Privacy Policy

What we collect, what is public, and who we share it with.

Draft — under review, not yet in force

This document is published for review and is not the final policy. Some details are still to be confirmed and are marked as such. It does not yet create binding obligations for either you or us.

1. Who we are

[Operating entity to be confirmed] operates you.new and is responsible for the information described here. Privacy questions: [privacy contact email to be confirmed]

2. Who this covers

Two different groups of people:

Members — people with a you.new account who build pages.
Visitors— anyone who opens a member’s public page. Visitors need no account, and we ask them for nothing unless the member has turned on a contact form — in which case what a visitor chooses to type into it goes to that member. See section 5.
Members as controllers. When a visitor fills in a member’s contact form, that member decides what happens to the details. We store them on the member’s behalf and give the member the tools to export and delete them. If you sent your details to a member and want them removed, ask that member first; contact us if they do not respond.
When a page changes hands. A member can offer one of their pages to another member, and it moves if that member accepts. We can also move a page between accounts on request. The details visitors left through that page move with it, and the new owner becomes their controller.

3. What we collect from members

Account information. Your email address, and authentication data handled by our hosting provider. We do not store your password.
Profile information you enter. Display name, username, biography, job title, location, tags, profile and background images, social links, and the content of the cards on your page.
Account settings. First and last name, country and phone number, where you provide them.
Purchase records. What you bought, when, and the order reference. We never see or store your card details — payment is handled entirely by the payment provider.
Referral information. Who referred you and who you have referred, used to calculate commission.
Activity records. The things that make up your Impact score — for example, that you shared a page (which page, through which app, and when; never who you sent it to) or updated your biography — and when you last used your dashboard.
Interests you pick. If you choose interests (in onboarding or Settings), we keep them privately on your account and use them, with your page’s location and title, to suggest members you might want to meet. Nobody can see your list: a suggestion shows another member only the interests you have in common, and only members listed on Discover are suggested. You can change or clear them at any time in Settings, and they are deleted with your account. Invites you send from the onboarding open your own messaging or email app — we never see who you send them to.

4. What is public

Your page content is publicly readable. That includes your display name, username, biography, job title, location, tags, images and every card on your page.

Setting a page to Hidden removes it from the website, but the underlying data remains technically readable. Hidden means “not shown”, not “erased”. Do not use a hidden page to store anything private.

Discover. Unless you turn it off, your account is listed on Discover, the you.new home page, which anyone can see — including people who are not signed in, and search engines. Your card shows your display name, username, photo, Discover card photo, header or background image, job title, the start of your biography and your location, and links to your main page. Your tags are not shown, but people can find you by searching for them. It never shows your Impact score, how many people joined through you, or your network size. Pages that are hidden, taken down or under review are not listed. You can turn this off at any time under “Show me on Discover” in your page settings, and you are removed straight away.

Separately, members above you in your referral network can see that you are in their downline whether or not you are listed on Discover. The Discover setting controls whether you can be found by name, not whether the connection exists.

Your Impact score. Wherever your name is shown to other signed-in members, it can appear with your Impact score (a number from 0 to 100 reflecting your recent activity), how many people you have invited, and the size of your network. How your score was earned is not shown to anyone but you, and members are not ranked against each other. Discover never shows it. Turning off “Show me to people above me” still keeps you out of other members’ lists.

Likes and saves. When you like a member’s page, that member can see that you liked it, shown as your main public page. Nobody else can see it, and the number of likes is never shown on a page. If you both like each other’s pages, you each get the other’s contact card: name, title, page link, and the public email and phone on that card, if any. Your sign-in email is never shared. Saving a page is private: it goes into your own groups, only you can see it, and the page’s owner is not told. A member can remove a like from their page without the person who liked it being told.

Your email address, phone number, country, purchase history and account settings are not public.

5. What we collect from visitors

Page analytics. When someone opens a member’s page or clicks a card we record which page, which card, and when. So that each visitor is counted once a day and fake traffic can be filtered out, we briefly process the visitor’s IP address and browser type to create an anonymous identifier for that day. The IP address and browser type themselves are never stored, the identifier is deleted within about a day and cannot be linked from one day to the next, and this analytics builds no profile of visitors. A member’s visits to their own page are not counted.
Visitor identification. [Wording to be confirmed] We run a third-party visitor-identification script on every page of you.new, including members’ pages. It may match a visit to a profile its provider already holds, which can include a name and contact details. Separately, a member can add their own visitor-identification tool (Pixel) to their page; it then reports that page’s visitors to that member. Both scripts are run by their provider, collect data directly from your browser, and are governed by the provider’s own privacy policy. See section 8.
Contact forms. If a member has turned on the option to ask visitors for their details and you choose to fill the form in, we store the name, phone number, email address and note you type, and make them available to that member. Nothing is collected from a visitor who does not use the form. We also email the member a copy of what you typed, and email you the member’s contact card. Each of those emails has a link to stop further ones. To honour that link, and to limit how often any one address is emailed, our email log keeps a one-way fingerprint (a hash) of the address rather than the address itself. We record the IP address of the submission separately, in an abuse log that holds no contact details, solely to rate-limit the form — it is not stored alongside what you typed.
A referral cookie. If someone arrives through a referral link we store a cookie naming the referring member for 30 days, so that member is credited if the visitor registers. It holds no personal information about the visitor.
Authentication cookies. Members’ sessions are maintained with cookies set by our hosting provider. These are strictly necessary for signing in.
Reports. If someone reports a page we record their IP address to prevent abuse of the reporting system, along with the reason given and any detail they type. See section 7.

6. Why we process this

Providing your account and publishing your page — to perform our contract with you.
Taking payment and calculating commission — to perform our contract with you.
Keeping the service safe and moderating content — our legitimate interest, and our legal obligations.
Understanding how pages perform — our legitimate interest, in aggregate form.
Passing a contact form submission to the member whose page it was sent from — our legitimate interest and theirs, acted on at the visitor’s own initiative.
Service messages about your account — to perform our contract with you.

[The privacy regime that applies, and the corresponding lawful bases, to be confirmed]

7. Content moderation

We check content published through you.new against our Acceptable Use Policy.

What we record

When content is reported, flagged or removed we record what was acted on, what the decision was, who made it and when. Where a report comes from a visitor we record their IP address to prevent abuse of the reporting system.

Automated screening

Where enabled, images and text you publish are sent to a third-party classification provider to check for the content described in the Acceptable Use Policy. We send the content itself and nothing about your account. Your content is not used to train the provider’s models.

Moderation records are kept [retention period to be confirmed].

8. Who we share information with

We do not sell your information. We share it only with providers who help us run the service: our hosting and database provider, our application hosting provider, our email delivery provider (SendGrid), our payment and CRM provider, our content classification provider where automated screening is enabled, and the operators of any tools you embed on your page.

[Each provider to be named individually before this policy is finalised]

Contact form submissions are an exception: they are held by us on the member’s behalf and shared with no one else, apart from our email delivery provider, which carries the emails described in section 5.

Embedded tools are your responsibility. Widgets, chat tools and visitor-identification tools (Pixel) you add to your page are operated by third parties, collect data directly from your visitors, and are governed by their own privacy policies — not this one. If you embed them, you should tell your visitors.

Contact form submissions are your responsibility too. If you turn on the option to ask visitors for their details, you decide what happens to what they give you. Handle it accordingly and honour deletion requests — the Contacts tab lets you delete any entry.

We also share information where the law requires it, or to protect the safety of people using the service.

9. Where information is held

[Data location and international transfer safeguards to be confirmed]

10. How long we keep things

Account and page content — while your account is open.
Closed accounts — kept, offline, for 48 hours so you can change your mind, then deleted. We keep a record that the account was closed and deleted, with its former usernames, so we can answer questions about who held a name.
Page content after deletion — removed from the service; backup copies expire on the provider’s schedule.
Uploaded images — until you delete them or we remove them. Deletion is permanent.
Purchase and commission records — as long as required for tax and accounting.
Contact form submissions — kept until the member deletes them, or until the page they were sent to is deleted.
Likes and saves — until you undo them, or until the page or account is deleted. A page that changes hands loses its likes and saves. A card swap from a mutual like stays in each member’s list until they remove it, or an account is deleted. Records of like actions, kept to limit abuse, are deleted after 90 days.
Contact form abuse logs (IP addresses only) — [retention period to be confirmed]
Page analytics and moderation records — [retention periods to be confirmed]

11. Your rights

Depending on where you live, you may have the right to access a copy of your information, correct it, delete it, object to or restrict how we use it, take it elsewhere in a portable form, and complain to your data protection regulator.

To exercise any of these, contact [privacy contact email to be confirmed].

Some information cannot be deleted on request — for example records we must keep for tax, or moderation records relating to a serious breach.