — not yet reviewed by a solicitor.)

Sensitive personal data

We do not intentionally collect special category data (data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, health data, or data concerning sex life or sexual orientation). If such information ends up in an issue report, a message, a photograph or a document you upload, we treat it as ordinary content under this policy — we have no way to identify or specially handle it unless you tell us.

We do not record audio, and we do not process voice or any other biometric data.

Who sees what

A neighbour's name, email address, address line and issues are visible to the site team and the homeowner of that site only — never to other neighbours, and never on the site's public page. In a block of flats the building manager also sees the issues raised in that building, because acting on them is their role; the porter does not, and sees only their own reports. Issues are private by default; if the site team publishes an issue as a notice for the street, your identity is included only with your consent. Responders are shown to neighbours by first name and role only (for example "Dave · Site team").

What the builder publishes about themselves. A site's public page may show the site photograph, the site manager's name, role and photograph, upcoming notices, and paperwork the builder chooses to publish, such as a Party Wall Agreement, a Licence to Alter or an insurance certificate. Those are the builder's own details and documents, published by their own choice. Contact phone numbers, including the out-of-hours number, are shown only to people who have joined the portal — never on the page that anyone with the QR code can read.

3. Why we process your data, and the legal basis

We do not currently send marketing emails. If we ever do, we will rely on your consent (Art. 6(1)(a)) and you will be able to withdraw that consent at any time.

4. How the site's record is built, and where AI is involved

The Service keeps a record of the site for the builder: the issues raised, what the site team said and did about them, the notices published, and the documents shared. Most of that record is built without any AI — it is the content itself, arranged by date.

Two things do use third-party AI models, currently provided by OpenAI, L.L.C.:

• Event extraction. The text of the site team's own posts and notices — and, once the site team has acknowledged an issue, the report and follow-ups on it — may be sent to OpenAI's GPT-4o-mini model to pick out dated events and follow-up actions (for example "the skip will be moved on Monday") for the builder's record. A private message thread enters this processing only once the site team has replied in it.
• Search. The same text is used to generate a numerical representation ("embedding") with OpenAI's text-embedding-3-small model, so the site team can search the site's record in plain language.

Text sent for this processing is labelled only by the role of the person who wrote it (for example "a neighbour said") — never by their name, address line or email address — and a stakeholder's words are always presented to the model as reported by a third party, never as a statement by the builder. A neighbour's report that the site team has not acknowledged is not processed in this way, and the words of a stakeholder the site team has blocked are withdrawn from it.

OpenAI's API terms (in force at the time of writing) do not use API-submitted content to train OpenAI's models unless we explicitly opt in (and we do not). OpenAI may retain the data for a limited period for abuse monitoring; see OpenAI's privacy documentation for current details.

The outputs (extracted events and actions, search results) are stored on our infrastructure and shown to the site team only. They are not shown to neighbours and not shared with any third party other than the AI subprocessor described above.

Photographs. Photographs attached to issues, messages and notices, and the site photograph, are analysed by an open-source image model (CLIP) that runs on our own infrastructure, so the site team can search them by description (for example "skip on pavement"). Your photographs are not sent to any third-party AI provider for this — the analysis happens within our AWS account, and only the resulting numerical vector is stored. The site manager's photograph is not analysed at all. Videos attached as evidence are stored and played back; they are not analysed.

Important: AI outputs are not guaranteed to be accurate. They are an aid to the site team's own record, not a substitute for reading what was said. See the warranty disclaimer in our Terms of Service.

5. Who we share your data with (subprocessors)

We share personal data only with vetted subprocessors who help us run the Service. Each subprocessor handles a defined slice of data, under a written contract with appropriate data-protection terms (where required, including UK and EU Standard Contractual Clauses for international transfers).

We do not sell your personal data, and we do not share it with data brokers. The only thing an advertising platform learns from us is the sign-up signal described in Section 10, and only if you have accepted advertising cookies.

If we add or change a subprocessor, we will update this policy. Material changes will be notified to you by email and/or a notice in the Service.

6. Your responsibilities — builders and the people around your site

If you run a site on the Service, the neighbours who join its portal give their details to us by their own choice, and this policy governs what we do with them. Some personal data, though, is entered by you:

• Details you enter about other people — an issue you log on behalf of a neighbour who telephoned or called at the site, a name in a notice, a photograph in which someone can be identified. For that personal data you are the data controller and we act as your data processor. You are responsible for having a lawful basis under UK GDPR for entering it and, where the law requires, for telling the person that their details are being handled using a third-party tool.
• Publishing an issue as a notice. A neighbour's identity is included only with their consent; the Service asks before it does so. Do not name a neighbour in a notice or message in any other way without their agreement.
• The site-manager profile and the out-of-hours number. Keep them accurate. The out-of-hours number is shown to people who have joined the portal; if the person on that number changes, change the profile.
• Documents you publish. Publish only paperwork you are entitled to make available to the street.
• The QR code and hoarding notice. Display them only on a site you are responsible for.

This obligation is set out in more detail in our Terms of Service.

7. Where your data is stored

Your content data (site details, issues, notices, messages, photographs, videos, documents, and the site's record) is stored on infrastructure located in the United Kingdom (AWS and Neon, eu-west-2/London region).

We (the data controller) are established in the United Kingdom, so administering your account does not involve a transfer out of the United Kingdom. Some processing does involve international transfers:

• To the United States, when text is sent to OpenAI for the processing described in Section 4, when Stripe processes a payment, when Resend sends a transactional email, or when Inngest orchestrates background jobs.

Where personal data is transferred outside the United Kingdom or the European Economic Area, we rely on appropriate safeguards under UK and EU data-protection law. For transfers to the United States these are typically the UK International Data Transfer Agreement (or UK Addendum to the EU Standard Contractual Clauses) and/or the EU Standard Contractual Clauses, supplemented by such technical and organisational measures as the receiving subprocessor maintains.

You can request a copy of the relevant transfer mechanism by writing to info@noisy-neighbour.com.

8. How long we keep your data

• While your account is active: we retain your account data and the content of the sites you run or have joined for as long as you keep your account open.
• When you delete your account: we mark your account as deleted immediately and revoke your sessions. Within 30 days of account deletion we permanently delete or irreversibly anonymise your identifiable personal data. Within that window you can contact us to reverse the deletion entirely; after it, deletion is irreversible.
• Sites you run: a site only you belong to is deleted with your account — its issues, notices, messages, photographs, videos and documents included. A site shared with other team members is handed over to one of them rather than deleted — its record is not destroyed by your departure. Content you contributed to a site that survives remains part of that site's record (retained on the basis of the site owner's legitimate interests and the establishment or defence of legal claims), but we remove its link to your identity: your name, email and other personal details are erased.
• Sites you joined as a stakeholder: your stakeholder link is removed and your personal details are erased, while the issues you raised and the private messages you exchanged with the site team survive as part of the builder's record with your identity removed — your name, email address, address line and phone number are taken out of the thread, whichever kind of stakeholder you were.
• Anonymised aggregate data: we may retain anonymised, aggregated usage data (for example, totals such as "X issues raised across all sites in month Y") indefinitely for product-improvement and reporting purposes. Once data has been anonymised so that it cannot be re-associated with you, it falls outside the scope of data-protection law.
• Billing records: we retain a limited amount of billing information (invoices, transaction records) for as long as required to meet our tax and accounting obligations, even after you delete your account.
• Backups: deleted data may persist in routine encrypted backups for a short period until the backups themselves are rotated, after which it is overwritten.
• Logs: operational and security logs are retained for up to 90 days.

Every notification email carries a one-click unsubscribe link, and you can set your notification level (everything, important notices only, or none) in the portal at any time.

If you ask us to delete a specific piece of content (rather than your whole account), we will do so promptly. Where the site's record was derived from it, we will remove the content and re-derive the record without it.

9. Your rights

Under UK GDPR (and EU GDPR where it applies to you), you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete personal data.
• Erase ("right to be forgotten") your personal data in the circumstances recognised by law. Account deletion in the Service is the simplest route for most data; for anything else, write to us.
• Restrict our processing of your personal data in certain circumstances.
• Object to processing we conduct on the basis of our legitimate interests.
• Portability — receive a copy of personal data you provided to us in a structured, commonly-used, machine-readable format.
• Withdraw consent at any time, where we rely on consent — for the analytics and advertising cookies in Section 10, through the Cookie settings link in the footer of the website.
• Not be subject to fully automated decisions that produce legal or similarly significant effects on you. The Service does not currently make any such decisions; AI is used to produce content for the site team's review, not to make decisions about you.

To exercise any of these rights, write to info@noisy-neighbour.com. We will respond within one month and may request information to verify your identity.

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (the UK's data-protection regulator) at ico.org.uk, or to your local data-protection authority in the EU/EEA. We would, however, appreciate the chance to address your concern first.

10. Cookies and similar technologies

Noisy Neighbour sets the following strictly-necessary cookies required to operate the Service:

• A session cookie set by our authentication provider (NextAuth) to keep you signed in.

• Short-lived impersonation cookies set only when an administrator legitimately impersonates a user account for support purposes (all such use is recorded in an audit log).

• Your cookie choice itself, saved in your browser's local storage (nn_consent) so we do not ask again on every page.

The following are not strictly necessary and are set only after you consent in the cookie banner. Until you choose, and if you decline, neither is set and no measurement data is sent.

• Google Analytics (measurement). Cookies _ga and _ga_*, set by Google Analytics 4, tell visits apart and measure how the Service is used — which pages are visited, in what order, from what kind of device and browser, and roughly where in the world — as described in Section 2. Set only if you accept analytics cookies.
• OpenAI advertising pixel (advertising measurement). We advertise in ChatGPT. The pixel measures the sign-ups that follow one of those adverts, so we can see which adverts work; it is not used to personalise adverts to you. Set only if you accept advertising cookies.

Both are loaded through Google Tag Manager, which honours your choice. You can change your choice at any time with the Cookie settings link in the footer of the website, and you can block or delete cookies in your browser settings. We use no social-media cookies.

11. Children

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at info@noisy-neighbour.com and we will delete the data.

12. Security

We take reasonable technical and organisational measures to protect your personal data, including:

• Encryption in transit (HTTPS / TLS) for all communications with the Service.
• Encryption at rest for stored content (provided by AWS S3 and Neon).
• Strong password hashing (bcrypt) for stored credentials.
• Session revocation (the tokenVersion mechanism) that invalidates outstanding sessions when you reset your password or delete your account.
• Strict access controls: a site's content is visible only to its site team and to the stakeholders who have joined it, each according to the visibility rules in Section 2. Documents are private to the site team unless an administrator publishes them, and every read of a published document is re-checked against that setting.
• Operational access to production systems is limited to a small number of authorised personnel and is logged.

No system is perfectly secure. If you become aware of a security issue, please write to info@noisy-neighbour.com.

13. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top. If the changes are material, we will notify you by email and/or by a notice in the Service before the changes take effect.

14. Contact

• Email: info@noisy-neighbour.com
• Postal: ANSONBY LTD, C/O N R Betts & Co, 2 Victoria Square, Fountain Court, St Albans, Hertfordshire, United Kingdom, AL1 3TF
• EU representative: [IF AND WHEN REQUIRED — see Section 1]