Your privacy.

Who we are

Upstairs Works is a coworking space at First floor, 1 Church Street, Whitchurch, Hampshire, RG28 7AD. Upstairs Works is responsible for your information. You can email us at aarons88@gmail.com.

You can also contact Aaron on +44 7702 566 037 or write to the workspace address above. Please do not send identity documents in a website enquiry.

The information we use

• Enquiries: your name, email, phone number, what you do and whether you want a desk for yourself or to share. We use these details to answer you and discuss a space.
• Your account: the name, email, profile image (if provided) and account identifier returned by Google or Apple, along with details you add to your profile. Apple may provide a private relay email. We never receive your Google or Apple password.
• Using the space: profile and company details, desk assignments, booking dates and times, requests, charges and invoice/payment records. A booking or assignment records who had a space reserved; it is not a record of attendance.
• ID checks: staff check photo ID in person and record that it was checked, when and by which administrator. The portal has no ID-document upload and does not store a copy or document number from that check.
• Security: sign-in sessions, IP address and browser information, provider tokens, and a history of administrative changes. These help protect accounts and keep records accurate.
• Email: messages you send to our workspace mailbox, your contact details, attachments and our replies. Authorised staff use the shared inbox to answer you. We also send account welcome and paid-booking confirmation emails needed to provide the service.
• Personal desk offers: when an offer link loads, we record the time against that offer so staff can follow up. This does not confirm who opened the link. The record stores no IP address or browser identifier, and we do not track email opens.

Sign-in only requests basic identity information. It does not give us access to your Gmail, Google Drive, Apple photos or contacts. Using a different sign-in provider can create a separate account; matching email addresses are not automatically linked.

Why we use it

Staff can opt in to browser notifications for incoming email. We store their browser subscription and notification preference, and send an encrypted alert through their browser provider’s push service. Alerts contain no sender name, subject, or email content. Staff can turn them off or disconnect their browsers in the inbox settings.

We use enquiry and account information to take steps you request before a contract, and to provide your account and agreed workspace services. Our legitimate interests are running the space safely, preventing misuse, responding to questions and keeping an audit trail. Where required, we keep financial records to meet legal obligations.

We need contact and sign-in details to provide an account, and booking details to reserve a space. Creating an account or making an enquiry does not subscribe you to a mailing list. Any future marketing subscription will be a separate choice.

Who can see it

Authorised Upstairs Works administrators can manage member profiles and workspace records. Members can see their own account information. We use these services to operate the website:

• Cloudflare: website hosting, security and the private database, private email storage and email delivery.
• Google or Apple: the sign-in service you choose, which also handles information under its own privacy notice.
• Slack: private enquiry notifications to the team, containing the details you submit.

Stripe handles checkout, invoices, subscriptions and payment details. Our portal keeps payment references and status rather than full card details.

Staff may configure verified email addresses to receive forwarded copies of workspace messages. These copies are also handled by the receiving email provider. We keep conversation records and original emails for two years after the latest activity, or longer while delivery or a support issue remains unresolved. Please do not email copies of your identity documents; we check ID in person.

Earlier enquiry records also remain in the previous Vercel/Neon service while the hosting migration is reconciled. The live website now uses Cloudflare.

Our Cloudflare database is configured for the EU. Hosting, sign-in and notification providers may also process information in other countries. The applicable provider transfer arrangements and safeguards are being reviewed for the final version of this notice.

Cookies and keeping you signed in

We use necessary cookies for sign-in and account security. Sessions normally expire after fourteen days, and continued use can renew them. You can sign out at any time; blocking these cookies prevents account sign-in. We do not use advertising cookies.

Links to Google Maps or WhatsApp open those services, where their own privacy and cookie policies apply.

We use Cloudflare Web Analytics to understand website visits, popular pages, referrals and loading performance. It does not use analytics cookies or identify individual visitors. We also remember your last sign-in provider in this browser’s local storage; this contains only the provider name, not your credentials.

Optional website analytics

Anonymous UK page counts

We automatically count views of public pages from UK connections to help improve the website. Cloudflare determines the connection’s country; we save only a daily total for each public page. We do not save individual events, IP addresses, visitor or account identifiers, query strings, referring pages or browsing histories for these counts. They cannot tell us how many different people visited.

These totals stay in our Cloudflare database for up to two years and are not sent to Google. We use the statistical purposes exception for this limited measurement. You can turn page counts off at any time in Analytics settings; no account is needed. We remember that setting in this browser for six months. Browser Do Not Track and Global Privacy Control signals also turn these counts off. Private account pages, admin pages and invitation links are excluded.

Google Analytics

If you choose “Allow analytics”, Google Analytics uses cookies to measure visits to our public pages, including visits from the UK. It receives a random browser identifier, public page names, referring website and campaign labels, and information about your browser and device. This helps us understand how people find the workspace and which pages are useful.

Google Analytics stays off until you allow it. We do not send account identifiers, names, contact details, form contents, private account pages or invitation links to Google Analytics. Advertising features are disabled. Your website analytics choice is separate from the optional account activity tracking below.

We remember your choice for six months. Analytics cookies last up to six months. You can decline or withdraw at any time using Analytics settings. Withdrawal stops future Google Analytics collection and removes its cookies from this site; it does not remove information already collected.

Google processes analytics information on our behalf and may process it outside the UK. See how Google uses information from sites that use its services. The website works normally if you decline.

Optional account activity tracking

After sign-in, you can separately choose whether to allow personalised analytics. This is optional, starts off unticked, and is not a condition of accepting our terms, booking or paying. You can change your choice in your account’s profile at any time.

If you opt in, we use a random browser identifier lasting up to 90 days, session storage and a 30-minute attribution cookie to measure page views, enquiry steps and booking journeys. Activity is linked to your account. Authorised staff can see your last observed page and time; this is not a live location. We collect allowlisted page names and campaign labels, not form contents or full query strings.

We also compare different homepage wording. With your activity tracking permission, we record which version was shown and whether it led to an action, enquiry or paid booking within 30 minutes. The version can change when you reload the homepage.

We rely on your consent for this tracking. Withdrawing stops future personal activity collection and removes your last-seen information. Individual journey events expire after 90 days; anonymous daily statistical summaries are retained for two years. Necessary account, booking, payment and security records are unaffected.

Cloudflare’s separate cookie-free aggregate website statistics do not use this optional account tracking. They help us understand overall website traffic without identifying individual visitors.

How long we keep information

We keep enquiry details while following up, account and booking information while needed to provide the service, and billing or security records for as long as needed for legal obligations, outstanding balances or disputes. Account closure does not automatically delete every record; contact us to request deletion.

Your choices and rights

You can ask to access or correct your information, or request deletion, restriction or a portable copy where the relevant right applies. You can also object to processing based on legitimate interests. These rights can have exceptions, including records we must retain by law.

Contact us using the details above to make a request. We may need to confirm your identity before releasing account information. You can raise concerns with the Information Commissioner’s Office.

We will date changes to this notice and draw significant changes affecting your account to your attention.