Nule Rep privacy policy

Last updated 14 September 2026

1. Who we are

Nule Limited ("we", "us", "our") operates Nule Rep (available at rep.nule.ai), a record of which tradespeople the households on a street have used and would use again. We are a company registered in the United Kingdom. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Nule Limited is the data controller for the personal data collected through Nule Rep.

2. What data we collect

Account: your first name, and the email address or mobile number you sign in with, together with your notification and house-number preferences. There are no passwords: we send you a single-use sign-in link and a six-digit code, either of which gets you in.
Your home: the address you claim, resolved to its Unique Property Reference Number (UPRN), the street's Unique Street Reference Number (USRN), the property's coordinates as supplied by the address service, and the map cells derived from them. This is how Rep knows which street you live on. The coordinates are never shown to anyone and never leave Rep — search matches on street and cell references, never on distance.
Home verification: when you verify your home we receive one device location reading (latitude, longitude and its accuracy). We record whether it was close enough to your address; we do not track your location afterwards.
What you say: the tradespeople you recommend, jobs you confirm, and asks you post (what you need and any note you add), together with the street they were made from.
Businesses: if you add or claim a business — its trading name, trade, phone number, email and website.
Usage: when a shared link is opened, and messages we send you (channel and whether they were delivered).
Invites: if you use Share Nule Rep, the email addresses you type. Each gets one email naming you, and the address is kept only in our record of that message, which is emptied after 30 days. If someone joins through your invite, we record that you know each other and show each of you the other's first name in Settings. The connection is deleted if either of you deletes your account.
If Rep cannot reach you yet: Rep only knows UK streets. When somebody enters a postcode we cannot resolve we record the postcode and its shape, with nothing that identifies anyone, so we can see where to go next. If you then ask us to tell you when Rep reaches you, we keep your email address and the place you typed — that is not an account, we send you nothing else, and you can have it removed at any time by writing to privacy@nule.ai.

3. How we use your data

To work out which households are on the same street and nearby, so recommendations are shown in the right place.
To count each household once, however many people live there, and to keep a recommendation with the street it was made from even after you move.
To tell a tradesperson that a household on a named street recommended them, and to tell tradespeople your street has recommended when you ask for their trade. Both messages use your first name and house number.
To send you sign-in codes and notifications about your asks, your home and your business, including one reminder if you haven't confirmed your email after 2 days, and one if you haven't verified your home after 3.
To detect misuse, such as an account claiming many homes in a short time.
If you tag a tradesperson you saw working on your street (Van Spot), we keep the business, your street and the date with your account, and the link you sent them. We do not keep which house they were outside, and we never message the number on the van ourselves — you send that from your own phone. If the van showed an email address and you ask us to, we email them once, naming your first name and street. If you photograph the van to fill in the form, the photo is sent once to Amazon Rekognition (London) to read the writing on it, and is not kept by us or by them; the number plate is discarded before anything reaches the page. A tradesperson who opens the link but does not claim gets one reminder email from us, to the business address, and no more.
To run and support the service. A small number of Nule staff can see accounts, homes and businesses through an internal console in order to answer support, correct mistakes and act on requests like these. Access needs a named administrator sign-in; nothing about it is public and nothing is shared outside Nule.

4. What other people can see

Your first name and house number appear beside the tradespeople you recommend. Households on your own street see them. Further away, people see the street name only, with no house number.
A tradesperson you recommend is told your first name, house number and street.
When you post an ask, the tradespeople your street has already recommended are told your first name, house number and street. They are also told the first name and house number of the neighbour who recommended them.
Your ask comes with a link for you to post in your street group. Somebody who opens it and has claimed a home sees your first name and house number, and those of anybody who answers. Somebody who has not sees only that a household on your street is asking, with no name and no number — and a link preview shared onward names nobody at all.
A business you have claimed shows you the first name and house number of every household that recommended you, and the date.
A business is told only how many households would not recommend it — never which, never from which street, never on what date. Your neighbours see a thumbs down without your house number too, unless you tick the box that lets them ask you why.
Nobody sees your postcode, the rest of your address, or your location. There is no way to search Rep for a person or an address, and we do not sell personal data.
We never publish totals designed to rank people or businesses.

5. Lawful basis

We process your data to provide the service you asked for (performance of a contract), on the basis of your consent where you tick a box — being told when someone on your street is looking for a tradesperson, and letting neighbours ask you why you would not recommend someone — and in our legitimate interests of keeping the record trustworthy and preventing fraud. Analytics and the advert on your home pages run on consent alone and only after you accept. Buying the ad-free pass is a contract, and we keep its record because tax law requires it. Every tick is off by default and can be turned off again in Settings.

6. Where the data comes from and goes

Ideal Postcodes (Royal Mail PAF and Ordnance Survey AddressBase) resolves the address you type into a UPRN and coordinates. When someone looks up a postcode we receive, and keep, every address in it — not only the one they pick — so that we never have to ask again for that postcode. Those stored addresses are property records, not people: no name, no occupant and no account is attached to an address unless somebody claims it. They are kept for as long as Rep operates, and you can ask us to remove one at privacy@nule.ai.
Ordnance Survey Open Linked Identifiers gives us the street (USRN) for a property. Contains OS data © Crown copyright and database right 2026, used under the Open Government Licence.
Amazon Web Services (UK/EU regions) hosts the service, sends our emails (Amazon SES), sends text messages if you turn them on (Amazon SNS), and holds our nightly backups (Amazon S3, London).
If WhatsApp notifications are switched on, Meta Platforms delivers those messages to the number you gave. Meta processes them in the United States under the UK addendum to the EU Standard Contractual Clauses.
Google (Google Analytics) receives page views only if you accept analytics, with identifiers stripped from the address and your IP anonymised. Google processes them in the United States under the UK addendum to the EU Standard Contractual Clauses. Decline and nothing is sent.
Google (AdSense) shows one advert at the bottom of a household's home, Find someone and My recommendations pages, only if you accept cookies. Google receives the address of those three pages, which carry nothing that identifies you, along with the usual browser details it needs to serve an ad. No other Rep page loads it, and tradespeople's pages never do. Google processes this in the United States under the UK addendum to the EU Standard Contractual Clauses.
Stripe takes payment if you buy the ad-free pass. You pay on Stripe's own page, so Rep never sees your card; we receive a record that your household paid, how much and when. Stripe acts as an independent controller for payment and fraud checks.
If you link a business to a Nule account, we exchange your Nule account identifier and business name with Nule so finished jobs can become recommendations.

7. How long we keep it

Your home history (including homes you have moved from) and recommendations are kept for as long as your account exists, because a recommendation belongs to the street it was made from.

Home-verification readings — we keep whether it was close enough, and how close, for 90 days, then delete the record. The location reading itself is never stored at all.
Sign-in codes and links — deleted as soon as they are used or expire (15 minutes for a code, 24 hours for a link).
Sessions — deleted once they expire, a year after you signed in on that device. Using Rep does not extend it; after a year you sign in again.
Messages we sent you — after 30 days we delete what the message said and the address it went to, and keep only that it was sent, when, and whether it arrived.
An account started but never confirmed — deleted after 7 days, along with anything recorded with it.
An ad-free pass — that your household paid, how much and until when is kept for six years, because tax law requires it. It stays if you delete your account, and names the household, not you.
A request to be told when Rep reaches you — kept until we reach you or you ask us to remove it, whichever comes first.

Backups. The database is copied to encrypted, private storage once a night and each copy is kept for a year. So for up to a year after something is deleted here, a copy of it still exists in a backup. We do not use backups to answer questions about you, and a backup is only ever opened to restore the service after a failure — at which point anything you deleted is deleted again. Everything above is about the live service; this is the one place the timings do not hold.

You can download everything we hold about you, and delete your account, from Settings — no need to ask us. When you delete your account, your name, contact details, sign-in history and verification readings are erased; recommendations you made stay on the street's record with nothing on them that identifies you. If you want a recommendation off the record too, withdraw it before you delete your account.

8. Your rights

Under UK GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to processing, and take your data elsewhere. Copies and deletion are in Settings and take effect immediately; for anything else write to privacy@nule.ai and we respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

9. Cookies and analytics

Always on: one session cookie, so you stay signed in. It lasts a year and is strictly necessary, so it needs no consent. If you arrive through a shared link we note that in your session so we can tell which shares are working; that is not a separate cookie and is never passed to anyone else. Your answer to the question below, and a couple of preferences (whether you dismissed the add-to-home-screen prompt), are kept in your browser's own storage, not in a cookie.

Only if you say yes: Google Analytics, so we can see which pages help and which do not. We ask before anything loads — decline and no request is made to Google and no analytics cookie is set. You can change your mind by clearing this site's data in your browser, which brings the question back.

When you do say yes, the page address we send is stripped of identifiers first: a visit to an ask is reported as /ask/:id and a business page as /business/:id, never the real one. Google is told which kinds of page get used, never which household or which business. Your IP address is anonymised. We do not build profiles and nothing about you is shared with advertisers.

Also only if you say yes: the Google advert on a household's three home pages. Google may set its own advertising cookies for it. Decline and the space stays empty and nothing is requested from Google. A household with the ad-free pass, and anyone whose business is on Nule, is never shown the advert at all.

10. Children

Nule Rep is for adults. We do not knowingly collect data from anyone under 18.

11. Changes

We will post changes here and, for significant changes, tell you by email.

12. Contact

Nule Limited · privacy@nule.ai · support@nule.ai