Privacy Policy
Last updated 28 July 2026
This policy explains what personal data Unlocked London collects, why we collect it, and the rights you have over it. It applies to theunlockedlondon.com and to the private guide app.
The short version.
- We never see or store your card details — Stripe handles all payments.
- The places you save and mark as visited stay in your own browser, not on our servers.
- Analytics cookies only load if you agree, and you can change your mind at any time.
- The map only uses your location if you ask it to, and your position never leaves your phone.
- We do not sell your personal data.
1. Who we are
Franceska Sulejmani, trading as Unlocked London (“we”, “us”), operates theunlockedlondon.com and the Unlocked London subscription guide. Franceska Sulejmani is the data controller for the personal data described in this policy.
Contact for any privacy question or request: hello@theunlockedlondon.com.
2. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Email address and subscription details (via Stripe) | To create your subscription, send your access code and handle billing and cancellation | Performance of a contract |
| Your personal access code, stored in a secure cookie | To keep you signed in to the guide and confirm your subscription is active | Performance of a contract |
| Saved places, hearts and visited markers | To remember your personal list — these stay in your browser’s local storage | Performance of a contract |
| Your approximate location, only if you tap “Use my location” | To show the guide’s addresses around you on the map and sort them by distance. Your position is used inside your browser only — it is never sent to us or stored anywhere, and it stops being used as soon as you leave the map. | Your consent |
| Meta Pixel analytics events | To measure which adverts lead to trials so we can advertise sensibly | Your consent |
| Standard server and security logs | To keep the service available and protect it from abuse | Legitimate interests |
3. Payments
Payments are processed by Stripe Payments Europe, Ltd. We never receive or store your full card number. Stripe processes your payment data as an independent controller under its own privacy policy. We receive only what we need to run your subscription: your email address, the subscription status and the last digits and brand of your card.
4. Cookies and analytics
We use two kinds of cookies and similar storage:
- Strictly necessary — the access-code cookie and local storage that keep you signed in and remember your saved places. Without these the app cannot work, so they do not require consent.
- Analytics (optional) — the Meta Pixel, which tells us whether an advert led to a preview or a trial. It only loads after you press “Allow analytics”, and you can withdraw consent at any time on our cookie preferences page.
When the Meta Pixel is active, Meta Platforms Ireland Ltd. receives event data as a joint controller for its own purposes, as described in the Meta Privacy Policy.
5. How long we keep data
- Subscription and billing records: kept for as long as required by tax and accounting law (normally six years).
- Access-code cookie: until it expires or you clear your browser data.
- Saved places: they live only on your device and are deleted when you clear the browser.
- Analytics events: retained by Meta according to its own retention periods.
6. Sharing
We do not sell your personal data. We share it only with the providers needed to run the service: Stripe (payments and subscription management), Vercel (hosting) and, with your consent, Meta (advertising measurement). Providers may process data outside the UK/EEA under appropriate safeguards such as Standard Contractual Clauses.
When you open the map, your browser requests map imagery from CARTO and OpenStreetMap. Those requests carry your device’s IP address and the area of the map being viewed, as with any website that shows a map. We do not send them your exact position.
7. Your rights
Under the UK GDPR and the EU GDPR you have the right to access, correct, delete or port your data, to restrict or object to processing, and to withdraw consent at any time. Write to hello@theunlockedlondon.com and we will reply within 30 days.
You may also complain to a supervisory authority — in the UK, the Information Commissioner’s Office.
8. Children
The service is intended for adults. It is not directed at children under 16 and we do not knowingly collect their data.
9. Changes
If we change this policy we will update the date at the top of this page and, for significant changes, tell subscribers by email.