Privacy Policy
What we collect, why, who sees it, how long we keep it, and your rights.
This is a draft that describes how Landcode works today. It still needs a lawyer's review before launch.
Who we are
Landcode is responsible for your personal data on Landcode (the “controller”). Chamber of Commerce (KvK) number 93881525. For anything about your data, email info@landcode.studio.
Landcode is based in the Netherlands, so the EU's GDPR applies. Because Landcode also serves people in the United Kingdom, the UK GDPR applies to the data of people there too.
What is public
Landcode is a place to show your work, so a lot of it is public on purpose: your profile, @handle, photo, landcode, city, what you do, portfolio, posts, listings, shops, events, projects and published reviews. Anyone can see these without an account, and search engines can show them. A private hiring account has no public profile. Your email address and phone number are never public; your phone number is shown to people you deal with only if you switch that on.
What we use, why, and for how long
| Why | What | Legal basis | How long |
|---|---|---|---|
| Your account and signing in | Email address or phone number, password (stored only as a hash) or a one-time code, your Google account details if you use Google, sign-in times | Contract: we need it to give you an account | Until you delete your account |
| Your public profile and work | Name, @handle, photo, landcode, city, what you do, Instagram handle, portfolio, posts, listings, events, projects, reviews, and once you have been paid for work through Landcode, how many paid jobs, clients and returning clients you have had (counts only, never amounts) | Contract: showing your work is what Landcode is for | Until you delete it or your account |
| Showing you on the map | Your city, or a pin you drop (stored rounded to about 1 km and shown with a fixed offset) | Contract, and only when you choose to appear | Pins and trips: deleted 30 days after they expire. City: until you remove it |
| Buying, selling, hiring and tickets | Orders, quotes, amounts, the other party, delivery details you give at checkout | Contract, and our legal duty to keep financial records | Order records: 7 years (Dutch bookkeeping law). Shipping address: blanked 180 days after the order is settled |
| Messages about a piece of work | What you and the other person write in the thread on a quote or a role application, and when. No one else can join a thread | Contract: agreeing and delivering the work | Deleted 730 days after the work ends (the quote is finished or the application is decided). You cannot edit or delete a message once sent |
| Invoices for our fee | When you pay Landcode a commission: your name, country, VAT number if you gave one, the fee and the btw on it | Legal obligation: Dutch tax law requires us to issue and keep invoices | 7 years (Dutch tax law) |
| Getting paid | Handled by Stripe: your identity and bank details for payouts. We keep the status of your payout account | Contract, and the payment provider's legal duties | Status: until you delete your account. Stripe keeps its own records under its own duties |
| Checking who hires creatives | Done by Stripe Identity: a photo ID and, if you choose, a live selfie that Stripe compares with it to confirm it's you (biometric data). They go to Stripe only. We keep the result: verified or not, which check you chose, your verified name, the date, and your consent | Legitimate interest (the safety of the people being hired) for asking hirers to verify; your explicit consent for the selfie comparison, which you give before the check. You can choose to verify with your ID only, without a selfie | The result: until you delete your account. Stripe is asked to delete the photos once the check is finished. An attempt never completed: deleted after 90 days |
| Emails about your activity | Your email address, what the email was about, when it was sent | Contract for receipts and updates on your orders and hires; legitimate interest for at most two reminders after sign-up, which you can turn off | The address in our sending log is blanked after 395 days |
| In-app notifications | Who followed you, requested a collaboration, applied or hired you | Contract | Deleted after 365 days |
| Safety and moderation | Reports you make or that are made about content, blocks you set | Legitimate interest: keeping people and the platform safe | Closed reports: deleted 730 days after review. Open reports are kept until they are handled. Our record of which admin decided: deleted after 730 days |
| Security and running the service | IP address, device and browser details in server logs, sign-in attempt counters | Legitimate interest: protecting accounts and keeping the service working | Sign-in counters: 1 day. Server logs: 30 days |
We do not sell your data, show you ads, or use it to build advertising profiles.
Credits on work
People can credit the collaborators who made a piece of work with them. If the person credited has a Landcode account, they are notified and choose whether to accept; a credit only appears on their profile once they do.
If they do not have an account, the only thing stored about them is the name the person typed and the role they played, attached to that one piece of work. We never ask for, collect, or store a non-user’s email address or phone number, which is why the claim link is sent to them by the person crediting them, not by us.
That name is not published. Visitors to the work see the role and that a credit is pending; only the person who wrote the name down can see it, so that they can tell their own pending credits apart. If the person named claims the credit, the name shown from then on is the one they chose for themselves.
- The person who gave the credit can remove it at any time, which deletes it outright.
- The person credited can decline it, at any point, including after accepting.
- An unclaimed credit is deleted automatically once its link has been expired for 30 days.
- Claim links work once, expire after 60 days, and are stored only as a one-way hash.
Location and the map
- Area-level only. You appear on the map only if you choose to: by saving a city, dropping a pin, or putting a listing on the map. A pin shows a neighbourhood or city, never a street address.
- Rounded and offset. A dropped pin is stored rounded to a square of about 1 km, and every pin is drawn with a small offset that is fixed for you, so it never points at a real doorstep.
- Pins expire. You choose how long a pin lives (1 hour to 6 months), and you can remove it any time.
- Events use venues. Events are public gatherings, so their venue addresses are shown on purpose.
- “Locate me” uses your device's position only to move the map. It is not sent to other people as a precise point.
Messages and contact
Once there is work between two people (a quote, or an application to a project role), they can message each other in a thread on that work. Only the two of them can read and write in it. Landcode's administrators can see a message only after one of you reports it, to decide the report. Messages cannot be edited or deleted once sent, a block stops the thread, and we delete them two years after the work ends.
There is no other messaging on Landcode. To contact someone before there is any work, we open their Instagram or email, so we never see those conversations.
Decisions made automatically
Two money decisions happen on a timer, without a person deciding. Neither looks at who you are: they follow only dates and what you and the other person did in the app.
- Release. For shipped products and for hires, the payment is held until the buyer confirms they got what they paid for. If the buyer neither confirms nor reports a problem, the payment goes to the seller or creative 7 days after a product is marked shipped, or 7 days after a hire is marked delivered. We email the buyer 2 days before that happens. Reporting a problem stops the clock: nothing is released while a dispute is open.
- Refund at a dispute's deadline. If a dispute is still open 60 days after it was opened, the buyer is refunded in full, because the money is theirs until delivery is confirmed. We email both sides on day 55.
- The ID check for hirers. Stripe decides whether your ID is genuine (and, if you chose the selfie check, whether your selfie matches it). Until it passes you can't invite, hire or ask for a quote.
Ask a person. If any of these affects you, email info@landcode.studio. A person will look at it and answer within 5 working days. If a release or refund happened because of a mistake on our side, for example a problem you reported in time that was not recorded, we put it right: we refund the buyer or pay the seller ourselves. The full rules are in the Terms.
Who we share it with
Services that work for us. These companies process your data only on our instructions, to run Landcode, under a data processing agreement with us. Stripe is also responsible for its own records under financial law.
| Who | What | Where |
|---|---|---|
| Supabase (database, sign-in, file storage) | Everything in your account | UK (London) |
| Vercel (hosting, scheduled jobs) | Every request to the site, and server logs | UK (London); its global network and the company are US-based |
| Stripe (payments, payouts, ID checks) | Buyer email and delivery address, seller identity and bank details, ID document and selfie for checks | Ireland and US |
| Resend (sending email) | Your email address and the email's content | Ireland; the company is US-based |
Your account data is stored in the United Kingdom, which the EU recognises as protecting personal data to the same standard. Where these services handle data in the United States, it is protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
Other services you use through Landcode. These are not working for us: your browser connects to them directly, or you use your own account with them. Each is responsible for that data under its own privacy policy. Embedded players load only when you ask (see Cookies below).
| Who | What | Where |
|---|---|---|
| Your Google sign-in, if you choose it. YouTube, only when you load a video | US | |
| SoundCloud, Instagram (Meta) | Only when you choose to load an embedded track or post | EU and US |
| OpenStreetMap Nominatim | The place you type into a search box, sent by our server to find it. Not your IP address | UK |
| OpenFreeMap | Your IP address, to draw the map | EU |
We also share data when the law requires it, for example with the tax authorities.
Cookies and device storage
- What we use. One cookie keeps you signed in, and your browser stores a few small settings (such as finishing sign-up, and your choice about embedded media). These are needed for the service to work, so they don't need a consent banner. We use no advertising or tracking cookies.
- YouTube, SoundCloud and Instagram. Their players can set their own cookies, so they load only when you tap “Load”. “Always load” is remembered on that device, and you can turn it off in Settings → Privacy.
- Maps, flags and link previews load images from other servers, which see your IP address but set no cookies.
Your rights
- See and take your data. Settings → Privacy → Download my data gives you everything we hold about you as one file.
- Correct it. Edit your profile any time. Changing your email sends a confirmation link first.
- Delete it. Settings → Delete account deletes your account and data. We keep order records for 7 years because the law requires it, and the other person in a hire keeps their own record of it.
- Object or limit. Turn off reminder emails, hide your connection lists, leave the map, or keep your profile off the landing page, all in Settings. You can also object to any use based on legitimate interest by emailing us.
- Ask us. For anything else, email info@landcode.studio. We answer within 30 days.
- Complain. You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the authority where you live. In the UK, that is the Information Commissioner's Office.
Age
Landcode is for people aged 16 and over. If you think someone younger has an account, email info@landcode.studio and we will close it and delete its data.
Security
Passwords are stored only as hashes, connections are encrypted, database rules limit who can read and change each kind of data, and photos have their location data removed when you upload them. If a breach puts your data at risk, we will tell you and the authority as the law requires.
Changes
We will update this page when what we do with your data changes, and tell you in the app before an important change takes effect.
Draft: not yet legally reviewed.
Placeholder content for Privacy Policy · last updated draft (version 3 (draft)). This is a working draft written to describe how Landcode behaves today, not a final legal agreement.