Privacy Notice

Who we are

Belayat is a service of Twakka Ltd, registered in England and Wales (company number 14001176), 167–169 Great Portland Street, Fifth Floor, London W1W 5PF. We decide how and why your personal data is used, so we are its "controller" under UK data protection law.

For anything about your data, including using your rights, email support@belayat.uk. We do not have a separate data protection officer. The same team reads every message.

The short version

• You can browse without an account. We do not track you across other apps or websites, and we do not sell your data.
• We never store your exact location. We use a postcode, show only an approximate area, and show distance as a rough band such as "about 1 mile".
• Your mobile number is stored only as a scrambled code and a locked copy. Nobody sees it unless you choose to show it.
• Messages are not end-to-end encrypted. Automatic checks look for scams, and moderators can read a conversation when it is reported or flagged.
• Automatic tools, including an AI tool, help us spot risk. A person decides what happens to any account.
• You can delete your account in the app or on the web, and it is really deleted.
• If your business is in our directory, you can claim it, correct it or have it removed.

What we collect

Your location

• We never store the exact position of your device. If you tap "Use my location", your device sends its position once, our server turns it into the nearest postcode, and the position is thrown away.
• For a post, we look up the centre of its postcode area. In search results and on maps of many posts, everyone sees a point moved a fixed distance away from that centre (about a third to two thirds of a mile for rooms, about a fifth to half a mile for everything else), shown as a circle at least a mile wide, never a pin.
• A room’s own page shows the same moved circle, so its real postcode centre stays private. A job advert or an event happens at a workplace or venue, so its own page shows the centre of the postcode the poster gave on a map. We never show a street address for a job.
• Distances are shown only in bands: under 1 mile, about 1 mile, about 3 miles, about 6 miles, about 15 miles, or 30 miles or more. For rooms, distances to stations are measured from the moved point, not the real one.
• To stop anyone using many searches to pinpoint a post, we limit how many places one account can search from in an hour. For this we keep a scrambled code of a rounded search area for one hour, then delete it.
• If you search without signing in, the same limit applies to your internet connection. We keep a keyed hash (an HMAC) of your IP address, a scrambled code made with a secret key, next to the scrambled code of each rounded search area. We delete them about an hour after your last search. We never keep the IP address itself.
• The area you choose to browse from is kept on your device, not on your account. We receive it only as the place to search from.
• Maps are drawn from our own server, so no map company sees which areas you look at.

Automatic checks and AI

We use automatic tools to keep Belayat safe and lawful:

• Posting rules check every post before it appears, for example for rent ranges, discriminatory wording, fees charged to job seekers and pay below the minimum wage. A post that breaks a rule cannot be published until you change it, and we tell you why.
• Automatic checks may hold a post for a person to check first, such as the first room an account offers, jobs that mention visa sponsorship, rents far below the local average, and photos that match another post. A held post appears only once a person has checked it.
• A risk score is worked out from signals such as how new the account is, the type of phone number, and whether photos have been used before.
• An AI tool reads new posts and reported content and gives our moderators a risk rating and the reasons for it. The AI model is made by Anthropic, and we reach it through OpenRouter. Neither may use our data to train AI models, and neither keeps it once the answer is given (zero data retention). Both are US companies, so this is a transfer outside the UK, made with the safeguards UK data protection law requires. See Data sent outside the UK.
• When the AI tool rates a post as risky, it puts the post in front of a moderator. It does not hide or remove the post itself. A person looks at it and makes the final decision.

A person decides what happens to your account. Automatic tools only advise. They do not warn, suspend or ban anyone. The one decision taken automatically is removing obvious spam from a brand-new account. If that happens to you, you can appeal and a person will look at it. You can also ask us to explain any decision, and to have a person review it.

If your business is in our directory

Belayat has a directory of businesses and community organisations. Most listings were copied from the old belayat.uk directory, which built them from details that were already public, such as listings a business had published online. We did not get these details from you. If you run a listed business, especially on your own, some of them may be personal data about you.

For each listing we may hold:

• the business name and a description
• its address and where it is on a map
• its phone number, which may be a mobile
• its website and email address
• its logo or a photo

Anyone can see a listing, in the app and on belayat.uk, and search engines can show it, so people can find and contact the business. We show the phone number the listing gives, because it is the business’s published contact number. This is different from the mobile number a Belayat user verifies, which we never show unless they choose to. The service providers in Who we share it with store and serve listings for us. We do not sell them.

Our lawful basis is our legitimate interest, and the community’s, in a directory that helps people find local Nepali businesses and organisations. We use the details to show the listing, to let its owner claim it, and to deal with reports about it.

Every listing from the old directory says so, with a link to claim it. If it is your business, you can:

• claim it in the Belayat app. See If you claim a business.
• ask us to correct it: email support@belayat.uk with the listing’s name and what is wrong
• ask us to remove it: email support@belayat.uk. It stops showing as soon as we remove it, and if you ask, we delete its details too
• report it in the app if it is wrong, fake or not yours

You have the right to object to us showing your details. If you object, we remove the listing. You also have the other rights in Your rights, and you can complain to the Information Commissioner’s Office. See Questions and complaints.

Why we use your data, and our legal reasons

Data protection law says we must have a legal reason, called a "lawful basis", for each use.

• To provide Belayat: your account, posts, messages, saves, alerts and notifications. Lawful basis: our contract with you (the Terms of Use).
• To verify your mobile and stop fake and banned accounts: Lawful basis: our legitimate interest in keeping scammers off Belayat, and our contract with you.
• To check content, handle reports and moderate: including the automatic checks and the AI tool. Lawful basis: our legal duties under the Online Safety Act 2023 to deal with illegal content, and our legitimate interest in protecting people from scams and abuse. Where this involves sensitive information or information about crimes, we rely on the conditions in the Data Protection Act 2018 for preventing and detecting unlawful acts, and for preventing fraud.
• To keep records after a decision or a deletion: Lawful basis: our legal duties, and our legitimate interest in stopping banned people coming back and in dealing with legal claims.
• To share information with the police or other authorities: Lawful basis: legal duty, or our legitimate interest in preventing crime and protecting people.
• To fix errors and keep Belayat secure: Lawful basis: our legitimate interest in running a working, secure service.
• To understand how Belayat is used and improve it: using counts of what people do, never your messages, full postcode or phone number. Lawful basis: our legitimate interest in improving Belayat. See Cookies and storage for when we ask first.
• To run the business directory: showing businesses’ published contact details, including those copied from the old belayat.uk directory. Lawful basis: our legitimate interest in a useful local directory. See If your business is in our directory.
• To sell advertising and keep accounts: Lawful basis: our contract with the advertiser, and our legal duty to keep tax records.
• To send marketing email to advertisers: only with consent, or to existing customers where the law allows, with an unsubscribe link in every email. We never send marketing texts.

Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details, and you can object. See Your rights.

Who we share it with

Other people on Belayat see your public profile and your posts, and the people you message see your messages. Your mobile number is shown only if you choose.

Service providers (our "processors") who work for us under contract, and may use your data only to provide their service to us:

• Supabase: our database, file storage, sign-in and server functions.
• Hetzner: the servers that run the belayat.uk website, our maps, the service that turns a location into a postcode, and the backup copies of our database.
• Cloudflare: passes visits to belayat.uk on to our server and protects it from attacks. It sees your IP address and the pages you ask for.
• The SMS Works: sends and checks the text message code (UK).
• OpenRouter: passes posts and reported content to the AI model that gives risk ratings, with no training on and no keeping of our data (zero data retention). A US company.
• Anthropic: makes and runs that AI model, with no training on and no keeping of our data (zero data retention). A US company.
• ZeptoMail (Zoho): sends our emails, such as sign-in codes, deletion confirmations and moderation notices. Hosted in the EU.
• Google Firebase Cloud Messaging and Apple Push Notification service: deliver notifications to your phone.
• Sentry: error reports from the app, belayat.uk and our servers, so we can fix crashes. Phone numbers, email addresses, postcodes and message text are removed before a report is sent. Hosted in the EU, in Germany.
• PostHog: counts of how Belayat is used, only if you allow them. Hosted in the EU.
• Stripe: payments from advertisers. Stripe also uses payment data to prevent fraud, as its own controller.

Apple and Google receive the fact that you signed in to Belayat with them. How they use that is covered by their own privacy policies.

The police, regulators and other authorities, such as Action Fraud, the National Crime Agency, Ofcom, the Home Office or HMRC, when the law requires it or when we believe it is needed to prevent crime or protect someone from serious harm.

A new owner, if Belayat or our company is sold or merged. They would have to protect your data as this notice says.

We do not sell your personal data, and we do not share it with advertisers. Sponsored content is chosen by the area and category you are looking at, not by a profile of you.

Data sent outside the UK

Our main database is stored in the UK or the European Economic Area. The SMS Works is a UK company. Hetzner is a German company that hosts our own servers. ZeptoMail processes our data in the EU. Sentry and PostHog also store their data in the EU. The UK recognises the EU as giving adequate protection.

Some providers are in the USA, or may reach data from there, for example Supabase for support, Cloudflare, Google and Apple for notifications and sign-in, Stripe, and OpenRouter and Anthropic for the AI risk ratings. When data goes to the USA, it is protected by the UK Extension to the EU-US Data Privacy Framework, where the company has signed up to it, or by the UK’s International Data Transfer Agreement or Addendum, which are contracts approved under UK law. For OpenRouter and Anthropic, the safeguard is: [TRANSFER MECHANISM — solicitor to confirm]. You can ask us for a copy of the safeguards.

How long we keep it

• Your account and profile: until you delete your account. If you do not use your account for 3 years, we delete it. We email you a warning at least 30 days before, and using your account again stops it. If we have no working email address for you, we cannot warn you, and the account is deleted without a warning.
• Live posts: until they end, are closed or you delete them. Posts that have ended stay in My posts for 12 months, so you can post them again, then we delete them. A deleted post disappears at once and its photos are erased within 30 days.
• Messages: 12 months after the last message in the conversation. If a conversation was reported, until 6 months after the case is closed, if that is later.
• Your mobile number (hash and encrypted copy): until you delete your account.
• Your date of birth: until you delete your account.
• Reports, moderation decisions and appeals, including frozen copies of reported content: 3 years after the case is closed, or longer if a legal claim or a police investigation needs them.
• A banned mobile number, as a hash only: for as long as the ban lasts.
• Scrambled records of requests for a text message code: 24 hours.
• Scrambled search areas: 1 hour.
• Scrambled IP addresses from searches made without signing in: about 1 hour after the last search.
• Records of notifications sent: 90 days.
• Push tokens and device records: until you sign out, delete your account, or the token stops working.
• Error reports (Sentry): 90 days.
• Usage counts (PostHog): 12 months.
• Directory listings: while they are live. A removed listing stops showing at once, and if you ask, we delete its details too.
• Advertiser orders, payments and invoices: 6 years after the end of the financial year, as tax law requires.
• Emails with us: 2 years after the matter is closed.
• Website server logs: 30 days.
• The record that an account was deleted, with no name, email or number in it: 6 years.

Deleting your account

You can delete your account in the app, in Me, then Delete my account, or on the web at belayat.uk/delete-account. It is real deletion, not a pause, and it happens straight away. We delete:

• your profile, settings, saves, alerts, follows and devices
• your sign-in connections. If you used Sign in with Apple, we also revoke our Apple token, which disconnects Belayat from your Apple ID
• your mobile number, both the hash and the encrypted copy
• your posts: they disappear at once, their words and exact postcode are wiped, and their photos are erased within 30 days
• the words and photos of your messages. The people you talked to keep their own messages, and see yours as deleted, from "Deleted user"

We keep only what we need for safety and the law, with no name, email or number attached:

• an empty row for each deleted post, with no text, photos or postcode, so other people’s conversations still make sense
• what you wrote in reports and appeals, without your name
• frozen copies of reported content, and the record of moderation decisions
• a note that the account was deleted, and when

Two cases where we keep the hash of your mobile number. The hash is a scrambled code, never the number itself.

• If your account was banned, we keep the hash for as long as the ban lasts, so the number cannot be used for a new account.
• If a moderation case about your account is still open when you delete it, we keep the hash, linked to that case, for up to 90 days. If the case ends in a ban, it moves to the banned list. If not, or after 90 days, it is deleted. This stops people deleting an account to escape a decision.

Copies in our backups are deleted within a month. We do not restore deleted data from them except to recover from a fault.

Cookies and storage on your device

Belayat stores a few things on your device that it needs to work. The law allows these without asking, because you cannot use Belayat without them:

• your sign-in, so you stay signed in
• a post you have started, so you do not lose it
• small settings, such as your area

We do not use advertising cookies, and we do not use cookies or device identifiers to track you across other apps or websites.

Error reports (Sentry) help us find and fix faults. When something goes wrong in the app, on belayat.uk or on our servers, a report of the error is sent with technical details such as the device, browser and app version. Before it is sent, we remove phone numbers, email addresses, postcodes and message text. We do not record your screen. Error reports are not usage counts, so they are sent whatever you choose below.

Usage counts (PostHog) help us understand which parts of Belayat work, and how fast pages load. We count only a fixed list of actions, such as "a search was made" or "a post was published". Usage counts never include your messages, your full postcode, your phone number or your exact location, and we do not keep your IP address with them. They may include the postcode district you browse from (such as RG6) and, when a search finds nothing, the words you searched for, with any postcode, phone number or email address removed. We do not record your screen or every tap.

On belayat.uk, we ask first: usage counts do not start until you press Accept, Reject is exactly as easy as Accept, and you can change your mind at any time from the link in the footer.

In the app, the law lets us count usage to improve Belayat as long as we tell you and you can easily switch it off. We show you a one-time notice with an immediate "Turn off" choice, right there, before usage counts start. After that notice, usage counts are on unless you turn them off, and you can switch them off at any time, free, in Me, under Legal & data. Turning them off stops them straight away.

Your rights

You have the right to:

• get a copy of your personal data
• have wrong data corrected
• have your data deleted. You can do most of this yourself by deleting your account
• limit how we use your data while a question about it is sorted out
• object to us using your data on the basis of legitimate interests
• get the data you gave us in a format you can move to another service
• withdraw consent at any time, where we asked for it
• ask for a person to review a decision made automatically, and to explain it

To use any of these, email support@belayat.uk from the email address on your account, or tell us which account is yours. We may need to check it is you. We answer within one month. If a request is complicated, we may take up to two more months, and we will tell you why. It is free.

Children

Belayat is for adults. You must be 18 or over to have an account. We ask for your date of birth when you first sign in and we do not let anyone who says they are under 18 use an account. If we learn that an account belongs to someone under 18 anyway, we close it. If you think a child is using Belayat, please tell us at support@belayat.uk.

Keeping your data safe

We use encryption in transit, strict access rules on every database table, separate secret keys for phone numbers, and a record of every moderation action. Only a small number of people can see personal data, and only to do their job. If a breach puts you at risk, we will tell you and the Information Commissioner’s Office as the law requires.

Questions and complaints

If you are unhappy with how we use your data, please tell us first at support@belayat.uk. We will acknowledge your complaint within 30 days and tell you what we are doing about it.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection: ico.org.uk/make-a-complaint, or phone 0303 123 1113.

Changes to this notice

We will update this notice when what we do changes. The date and version at the top show which version you are reading. If a change matters to you, we will tell you in the app before it takes effect.