Privacy Policy

Account details (name, email, optional phone); profile details you choose to add; content you post (listings, events, stories, reviews, photos, voice recordings, applications); transaction records including wallet top-ups, payments, loyalty stamps, points and reward redemptions; approximate location when you use location features (e.g. NFC stamps, nearby drivers); device tokens for push notifications if you enable them; and — only if you consent — anonymised usage analytics (see below). Card and bank details are handled by Stripe — we never see or store full card numbers.

To run your account and provide the features you use; to process payments, wallet transactions and payouts; to operate loyalty stamps, points and rewards with participating businesses; to match deliveries, jobs and shifts; to send service messages; and — only if you opt in — occasional news and offers. We keep a record of the terms/privacy version you accepted, as part of our compliance commitments.

We run our own privacy-respecting analytics — there are no third-party advertising trackers on OneShetland, and nothing here is used to build an advertising profile of you.

Our analytics is opt-in. On the website it only runs if you accept it in the consent banner. Until you accept, no analytics identifier is created at all — nothing is stored in your browser and nothing is sent. If you decline, it stays off. When you do accept, it records product events (like “viewed an event”) against a random identifier, not your name. We also count clicks on our social-media short links (oneshetland.com/go/…) anonymously — no cookie is set and no profile is built.

Storage we need to run the site. Separately from analytics, your browser stores a few things so OneShetland works: your sign-in session; your answer to the analytics banner (so we stop asking); and things you set up yourself, such as a shopping basket or a saved preference. None of this is used for advertising profiling.

Payments (Stripe). Card payments are handled by Stripe. Stripe’s payment scripts load only on pages where you are actually paying or managing a saved card — not on ordinary content pages like the homepage, Directory or What’s On. On those payment pages, Stripe may collect transactional information and device-identifying information using cookies and similar technologies. Stripe uses this to process the payment, to authenticate you, for fraud and loss prevention, and to analyse the performance of its own services.

The Stripe cookies we currently see in our integration are:

• __stripe_mid — set by Stripe, for fraud prevention. Lasts approximately one year.
• __stripe_sid — set by Stripe, for fraud prevention. Lasts approximately 30 minutes.

Those are the ones we observe today; Stripe may use others as its own services change, and Stripe describes its own use in full at the links below. These are payment-security cookies, not advertising cookies, and they are separate from your analytics choice — the analytics banner controls our optional analytics, and does not switch off the storage needed to sign you in or to take a payment securely.

For Stripe’s own explanation, see the Stripe Privacy Centre and Stripe’s cookie information. OneShetland never receives or stores your full card details.

Some features are assisted by AI — for example Peerie Bot turning a plain-English description into an event listing, drafting content, or transcribing a voice recording you upload to Aald Memories. To provide these, the text or audio you submit is processed by our AI providers (Anthropic for text, OpenAI for audio transcription) on our instructions. We don’t permit these providers to use your content to train their models. AI features only process what you choose to give them.

The Directory includes listings for Shetland businesses compiled from publicly available sources (such as OpenStreetMap and businesses’ own public listings), so the Directory is useful to the community from day one. Where a listing relates to a sole trader, that information can be personal data — we publish it on the basis of legitimate interests. If a listing is about your business you can claim it for free and correct it, or ask us to amend or remove it at hello@oneshetland.com.

We rely on: performance of a contract (running your account and transactions); legitimate interests (keeping the platform safe and improving it, and publishing business directory information); consent (marketing, push notifications and website analytics, each of which you can withdraw anytime); and legal obligation (tax, fraud prevention, Gift Aid records).

Service providers who help us run OneShetland: Supabase (database & hosting), Netlify (website hosting), Stripe (payments & payouts), Postmark (email delivery), Expo (push notifications), Google Maps (maps & place search), Anthropic and OpenAI (AI features, as described above). When you transact with a business, hub or driver, the necessary details are shared with them to fulfil it. Content you choose to publish publicly (for example an event) may also be featured on OneShetland’s official social media pages to promote it to the community. We don’t sell your data.

Some providers process data outside the UK (for example in the EU or US). Where they do, transfers are protected by appropriate safeguards such as the UK’s data-bridge arrangements or standard contractual clauses.

Marketing emails are opt-in and every message has an unsubscribe link. Push notifications are controlled per-category in your notification settings, with quiet hours — you decide what you receive.

We keep your data for as long as your account is active, then only as long as needed for legal, tax and accounting purposes. Compliance and financial records are kept for the period the law requires.

Under UK GDPR you can access, correct, delete or port your data, object to or restrict processing, and withdraw consent. To exercise any of these, contact hello@oneshetland.com. You can also complain to the Information Commissioner’s Office (ico.org.uk).

OneShetland is for users aged 18 and over; we don’t knowingly collect data from children.

We may update this policy; we’ll notify you of significant changes in-app or by email.