Privacy Policy.

QuietList is a technology platform that facilitates private introductions between buyers and sellers of residential property. We do not act as estate agents and we do not represent either party in a property transaction. We don't list, value, market, or sell your home — we simply provide the quiet rails that let curious owners and serious buyers discover one another before anything goes public.

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), QuietList is the data controller for the personal information described in this policy. You can reach us at privacy@quietlist.co.uk.

We only collect what we need to run the service:

• Account details — your name, email, and password hash when you sign up.
• Listing details (sellers) — postcode, property type, bedrooms, asking price band, motivation, and any photos or descriptions you choose to upload.
• Buyer profile — preferred areas, budget, mortgage status, chain status, and move timeline. Optional but helps sellers gauge fit.
• Activity signals — listings you view, save, message about, or send soft offers on.
• Technical data — IP address, device type, and an anonymised visitor hash so we can count unique views without tracking you across the web.

• To create and operate your QuietList account.
• To display masked listing information (e.g. a partial postcode and blurred photos) to buyers before mutual consent.
• To pass a soft offer's amount and message only to the seller — your name and contact details remain hidden until they accept.
• To unlock direct messaging between buyer and seller only after a soft offer is accepted.
• To send transactional emails (offer activity, saved-search alerts) and security notifications.
• To improve the service and detect abuse, in line with our legitimate interests.

Privacy isn't a setting on QuietList — it's the product. By default:

• Your full address is never shown publicly. Sellers choose whether buyers see the area, district, or full postcode.
• Photos are blurred until you choose to reveal them.
• Buyers and sellers stay anonymous to one another until a soft offer is accepted by the seller.
• Messaging is RLS-gated at the database level — it cannot be opened before mutual consent, even by mistake.

We rely on the following lawful bases under UK GDPR:

• Contract — to provide the platform you signed up for.
• Legitimate interests — to keep the service secure, prevent fraud, and improve features. You can object at any time.
• Consent — for optional marketing emails and saved-search alerts. You can withdraw consent at any time from your account or via the unsubscribe link.
• Legal obligation — when we must respond to lawful requests from regulators or law enforcement.

We don't sell your data. We share information narrowly and only where it's essential:

• Other QuietList users — only the masked signals described above, and only what's needed at each stage of the journey.
• Service providers — our hosting, database, email, and analytics processors, all bound by data-processing agreements.
• Authorities — when legally compelled to do so.

Account and listing data is retained while your account is active and for a reasonable period afterwards (typically up to 24 months) so we can handle disputes and meet legal obligations. Email logs and security records may be kept longer where required by law. You can delete your account at any time and we'll erase or anonymise data that we don't need to retain.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion ("right to be forgotten").
• Restrict or object to certain processing.
• Data portability.
• Withdraw consent at any time (for processing based on consent).
• Complain to the Information Commissioner's Office.

Email privacy@quietlist.co.uk to exercise any of these rights.

We use a small number of strictly necessary cookies to keep you signed in and protect against abuse, plus a privacy-respecting analytics layer that uses an anonymised visitor hash rather than third-party tracking cookies. We don't share data with ad networks.

Data is encrypted in transit (TLS) and at rest. Database access is restricted by row-level security so that users — including our own staff — can only see what they're entitled to see. We review access logs and rotate credentials on a regular basis.

We may update this policy as the product evolves. Material changes will be flagged in-app or by email. The "last updated" date at the top will always reflect the current version.

Questions, requests, or concerns? privacy@quietlist.co.uk. We aim to reply within 5 working days.