Unpinched

Volunteer Privacy Notice

Last updated: 20 April 2026

This notice explains how Unpinched handles personal data when you volunteer to take part in the closed beta programme. It covers only the volunteer recruitment process — separate notices apply to registered users of the main Unpinched service.

Who is the controller

The data controller for information collected through the volunteer form is:

Actibility Limited, operator of the Unpinched service.

  • Private company registered in England
  • Company Registration Number: 10607409
  • Registered Office: 124 City Road, London, EC1V 2NX, United Kingdom
  • Contact: support@unpinched.com

If you have questions about this notice, or you want to exercise any of the rights set out below, please use that email address.

What we collect

When you submit the volunteer form we collect:

  • Your first name and last name
  • Your email address
  • An optional note describing your interest in the programme
  • The date and time of your submission
  • A one-way hash of your IP address (used only for anti-abuse throttling — we do not store the raw IP)
  • The user-agent string reported by your browser

Why we collect it

We use this information to:

  1. Assess suitability — decide whether to invite you into the closed beta based on your interest note and any information you provide
  2. Communicate the outcome — email you an invite code if accepted, or a polite decline if not
  3. Prevent abuse — apply rate limits and detect duplicate or automated submissions

Lawful basis

We rely on two lawful bases under UK GDPR:

  • Consent (Art. 6(1)(a)) — for processing the details you enter into the form. You give this consent by submitting the form. You can withdraw consent at any time by asking us to delete your record (see "Your rights" below).
  • Legitimate interest (Art. 6(1)(f)) — for the anti-abuse measures (IP hash, user-agent, rate-limit counters). Our interest is protecting the form from bots and repeat submissions; the impact on you is minimal because we do not store the raw IP or link the hash back to you.

How long we keep it

  • While your application is pending — until we review it and set its status (usually within 7 days)
  • If you are accepted — your contact details are kept only until you redeem the invite code in the app, at which point the volunteer record is deleted. From that point on, the main Unpinched user privacy notice applies.
  • If you are declined or you withdraw — we hard-delete your record 90 days after the decision, to give us time to answer any follow-up questions
  • If you never redeem an accepted invite — we hard-delete your record 90 days after approval

We keep an internal audit log of changes to applications (who approved, when, why). The audit log does not contain your personal data beyond the application ID and timestamp.

Who we share it with

We do not sell or share your information with any third party for their own purposes. The service providers (processors) who help us run the volunteer form are:

Processor Role Typical region
Cloudflare, Inc. DNS, CDN, and security for unpinched.com United Kingdom / European Union points of presence
DigitalOcean, LLC Hosting for the volunteer-form backend and its database United Kingdom (LON1 datacenter)
Apple Inc. Email service for support@unpinched.com Global (US-headquartered)

Each processor is engaged under a written data-processing agreement and only processes your information on our instructions.

International transfers

The volunteer form database is hosted entirely in the United Kingdom and is not replicated elsewhere.

Your form submission is typically processed at a Cloudflare point of presence in the United Kingdom or European Union before reaching our UK server. Cloudflare is headquartered in the United States; in the unlikely event traffic is routed through a non-UK/EU point of presence, Cloudflare relies on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

Email sent to or from support@unpinched.com is handled by Apple and may be processed on servers outside the UK. Apple relies on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum for these transfers.

Your rights

Under UK GDPR you have the right to:

  • Access — ask for a copy of the information we hold about you
  • Rectification — ask us to correct anything that is wrong
  • Erasure — ask us to delete your record ("right to be forgotten")
  • Portability — ask us to give you your data in a machine-readable format (we provide JSON)
  • Object — object to our processing based on legitimate interest
  • Withdraw consent — ask us to stop processing at any time

To exercise any of these rights, email support@unpinched.com. We will respond within 30 days. There is no charge for most requests.

If you are unhappy with how we have handled your information, you can complain to the UK Information Commissioner's Office (ico.org.uk).

Cookies

The volunteer form does not set any cookies. It does not use localStorage, sessionStorage, or any other browser-side persistence.

Changes to this notice

We may update this notice from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be notified to accepted applicants by email before they take effect.