Privacy Policy

massagehub.uk ("the Site") is operated by Hubline Digital Media Ltd, a company registered in England and Wales under company number 17418738, registered office 128 City Road, London EC1V 2NX, United Kingdom ("MassageHub", "we", "us", "our"). We are the data controller for the personal data described in this policy, which means we decide how and why it is processed. We are subject to the supervision of the Information Commissioner's Office (ICO). Privacy questions and requests: hello@massagehub.uk (please put "Privacy" in the subject line).

This policy applies to everyone who uses the Site: • Visitors and clients — people who browse listings, reveal a phone number, use the contact form or leave a review. • Advertisers (providers) — people and businesses who create an account and publish a massage listing. • Anyone whose personal data appears in a listing published by an advertiser (see section 12). It also explains what happens to data we make public on your behalf. Please read it together with our Terms and Conditions (massagehub.uk/terms).

Account data (advertisers and registered users): email address, password (stored only as a salted hash — never in plain text), account role, sign-in method (email or Google), and the dates of registration and last activity. Listing data (advertisers): the information you enter for your public profile — display name or pseudonym, age, category, city and postcode (and the approximate coordinates we derive from it), phone and WhatsApp numbers, description, services, prices, availability, nationality, photos and, for studios, the business name. This data is published on the Site and, through it, becomes visible to search engines and other services (section 12). Phone numbers are not shown in the page source; they are revealed on request and the reveal is logged (see "Usage data"). Verification photo (optional, advertisers): if you apply for the Verified badge you upload a selfie holding a handwritten note. It is stored in a private, access-controlled store, is viewed only by our moderators through a short-lived link, and is never displayed on the Site. It is a photograph, not a biometric template — we do not run automated facial recognition on it. See massagehub.uk/verification. Reviews (clients): the star rating, review text, the name you choose to display and the date. Signed-in reviewers are linked to their account; anonymous reviews are not. Contact-form and email data: your name, email address and the content of your message. Payment data (advertisers): the plan or boost purchased, amount, currency, date, payment status and a reference from the payment provider. Card numbers and bank details are entered on the payment provider's own pages and are never received or stored by us. Usage and technical data: IP address, browser and device information, the pages you request and the time of the request. In particular we log the IP address and user agent when a phone number is revealed (fraud prevention and abuse detection), when a link is shared, and when requests are rate-limited. Error reports may include the URL, browser details and a truncated stack trace. Moderation and activity records: moderation decisions and reasons, status changes to listings, verification outcomes, reports made about content, and administrative notes. We do not knowingly collect personal data from anyone under 18 (section 13).

Under the UK GDPR we must have a lawful basis for each use of personal data. We use: To provide the Site and your account — creating and securing your account, publishing and managing your listing, displaying reviews, processing payments, sending service emails (confirmation, approval, rejection, pause, password reset, billing). Lawful basis: performance of a contract (Article 6(1)(b)); for visitors without an account, our legitimate interest in operating the Site (Article 6(1)(f)). To moderate content and keep the Site safe and lawful — reviewing listings before and after publication, verifying photos, investigating reports, preventing fraud, spam, scraping and abuse, enforcing our Terms, and blocking or rate-limiting misuse. Lawful bases: our legitimate interests in running a safe, lawful and trustworthy service and protecting users (Article 6(1)(f)); compliance with legal obligations, including under the Online Safety Act 2023 (Article 6(1)(c)). To respond to you — answering enquiries, complaints, rights requests and appeals. Lawful bases: legitimate interests; legal obligation. To measure and improve the Site — aggregate, privacy-preserving analytics (page views, performance metrics, error monitoring) without advertising cookies or cross-site tracking. Lawful basis: legitimate interests. To publish live statistics — counts and price ranges shown on city and service pages are calculated from active listings in aggregate and do not identify any individual. To comply with the law — keeping accounting records, responding to lawful requests from authorities, and establishing, exercising or defending legal claims. Lawful bases: legal obligation; legitimate interests. To send marketing — only with your consent, which you may withdraw at any time using the link in the email or by contacting us. Lawful basis: consent (Article 6(1)(a)). Where we rely on legitimate interests we have balanced them against your rights and interests; you may object at any time (section 9).

Some listings describe adult-oriented massage styles. Information about the services an advertiser chooses to offer is entered and published by the advertiser as part of their trade and is not, in our assessment, information about the advertiser's sex life or sexual orientation. To the extent any part of a listing could be regarded as special category data, we process it because the advertiser has manifestly made it public on their own listing (Article 9(2)(e) UK GDPR). We do not request or process health data, biometric data, or data about criminal convictions. Please do not include such information in your listing, reviews or messages.

We do not sell personal data and we do not share it with advertisers or data brokers. We share data only as follows: Service providers (processors) acting on our instructions under data-processing agreements: • Supabase Inc. — database, authentication and file storage (data hosted in the EU, Ireland region), including the private verification-photo store. • Vercel Inc. — web hosting and content delivery, cookieless web analytics and performance monitoring. • Resend Inc. — transactional and account emails. • Functional Software, Inc. (Sentry) — error monitoring; reports may include IP address and browser details. • Upstash, Inc. — rate limiting of requests (IP-based counters, short retention). • Cloudflare, Inc. (Turnstile) — bot protection on forms. • Payment providers named at checkout — to take payment for Paid Services; they act as independent controllers for card data under their own privacy notices. The public: everything in a published listing, and every published review, is public. Search engines, AI assistants and other third parties may index, cache and display it (section 12). Authorities: we may disclose data to the police, regulators (including Ofcom and the ICO), courts or other authorities where the law requires it or where we reasonably consider disclosure necessary to prevent or investigate unlawful activity or to protect any person. Professional advisers and successors: our lawyers, accountants and insurers where necessary, and a purchaser or successor if the business or the Site is sold or reorganised, under the same protections.

Our primary data store is in the European Economic Area (Ireland), which the UK recognises as providing adequate protection. Some of our service providers (including Vercel, Resend, Sentry, Upstash and Cloudflare) are based in the United States or may process data outside the UK. Where personal data is transferred outside the UK we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or on the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with appropriate technical and organisational safeguards. You may request a copy of the relevant safeguards by contacting us.

We keep personal data only as long as we need it for the purposes above: • Account and listing data: for as long as your account is active. Paused listings remain published (with contact details hidden) until you reactivate or delete them. • Deleted accounts and listings: public profile data is removed at deletion. Verification photos are deleted when the request is withdrawn or on request. A minimal record that the listing existed (slug and deletion date, no personal data) is kept so the former URL can return a "no longer listed" page. • Moderation records, status-change logs and reports: up to 12 months after the account is closed, for safety, dispute and legal-compliance purposes. • Phone-reveal and abuse logs (IP address, user agent): IP addresses are anonymised after 90 days; aggregate counts are kept indefinitely. • Payment and billing records: 6 years after the end of the financial year in which the transaction took place, as required by UK tax and company law. • Contact-form messages and correspondence: up to 24 months after the matter is closed. • Error and performance logs: 90 days. • Backups: encrypted backups are kept for a limited period and overwritten on a rolling basis; data deleted from the live system is not restored from backups except to recover from a system failure. We may keep data for longer where necessary to comply with a legal obligation, resolve disputes or establish, exercise or defend legal claims.

Under the UK GDPR you have the right to: • Access — obtain a copy of the personal data we hold about you and information about how we use it. • Rectification — have inaccurate or incomplete data corrected (you can edit most listing data yourself in your dashboard). • Erasure — have your data deleted where there is no longer a lawful reason for us to keep it (see section 8 for what we must retain). • Restriction — ask us to limit processing in certain circumstances. • Portability — receive the data you provided to us in a structured, machine-readable format. • Object — to processing based on legitimate interests, and at any time to direct marketing. • Withdraw consent — where processing is based on consent, without affecting processing already carried out. To exercise any right, email hello@massagehub.uk from the address registered to your account (or otherwise identify that address). We may ask for information to confirm your identity before acting. We respond within one month; in complex cases we may extend this by up to two further months and will tell you if so. Exercising your rights is free unless a request is manifestly unfounded or excessive. If you are unhappy with how we handle your data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

We keep cookies to a minimum and do not use advertising or cross-site tracking cookies. Strictly necessary: authentication cookies (prefixed "sb-") that keep you signed in and protect your session; a security token used by Cloudflare Turnstile to distinguish people from bots on forms. These are essential to the Site and do not require consent under the Privacy and Electronic Communications Regulations 2003 (PECR). Performance and error monitoring: Vercel Analytics and Speed Insights measure page views and loading performance without cookies or persistent identifiers; Sentry error monitoring may store a short-lived session identifier to group errors. Local storage: your browser may store non-identifying preferences (for example a dismissed notice). You can block or delete cookies in your browser settings; blocking the strictly necessary cookies will prevent you from signing in.

We protect personal data with technical and organisational measures appropriate to the risk, including: encryption in transit (HTTPS/TLS) and at rest; row-level security so that users can access only their own records; column-level restrictions that keep phone numbers out of public database reads; private storage for verification photos with time-limited access links; salted password hashing; least-privilege access for staff; rate limiting and bot protection; and monitoring of errors and anomalies. No system is completely secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms we will notify the ICO within 72 hours and, where the risk is high, notify you directly without undue delay. If you discover a vulnerability, please report it responsibly to hello@massagehub.uk or see massagehub.uk/.well-known/security.txt.

A listing is a public advertisement. When you publish one you make its content — including your photos, working name, area and prices — available to anyone on the internet. Search engines, social networks, AI assistants and other services may crawl, index, cache, summarise and display that content, and we submit new and changed public pages to search engines to keep their copies current. We cannot control or delete copies held by third parties; when a listing is removed we take it off the Site, notify search engines that the page has changed, and the former URL returns a page stating that the listing is no longer available. Only publish information you are comfortable making public. In particular, use a working name if you prefer, do not include your home address (a postcode area is enough for the map), and never include another person's photograph or contact details without their explicit consent. If your personal data appears in a listing that you did not publish or consent to, contact hello@massagehub.uk and we will investigate and remove it.

The Site is strictly for adults aged 18 and over. We do not knowingly collect personal data from, or publish listings depicting, anyone under 18. If you believe that a child's data has been submitted to us, or that any listing involves a person under 18, contact hello@massagehub.uk immediately: we treat such reports as an emergency, remove the content and report to the relevant authorities where appropriate.

We do not make decisions about you based solely on automated processing that would produce legal or similarly significant effects. Moderation, verification and appeals are decided by people. Automated systems are used only for rate limiting, bot detection and blocking obviously abusive traffic.

We may update this policy from time to time. Material changes will be signposted on the Site or emailed to registered users before they take effect. The version number and the date of the last update are shown at the top of this page.

Hubline Digital Media Ltd (data controller) Company number 17418738, registered in England and Wales Registered office: 128 City Road, London EC1V 2NX, United Kingdom Email: hello@massagehub.uk — subject line "Privacy" Web: massagehub.uk/contacts