Privacy Notice

Who we are

Excelland is run by Hikari Estates Ltd, registered in England and Wales, company number 16683087. We are the data controller for everything below, and we are registered with the Information Commissioner’s Office under reference ZC016970.

Questions, requests or complaints: nt@hikariestates.co.uk. If we get it wrong you can complain to the ICO (ico.org.uk) — but please tell us first, so we can put it right.

What we collect, and why

• Your account — name, email address, and your password stored scrambled (hashed), never readable. Needed to provide the service and to contact you about your account. New passwords are checked against known breach lists via Have I Been Pwned — only a partial fingerprint is sent, never the password.
• Sign-in activity — when and how often you sign in. Visible only to the administrator, used to run the beta. We do not analyse what you do page by page.
• What you save — saved sites, tags and notes, and the assessment shown when you saved them. Other Excelland users cannot see any of it. The administrator can see how many sites and notes an account has, and can delete a saved site.
• What you search and look at — to answer a search or assess a point we send that text or those coordinates to the data services listed below. We keep the answers in a cache, held by location or by company number, not linked to you or your account.
• Company directors — where a landowner is a company, we look it up in the public Companies House register and show its current directors' names and roles, keeping a copy so we do not ask twice. If you are named there: we did not get your details from you, we got them from that public register, and you can email us to see what we hold or to object.
• Messages you send us — through the Help form, emailed to our mailbox so we can reply. If that email fails to send, the message is written to our server log so it is not lost.
• Technical records — your IP address limits repeated sign-in and password-reset attempts, held in memory only, never in the database. A refused sign-in is also noted in the server journal with the address it came from, and nothing else, so an address that keeps trying can be blocked at the firewall; those lines are kept for up to 30 days. Our servers keep no web access logs: the application log records errors and warnings (a failed email, for instance), not who visited which page.

We do not use analytics or advertising trackers, we do not profile you, and we never sell your data or hand it to anyone for their own marketing.

Why we're allowed to

Running your account, showing you sites and sending you account email is us doing what we agreed when you signed up (contract).

Keeping sign-in records, limiting attempts by IP address, keeping backups and checking new passwords against breach lists is us running a small service safely (legitimate interests — ours in keeping it working, yours in it not being broken into). Showing directors from the Companies House register serves the legitimate interest of anyone researching who owns a piece of land. You can object to any of these by emailing us.

Who else sees it

Excelland is built on public data services, so using it means asking them questions.

Services our server asks — they see us, not you. OpenStreetMap Nominatim and postcodes.io (what you type into search), PlanIt (planning applications near a point), planning.data.gov.uk (constraints), Mapillary, part of Meta (street-level photos), data.police.uk (crime figures), the government EPC service, Companies House (landowner and director details), and Have I Been Pwned (when you choose a password).

Services your browser loads — these also see your IP address. CARTO and OpenStreetMap (map tiles), Esri (satellite imagery), and Google only after you choose to show Street View, whose panel then carries the coordinates of the site you are viewing.

Suppliers who work for us, on our instructions and under contract: Hetzner (servers and backups), Cloudflare (answers the internet's lookups of our domain name; your requests do not pass through it, so it does not see them or your IP address), and Zoho Mail (sends our email).

We update this list when we add a service.

Where it lives

Our servers are in Germany. Encrypted copies of the database are kept elsewhere in the EU so the service can be brought back after a failure. Those backups are encrypted with a key held separately, and we open one only to restore the service — never to look something up.

Some things necessarily happen outside that. Where personal data leaves the UK to a supplier who works for us, the transfer rests on safeguards the ICO recognises: the UK's adequacy regulations, which cover the EU where those suppliers are, and our contracts with them. The data services listed above are different. We have no contract with them: the ones your browser loads see your IP address directly, the ones our server asks see our server, and all of them answer from wherever they are based, including outside the UK and the EU, under their own privacy notices.

Email we send you

About your account: confirming your address, approving your account, password resets, and a notice whenever your password changes — that last one is how you would find out if somebody else changed it.

The weekly planning digest: if you have saved sites, we email you once a week when a new planning application appears near one. It is part of the service rather than marketing — you get it because you saved a site — and it goes only to accounts that can sign in. To stop it, email us and we will switch it off for your account, or remove your saved sites.

Cookies

One cookie of ours, strictly necessary: it keeps you signed in for up to 7 days. We set nothing else and use no tracking cookies. The Google Street View panel, which loads only after you choose to show it, is Google's own frame with its own storage — that is not ours, and it is not used to advertise to you.

How long we keep it

• Your account and what you save — while your account exists. If we switch an account off, we keep the row so the decision can be reversed; ask us to erase it instead and we will. If you delete it yourself, everything goes 14 days later.
• A record that we deleted you — kept indefinitely, on purpose. It is a one-way fingerprint of your email address and the date, and nothing else: it cannot be read back as your address, and it is not used to contact you or to recognise you if you return. It exists so that restoring a backup cannot quietly bring your account back.
• Sign-in history — for the life of the beta, so we can see the service is being used.
• Data caches, including company directors — up to 90 days, then deleted whether or not anyone looks again.
• Links we email you, to confirm your address, reset your password or close your account: each works once and expires within a day, and our record of it is deleted 30 days after it expires.
• Messages you send us — in our mailbox while the conversation may still matter.
• Backups — see the ceiling below.

Your rights

You can delete your account yourself, from the Account page — you do not have to ask us. We check it is you (your password, and a link we email you), then wait 14 days before anything is deleted, so a mistake or someone else acting in your name can still be undone by signing in. After that your account, your saved sites and your notes are gone, and we email you to say so.

You can also ask us at any time to show you what we hold, correct it, delete your account and everything in it, pause our use of it while a disagreement is sorted out, or send you a copy to take elsewhere. You can object to the uses we base on legitimate interests, listed above. Email nt@hikariestates.co.uk and we'll act within a month.

When we delete something it goes from the live service straight away. A copy can remain in our encrypted backups for up to three months, after which it is destroyed automatically. Those backups are only ever used to bring the service back after a failure — we do not read them, and we do not restore from them to answer questions about you. If we ever do restore one, re-applying every erasure is a required step before the service goes back online.

No decision about you is made automatically. Excelland scores land, not people.

If we change how we handle your data, we change this page and the date at the top in the same release.