safespace is anonymous, two-way reporting software. This page explains what is collected when you visit this site, make a report or use the dashboard, and how it is handled.
About the walkthrough. The interactive walkthrough on this site uses a sample organisation, Calder Group, and sample data. Reports, replies and demo requests made in the walkthrough are not sent anywhere.
Who we are
safespace is based at Park House, Park Square West, Leeds LS1 2PW. For anything in this policy, contact hello@safespaceapp.co.uk.
Our role and your organisation’s
For this website and for demo requests, we decide how your data is used, so we are the data controller.
When an organisation such as an employer, school or housing provider uses safespace, that organisation decides why reports are collected and how they are handled. It is the controller of the reports made to it, and safespace processes them on its behalf. Questions about a specific report, or how an organisation acts on it, should go to that organisation.
If you make a report
You don’t need an account and you are never asked for your name or email address.
- We store what you choose to write, any files you attach and the conversation that follows.
- You receive a case key to return to the conversation. Only a one-way hash of it is stored, so it can’t be read, looked up or recovered by anyone, including us.
- Your IP address and device details are never stored with your report. To stop the service being abused, your IP address is used briefly to count how many reports come from one place in a short window. That counter isn’t linked to any report and expires with the window.
Anything you write can identify you if it contains personal details. Share only what you are comfortable with. The lawful basis is the legitimate interests of the organisation you are reporting to, and in some cases its legal obligations, for example around whistleblowing or safeguarding.
If you use the dashboard
Team members are invited by their organisation. We hold their work email address, role and the replies, notes and decisions they make on cases, which appear on each case’s timeline. Email alerts about new activity contain no report content. The lawful basis is the contract with the organisation and its legitimate interest in running its reporting channel.
If you request a demo
The demo form collects your name, work email, organisation and anything you add, and we use them only to arrange and run the demo. The lawful basis is our legitimate interest in responding to enquiries. In the walkthrough the form sends nothing.
How long it is kept
Reports are kept for as long as the organisation using safespace needs them, and are deleted when it closes its account or asks us to. Team member details are removed when their access ends. Demo enquiries are kept only as long as needed to follow up.
How it is protected
Data is encrypted in transit and at rest. Row-level security means team members can only ever see their own organisation’s cases, and read-only members can’t reply to or change them. Case keys are stored as hashes.
Your rights
Under UK data protection law you can ask for access to the personal data held about you, and for it to be corrected, erased or restricted, or moved elsewhere. You can also object to how it is used. To do any of these, email hello@safespaceapp.co.uk, or for a report, contact the organisation you reported to.
Because reports are anonymous, we can’t find yours from your name. Including your reference number will help, but never send us your case key.
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, though we would appreciate the chance to help first.
Changes
This policy may be updated from time to time. Any changes will appear on this page with a revised date.