Privacy Policy
Last updated: 18 June 2026
1. Who we are
Nearbit(“we”, “our”, “us”) is the data controller for personal data collected through this website (nearbit.nanocorp.app). We operate a personalised local activity recommendations service — events, art, sports, and walks — delivered as a weekly newsletter or on-demand.
If you have any questions about this policy or want to exercise your privacy rights, email us at: privacy@nearbit.app
Your use of Nearbit is also governed by our Terms of Service, including the terms that describe Nearbit as an advisory discovery service.
2. What data we collect and why
We only collect data that is necessary to run the service.
a) Sign-up data
| Data | Why we collect it | Lawful basis (GDPR Art. 6) |
|---|---|---|
| First name | To personalise recommendations and emails | 6(1)(b) — performance of a contract / steps prior to entering one |
| Email address | To send your weekly recommendations newsletter | 6(1)(b) — performance of a contract / steps prior to entering one |
| City | To find local events and activities near you | 6(1)(b) — performance of a contract / steps prior to entering one |
b) Analytics data (only with your consent)
If you accept analytics cookies, we collect anonymised usage data (page views, button clicks, session duration, and Core Web Vitals) via PostHog. This helps us improve the service. No analytics data is collected if you decline.
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Page views & clicks | Understand how visitors use the site | 6(1)(a) — consent |
| Browser / device type | Improve cross-device experience | 6(1)(a) — consent |
| Core Web Vitals | Monitor and improve site performance | 6(1)(a) — consent |
c) Payment data
If you purchase a Premium subscription, payment is processed directly by Stripe. We never see or store your full card number. Stripe shares only confirmation of the transaction with us.
d) Technical / server logs
Our hosting provider (Vercel) may log IP addresses and request metadata for security and performance purposes. We do not access or process these logs ourselves.
3. Cookies
We use two categories of cookies:
- Essential cookies — necessary for the site to function (e.g. storing your cookie preference). No personal data is tracked. These are set without consent.
- Analytics cookies— set by PostHog only if you click “Accept all” in the cookie banner. You can change your preference at any time by clearing your browser storage or contacting us.
We do not use advertising, tracking, or profiling cookies.
4. How long we keep your data
| Data | Retention period | Reason |
|---|---|---|
| Sign-up data (name, email, city) | 3 years from sign-up, or until you ask us to delete it | Necessary to run your subscription; we delete inactive accounts on a rolling basis |
| Analytics data | Up to 12 months, then anonymised or deleted by PostHog | Sufficient for trend analysis; PostHog's data retention policy applies |
| Stripe transaction records | 7 years | UK/EU legal requirement for financial records |
| Vercel server logs | Up to 30 days | Set by Vercel's infrastructure; we do not control this |
5. Who we share your data with
We do notsell your personal data. We share it only with the following service providers (“processors”) who act on our instructions:
| Processor | Purpose | Where they process data |
|---|---|---|
| PostHog | Site analytics (only with your consent) | EU / US (PostHog Cloud) |
| Stripe | Payment processing | US (covered by Standard Contractual Clauses) |
| Vercel | Website hosting and infrastructure | US (covered by Standard Contractual Clauses) |
| Neon | Database hosting (stores sign-up data) | US (covered by Standard Contractual Clauses) |
Where processors are based outside the UK or EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or equivalent) as required by UK GDPR and EU GDPR Chapter V.
6. Your rights
If you are in the EU, UK, or California, you have specific rights over your personal data. Here is how to exercise each one:
EU and UK rights (GDPR / UK GDPR)
| Right | What it means | How to use it |
|---|---|---|
| Access | Get a copy of the personal data we hold about you | Email privacy@nearbit.app with subject "Data Access Request" |
| Rectification | Ask us to correct inaccurate or incomplete data | Email privacy@nearbit.app |
| Erasure ("right to be forgotten") | Ask us to delete your data | Email privacy@nearbit.app with subject "Deletion Request" |
| Portability | Receive your data in a machine-readable format (e.g. CSV or JSON) | Email privacy@nearbit.app with subject "Data Portability Request" |
| Restriction | Ask us to stop processing your data while a dispute is resolved | Email privacy@nearbit.app |
| Objection | Object to processing based on legitimate interests | Email privacy@nearbit.app with subject "Objection to Processing" |
| Withdraw consent | Withdraw analytics consent at any time | Clear your browser's local storage, or email us |
We will respond to all requests within 30 days. If your request is complex, we may extend this by a further two months and will let you know.
You also have the right to lodge a complaint with a supervisory authority:
- UK: Information Commissioner's Office (ICO) — ico.org.uk · 0303 123 1113
- EU: Your national Data Protection Authority. A list is available at edpb.europa.eu
California rights (CCPA / CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Know / Access: Request the categories and specific pieces of personal information we have collected about you.
- Delete: Request deletion of your personal information.
- Correct: Request correction of inaccurate personal information.
- Opt out of sale / sharing: We do not sell or share personal information for cross-context behavioural advertising.
- Non-discrimination: We will not discriminate against you for exercising any CCPA right.
To submit a CCPA request, email privacy@nearbit.app with “California Privacy Request” in the subject line.
7. Security
We use industry-standard security practices including encrypted connections (HTTPS), access controls, and trusted cloud infrastructure. No system is completely secure, so we cannot guarantee absolute security, but we take reasonable technical and organisational measures to protect your data.
8. Children
Our service is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe we have inadvertently done so, please contact us and we will delete it promptly.
9. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page. If you are a subscriber, we may also notify you by email.
10. Contact us
For any privacy-related questions or to exercise your rights:
NearbitData Controller
Email: privacy@nearbit.app
We aim to respond within 5 business days and will always meet the 30-day statutory deadline.