From Here
Back to map

Privacy Policy

Last updated 24 February 2026

From Here is a map-based platform that connects local businesses, artists, makers, photographers, performers and venues to each other and to the people who want to find them. This policy explains what we collect, why, how long we keep it, and the rights you have.

1. Who we are

From Here is operated by From Here, contactable at contact@fromhere.global.

Registered office:
Office 1843
3 Fitzroy Place, 1/1
Sauchiehall Street
Finnieston
Glasgow Central, G3 7RH
United Kingdom

Data protection contact: the same address or email above.

2. What we collect

Account data

  • Your name, email address, role (Explorer / Creator / Space / Performer / Photographer / Seller)
  • A hashed password (bcrypt — we never see the plaintext)
  • Optional profile picture
  • Google sign-in identifier if you use Google auth
  • Every successful sign-in is recorded with the IP address you signed in from, a truncated user-agent string, and a timestamp. You can view your own recent sign-ins from Dashboard → Security.

Location data

  • An optional Home pin (approximate address + latitude/longitude + a radius) that you set yourself.
  • Live device location only when you tap "From me" — it's sent to the map, never stored.
  • Locations of pins you drop on the map (Scout / Explore trips) are saved to your account and fully purged when you delete it.
  • The pinned location of each photo, listing or gig you publish.
  • Pin privacy mode. Sellers who don't want their exact location shown pick one of three modes on each listing: exact (renders at the true coordinates), fuzzy (renders at a deterministic offset inside a 500 m – 5 km radius; true coordinates are stored server-side but never emitted publicly), or hidden (omitted from public map responses entirely).

Contact data (only when you provide it)

  • If you add a phone number or email address to a pin's Contact card, you also choose whether that field is visible to anyone, members only, or hidden. We honour that setting on every read.

Content you post

  • Listings, product descriptions, prices, opening hours, menus, gallery photos, recurring What's-On events.
  • Photos and their titles, descriptions, tags. GPS metadata is stripped from uploads on our servers before storage.
  • Gigs, RSVPs, reviews, follows and hearts.
  • Trip notes attached to saved places.

Payment data

  • Card details are handled directly by Stripe — we never see or store them.
  • We keep an order record (items, totals, platform fee, seller net, shipping / collection details, redeem code where applicable). Retained for as long as tax law requires (typically 6–7 years).

Technical data

  • Three first-party cookies as listed in §7 below.
  • PostHog product analytics — see §4. This captures page views, clicks, and (in some flows) session recordings, so we can see which features people use and where they get stuck.
  • Server-side error logs and rate-limit counters kept for a rolling 30-day window to help us debug issues and spot abuse.

3. Why we use it

  • To operate the map, the marketplace and the community features you signed up for.
  • To send transactional emails (password reset, gig confirmation, order updates).
  • To keep the service safe (rate-limiting sign-ins, spotting abuse).
  • To comply with tax and accounting law for any purchase you make.

We do not sell your data. We do not run ad networks. We do not track you across other websites.

4. Third parties we share with

The processors below are the only outside services that receive data about you.

  • Stripe — payment processing. Your card details go directly to Stripe and never touch our servers. See Stripe's privacy notice.
  • PostHog — product analytics. PostHog is a US-hosted service that captures page views, click events and (in some flows) session recordings so we can improve the product. We do not sell this data and it is not used for advertising. Because PostHog is currently hosted in the United States, this involves an international data transfer — see §11 below.
  • Emergent Object Storage — hosts any image or file you upload (profile pictures, pin cover images, gallery photos, product images, gig posters).
  • OpenStreetMap / Nominatim — map tiles and geocoding. When your browser loads the map, it fetches tile images directly from OpenStreetMap's CDN, which involves your IP address being visible to OSM. Any place-search or reverse-geocoding query is routed through our servers so your IP is not exposed for that.
  • Google — only if you sign in with Google (we receive your email address and profile picture).
  • Resend — transactional email delivery (when configured). We share only the email address and message content.

We do not sell your data. We do not run ad networks. We do not embed Facebook, Google Ads, TikTok or any cross-site tracking pixels.

5. How long we keep it

  • Password reset tokens: 1 hour, then invalidated.
  • User session cookies: 30 days rolling.
  • Sign-in event log (IP + user-agent per successful login): retained for 12 months, then automatically purged.
  • Uploaded images and files: retained while your account is active. On account deletion, images are removed from Emergent Object Storage within 30 days.
  • Account and content: for as long as your account is active.
  • Deleted accounts: personal data is cleared immediately (scout trips fully purged, author names anonymised), and the residual shell is removed after a 30-day grace period. Order records associated with your account are retained for as long as tax law requires (typically 6–7 years) but stripped of everything not required for the tax record.
  • Invite codes you have used: retained indefinitely for anti-abuse tracing (they contain no personal data beyond the fact that a code was consumed by an account you created).
  • PostHog analytics events: subject to PostHog's own retention rules; you can request deletion of your PostHog data at any time via the contact address below.

6. Your rights

If you are in the UK / EU (or California, or other jurisdictions with equivalent rules) you can:

  • Download your data at any time from Dashboard → Privacy → Download my data.
  • Delete your account from Dashboard → Privacy → Delete my account. Personal data is wiped immediately; the shell is purged after 30 days.
  • Correct anything wrong — edit your profile, or email us.
  • Withdraw location consent — clear your Home pin at any time.
  • Complain — you can contact your national data protection authority (in the UK, the ICO).

7b. Platform fees (for context)

Selling on From Here costs a flat 9% all-in per completed sale, which includes Stripe payment processing. You keep 91%. There is no monthly fee, no setup fee, and no cap.

7. Cookies

We use the following first-party cookies. All are marked HttpOnly and Secure, so JavaScript cannot read them.

  • access_token — keeps you signed in. Expires after 30 days.
  • session_token — used only for the OAuth (Google sign-in) exchange. Session-only.
  • admin_access_token — set only while an administrator is impersonating an account for support purposes, so we can safely exit impersonation. Session-only.

We also use browser localStorage on your own device — cart contents, map layer preferences, filter chips, and the onboarding progress flag. This data lives on your device and is not transmitted to our servers.

Analytics: PostHog (see §4) sets its own cookies for product analytics. We treat this as legitimate-interest product improvement — not advertising — and analytics collection is a condition of using the platform. You retain all of your rights under UK GDPR (see §§5-6), including the right to request erasure of your data via the contact address in §10.

8. Children

From Here is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has signed up, please email us and we will delete the account.

9. Changes to this policy

If we materially change how we handle your data we'll email you and post the updated version at least 14 days before it takes effect.

10. Contact

Questions or requests: contact@fromhere.global. See also our Terms of Service and Community Guidelines.

11. International data transfers

One of our processors — PostHog — is hosted in the United States. When you use the platform, a limited set of product-analytics events (page views, clicks, occasional session recordings) is transferred from the UK / EU to the US. We rely on the UK & EU Standard Contractual Clauses for that transfer, together with PostHog's own supplementary technical measures.

All other processing takes place inside the UK / EU. Card processing is handled by Stripe under their own UK / EU data-residency terms.

12. What we do NOT collect

For clarity, and to help you evaluate what we hold, we do not collect:

  • Your date of birth.
  • Any government-issued ID.
  • A phone number (unless you voluntarily add one to a pin's Contact card).
  • Credit card details — Stripe holds these, we never see them.
  • Health, biometric, genetic or other special-category data.
  • Political, religious or trade-union affiliation.
  • Facebook, Google Ads, TikTok or any other cross-site tracking pixel.
Just so you know

From Here uses one essential cookie to keep you signed in, plus product analytics (PostHog) to improve the app. No ads, ever. See our Privacy Policy.