Privacy policy.

Cozy (“we”, “us”) runs www.cozylondon.co.uk. This policy explains what personal data we collect, why, and the choices you have. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Questions? Email privacy@cozylondon.co.uk.

What we hold

• Account details: your email address, display name and, for hosts, phone number and business details you add.
• Listings: the photos, descriptions, location and calendar information hosts add. Photos are re-encoded when uploaded, which removes hidden metadata such as GPS location.
• Briefs and messages: what you tell Dea or Leo, the briefs you create, enquiries and conversations between guests and hosts, and booking proposals.
• Invoices: for confirmed bookings, the names and billing details needed to issue an invoice. Hosts’ bank details appear only on their own invoices.
• Usage and device data: pages viewed, how you arrived (for example a campaign link), and basic technical details — only with your consent where the law requires it.
• Donations: the amount and your Stripe receipt details. We never see your full card number.

Why we use it (and our lawful bases)

• To run your account, show listings, pass messages between guests and hosts and create invoices — contract.
• To keep Cozy safe: preventing spam and scams, reviewing reported conversations and checking listings — legitimate interests.
• To send service emails you need (sign-in links, enquiry and booking notifications) — contract.
• To send newsletters or occasional updates — consent, which you can withdraw at any time from any email.
• For analytics and advertising measurement cookies — consent, through our cookie banner.
• To keep financial records — legal obligation.

Dea and Leo (AI)

Dea and Leo are powered by a large language model provided by Anthropic. When you chat with them, the text of your conversation and the relevant listing details are sent to Anthropic to generate a reply. We don’t use your conversations to train models, and our provider doesn’t either under our agreement. The assistants never send anything or confirm a booking without a person approving it.

Who processes data for us

We use a small number of trusted processors, each under a written agreement:

• Supabase — database, sign-in and file storage.
• Render — hosting for the website.
• Anthropic — the AI model behind Dea and Leo.
• Resend — sending email.
• Stripe — donations, and card payments made to hosts’ own Stripe accounts.

Map tiles come from OpenFreeMap (OpenStreetMap data); your browser requests them directly, which shares your IP address with that service. Some processors are based outside the UK; where that happens, data is protected by UK adequacy regulations or the UK International Data Transfer Addendum.

We never sell your data. Hosts see what you choose to send them in a conversation; they never see the contact details on your account.

Cookies and consent

We use essential cookies to keep you signed in and remember your choices. Analytics (Google Analytics 4) and advertising measurement (Meta Pixel) only run if you agree in the cookie banner, using Google Consent Mode so nothing is stored until you choose. You can change your mind at any time from the cookie settings link in the footer or by clearing your browser’s storage for this site.

If you arrive through a host’s invite link (/r/…), we set one first-party cookie, cozy_ref, for 90 days. It holds only the invite code, so we can thank the host who invited you when you list a space. It isn’t used for advertising and is never shared.

How long we keep it

We keep account data while your account is open. Briefs expire from the lead feed after 21 days. Messages are kept so both sides have a record of what was agreed. Invoices and donation records are kept for six years for tax purposes. When you delete your account, we delete or anonymise the rest within 30 days.

Your rights

You can ask to see, correct, export or delete your data, object to some uses, or withdraw consent. The quickest way is from your account, where you can download a copy of your data or delete your account. You can also email us. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office (ico.org.uk).

Changes

If we change this policy in a way that matters, we’ll tell you by email or on the site before it takes effect.