Privacy Notice

Who’s looking after your data

Orlando Obsessed is operated by Orlando Obsessed Ltd, a private limited company incorporated in England and Wales, Companies House number 14800946. For the purposes of UK GDPR, Orlando Obsessed Ltd is the data controller for the information described in this notice. Our registered office is the address shown in the footer below.

For anything to do with data protection, privacy or your data rights, email us at privacy@orlandoobsessed.com. For general questions, use hello@orlandoobsessed.com.

We are not legally required to appoint a Data Protection Officer, and we have not appointed one. Privacy queries are handled by us directly at privacy@orlandoobsessed.com.

Where we are right now

Orlando Obsessed is in a pre-launch, coming-soon phase. The only thing live today is the mailing-list signup. Accounts, member profiles, posts, friends, saved trips and AI Quick Plans are still in development and are not yet open to the public. You cannot create an account today.

So this notice has two parts. First, what happens now when you join the mailing list. Second, how the full service will handle your data once accounts open. Everything in the “full service” sections below applies only once accounts open, not today.

Marketing emails and the mailing list

If you join our mailing list from the coming-soon page, here is exactly what that involves. Joining the list does not create an account, and it is the only personal data we process from the public at this stage.

• What we collect: your first name, last name and email address, plus the timestamp of your signup and the exact version of the consent wording you agreed to.
• Why we use it: to send you launch news and an early-access invite for Orlando Obsessed. Nothing else. We never sell your details and never use them for anything other than the launch updates you signed up for.
• Lawful basis: your explicit, opt-in consent under Article 6(1)(a) of the UK GDPR. You give it yourself, by ticking a single dedicated box that is never pre-ticked and never switched on by default. The consent record we store is our evidence that you agreed.
• How long we keep it: until you unsubscribe or ask us to delete it.
• Who handles it: Supabase stores the list in its London (eu-west-2) region. When we begin sending, Resend will deliver the emails. The sign-in providers and the AI provider described further down do not touch a mailing-list signup at all.
• Withdrawing consent: you can withdraw your consent and unsubscribe at any time, as easily as you gave it, using the link in every email we send or by contacting us. Withdrawing stops all future marketing. It does not affect anything we lawfully did before you withdrew.

We hold ourselves to a clear standard for this. We use a single, separate, unticked opt-in box specifically for receiving launch marketing email from Orlando Obsessed Ltd. We never pre-tick it or default it on. The consent is freely given, specific, informed and unambiguous, given by a clear affirmative action, and it names both the organisation (Orlando Obsessed Ltd) and the channel (email marketing). We do not bundle it with our terms or with the act of signing up, and ticking it is never a condition of anything. The purpose, launch news and an early-access invite, is stated right next to the field.

When you submit the form, we capture and store the consent record: who consented (your email), your first and last name, the timestamp, the form or source identifier, and the exact version of the consent wording shown. This lets us demonstrate the list is valid and action withdrawals properly. Every marketing email we send clearly identifies the sender as Orlando Obsessed Ltd and never disguises or conceals who is sending it. Every email carries a valid, simple, free unsubscribe route, which we honour promptly; you never need to log in or pay to unsubscribe.

This email opt-in is governed by the direct-marketing rules and is entirely separate from cookie consent. For how we use cookies and similar storage, see our Cookies Policy.

The full service, once accounts open

When the community and trip-planning app opens, it will process more data so that it can actually work for you. The sections below describe that future processing. None of it is happening yet.

Once accounts open, we will use your data to:

• create your account and sign you in;
• build and show your member profile, subject to the privacy controls you choose;
• run the social and community features (posts, comments, friends);
• let you plan and save trips;
• generate AI Quick Plans from the inputs you give us;
• personalise your experience;
• keep the service secure and reliable; and
• send you service communications about your account.

We rely on different lawful bases depending on what we are doing:

• Consent (Article 6(1)(a)): where we ask for it, for example optional marketing or features you switch on. You can withdraw it at any time.
• Contract (Article 6(1)(b)): to deliver the account and the features you ask us for, such as signing you in, showing your profile and generating a Quick Plan you request.
• Legitimate interests (Article 6(1)(f)): to keep the service secure, prevent fraud and abuse, keep it reliable, and understand aggregate usage so we can improve it. Our interests here are running a safe, working, trustworthy service for our members.

What the full service will collect

Once accounts open, the categories of data we expect to hold are:

• Your details: name, email address, preferred name, handle, and your UK city or location.
• Date of birth: kept private and never shown to other members.
• Images: your profile picture and cover photo.
• Onboarding answers:the “How I do Orlando” preferences you give when setting up.
• What you create: posts, comments, photo uploads, Quick Plans and saved trip information.
• Technical metadata: IP address, browser type and general device information, used for security and to keep the service reliable.

Who helps us run things

We use a small set of trusted infrastructure providers. The mailing list today touches only Supabase and Resend. The rest come into play once the full service opens.

• Supabase: database, file storage and authentication. Our project is hosted in the London (eu-west-2) region.
• Vercel: hosts the website and runs our serverless functions, on a global edge network.
• Apple and Google: sign-in providers, for the full app only. They handle the password side of authentication.
• Anthropic (Claude API): used server-side to generate Quick Plans, for the full app only. The prompts and generated plans pass through Anthropic, and under its API terms Anthropic does not use data submitted via the API to train its models.
• Resend: delivers our email, both the mailing-list emails and, later, transactional account email.

Where your data is processed

We process data in the UK and the EEA where we can. Some providers, namely Anthropic and Resend, may process data in the United States. Where data leaves the UK, the transfer relies on appropriate safeguards, such as standard contractual clauses, the UK Addendum, or adequacy where it applies. If you would like detail on the safeguards for a particular transfer, email us at privacy@orlandoobsessed.com and we will explain.

How long we keep it

• Mailing list: kept until you unsubscribe or ask us to delete it.
• Account data: kept for as long as your account is active.
• After you delete your account: we delete your profile, your saved plans and any content you posted, usually within 30 days.
• Longer where required: some records may be retained for longer where the law requires us to keep them, or for as long as we may need them to establish, exercise or defend legal claims.

Do you have to give us your data

Giving us your email for the mailing list is entirely voluntary. Without it, we simply cannot send you the newsletter. Once accounts open, certain data is needed to create and run your account, for example a name and email and the basics of a profile; without those we cannot provide the account or the features you ask for.

Automated decisions

We do not make any decisions about you by solely automated means that produce legal effects or similarly significant effects. AI Quick Plans, when they launch, generate trip suggestions from the inputs you give us; they do not make decisions of that kind about you, and a Quick Plan is always something you choose to use or ignore. The “personalise your experience” purpose above tailors what you see; it does not amount to profiling that has a legal or similarly significant effect on you.

Data we may receive about you

Today we only collect the mailing-list details you give us directly. Once the full app opens, some data may reach us from sources other than you, for example your name and email from an Apple or Google sign-in, or details that arise through friend connections. When that begins, we will set out here the categories of personal data we hold from those sources and where each one came from.

Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data erased;
• restrict how we process your data;
• receive your data in a portable format;
• object to certain kinds of processing.

Some of these rights apply only when we rely on a particular lawful basis, so they will not always be available in every case. Wherever we rely on your consent, including the mailing list, you can withdraw it at any time, as easily as you gave it, using the unsubscribe link in every email or, once accounts open, an account setting.

To exercise any of these rights, email privacy@orlandoobsessed.com. If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.

Cookies

We keep cookies and similar storage to the minimum needed to make the site work. For the full detail of what is stored on your device and why, see our Cookies Policy. Cookie consent is separate from the marketing-email consent described above.

How and when we tell you this

We give you this notice at the point we collect your data: it is linked right at the signup form. We have written it in concise, plain English, and we will tell you before we ever start using your data for a new purpose.

Changes to this notice

We may update this notice from time to time. We will flag material changes on the site, and where a change affects data you have already given us, we will ask you to accept the new version.