The short version
- No ads, no analytics, no tracking cookies.
- You can use the map without an account, and when you do we don't know who you are.
- If you create an account, we hold your email address, how you sign in, and whether you subscribe. That is the whole account.
- Your card details go to Stripe, never to us.
- We never sell data, to anyone.
1. Who we are
My Area Score (myareascore.co.uk) is operated by Sentium Ltd, a company registered in England and Wales (company number 16512683), with its registered office at Suite Ra01, 195–197 Wood Street, London E17 3NU, United Kingdom. Sentium Ltd is the data controller for the personal data described here.
For any data protection question, write to support@sentium.app.
2. The map is about places, not people
My Area Score compares neighbourhoods in London and the surrounding commuter belt. Its figures come from published sources — the ONS census, HM Land Registry, police.uk, the Department for Education, Ofsted and TfL — and are shown only as totals, percentages and medians for whole areas. Nothing on the map identifies an individual.
3. Using the map without an account
- Your browser downloads the map and its figures from our servers. We don't record which areas you look at or which filters you choose; that stays in your browser.
- Postcode and place search is sent from your browser directly to postcodes.io, a free lookup service run by Ideal Postcodes Ltd, to find where it is on the map. They receive what you typed and your IP address, and nothing that tells them who you are.
4. What we hold if you create an account
- Your email address — it identifies the account, and we use it to send sign-in links, address confirmations and password resets.
- How you sign in — which of a password, an emailed link, Google or Facebook you have used.
- Your password, as a hash only. We store a salted scrypt hash, never the password itself. A new password is held unused until you confirm your email address.
- Account housekeeping — whether your email address is confirmed, when the account was created, and a timestamp that signs out every device after a password reset.
- Your subscription — whether you subscribe, the customer and subscription references Stripe gives us, and when the current period ends.
We do not store your name, photo, postal address, phone number or payment card, and we keep no history of what you do on the map.
5. Signing in with Google or Facebook
If you choose to, Google or Meta tells us your email address and confirms it is verified. Google also sends your basic profile, which we discard. We never post on your behalf, and we don't see your contacts, friends or anything else in those accounts. How Google and Meta handle your data is set out in their own privacy policies.
6. Payments
Subscriptions are processed by Stripe. You enter your card details on Stripe's own checkout page; they never reach us. Stripe tells us whether a subscription is active, and keeps its own records of payments to meet its legal and anti-fraud obligations, as described in Stripe's privacy policy.
7. Security records
- Attempt counts. To stop password guessing and email abuse, we count sign-in and email requests per IP address and per email address over 15-minute or one-hour windows. These counts are deleted automatically once their window has closed, normally within a day.
- Emailed links. Each sign-in, confirmation or reset link is a random, single-use code stored with the email address it was sent to. Links expire within 24 hours and the record is deleted automatically within two days.
8. Cookies
We use only the cookies needed to sign you in:
- A sign-in cookie, lasting up to 30 days, set only once you sign in.
- A short-lived cookie, lasting 10 minutes, while you sign in with Google or Facebook.
There are no analytics, advertising or third-party tracking cookies, which is why the site doesn't ask you to accept any.
9. Who processes data for us
- Microsoft Azure — hosts the website and sign-in service (West Europe region, the Netherlands), stores accounts and map data (UK South region, London), and sends our emails (Azure Communication Services, data held in the UK).
- Stripe — payments and subscriptions.
- Google and Meta — only if you choose to sign in with them.
- postcodes.io — postcode and place search, as described above.
We never sell data and we never share it with advertisers.
10. Why we are allowed to process it
- Contract — running your account and subscription, and sending the emails that make sign-in work.
- Legitimate interests — the security records in section 7, which protect your account and the service.
- Legal obligation — keeping payment records for tax purposes.
11. How long we keep things
- Your account: for as long as it exists. When you ask us to delete it, we do so within 30 days.
- Attempt counts: normally deleted within a day.
- Emailed-link records: deleted within two days.
- Payment records: kept by Stripe and by us for as long as UK tax law requires, normally six years, even after an account is deleted.
12. International transfers
The website and sign-in service run in the Netherlands, which the UK recognises as providing adequate protection. Stripe, Google and Meta may process data in the United States; where they do, the transfer is covered by the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum.
13. Your rights
Under the UK GDPR you have the right to access, correct, erase, restrict and port your personal data, and to object to its processing. To exercise any of them, email support@sentium.app from the address on your account. We respond within 30 days.
To delete your account, follow Deleting your data.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.
14. Children
My Area Score is for adults. Accounts are not intended for anyone under 18, and we do not knowingly hold personal data about children. Figures about schools describe schools, never individual pupils.
15. Changes to this policy
We will update this page when anything changes, and email account holders at least 30 days before any material change takes effect.