Privacy notice
What personal information Public Trust collects, why, how long it keeps it, and your rights.
Who we are
Public Trust ("we") is an independent website. We're responsible for the personal information described here. You can reach us through the contact page.
What we collect and why
If you rate a service or ask us to add a council
- Your email address, so we can send you a sign-in code and you can see or withdraw your ratings. It's stored encrypted.
- Your answers, the year or years your experience covered (or just "before 2020"), your relationship to the service (for example, a parent), and the declarations you make. There's no free text.
- A worker's name and registration number, only if you choose to give them. They're stored encrypted, seen only by our staff, and never published.
- Sign-in codes, stored scrambled so even we can't read them. Each one stops working after 15 minutes.
When you use the site
- Three cookies that the site needs to work and stay safe. The cookies page explains them.
- A scrambled version of your IP address, kept for a short time to stop abuse such as repeated sign-in attempts. Our sessions don't record your IP address or device.
- If someone tries to use an email address we don't accept, such as a council's, a scrambled version of the network address (IP address) it came from, and the part of the address after the @. Ratings sent from that network for the next 30 days are checked more closely.
- Error logs and performance records, which help us fix problems. They don't record who was using the site.
If you support us
You give through Buy Me a Coffee, on their own site and under their privacy policy. They take the payment, so we never see your card details. They tell us the amount and whatever you choose to give them, such as your name, email address and a message. We use it only to keep a record of support, never to contact you about anything else.
We don't use analytics or advertising cookies, and we never sell your information or use it for marketing.
What's shown publicly
Combined results for each service: its score, and its result for each question once at least 3 people have answered it. Nothing shows who gave a rating, and your email address and any worker you name are never shown. While a service has only a few ratings, its score is steadied towards the middle, so it doesn't simply repeat one person's answers.
Why we're allowed to use it
We rely on legitimate interests: giving families a fair, independent way to share their experience of council services, checking that ratings are genuine, and keeping the site secure. We only collect what we need for that, and we've weighed it against your privacy.
Who we share it with
- The companies that run the site for us, who handle your information only on our instructions: Laravel Cloud, which hosts the site and its database; Resend, which sends our emails; and Cloudflare, which delivers the site, protects it from attacks and passes on emails sent to us.
- We never give your details to the council you rated, an inspectorate or a regulator, unless the law requires it.
- If something you send us suggests a child is at risk, we may pass it to the council's children's social care team or the police.
Your information is stored in the UK and the European Union.
How long we keep it
- An account whose email was never confirmed: deleted after a day.
- Sign-in codes: deleted a day after they stop working.
- The network a refused email address came from: deleted after 30 days.
- Worker names and registration numbers: deleted after 24 months.
- Your account and ratings: while your ratings are part of a service's results. You can withdraw a rating, or delete your whole account, at any time from your account page. A deleted account's ratings are withdrawn first, and kept only as withdrawn records that don't say whose they were.
- Error logs: 14 days. Performance records: 7 days.
When we delete something, we keep a note that it was deleted and when, but not the information itself. Deleted information can stay in our backups for up to 7 days, until they're replaced, and is then gone for good.
Your rights
You can delete your account yourself, from your account page. You can also ask us for a copy of your information, to correct it, to delete it, or to stop or limit how we use it. Contact us, and we'll reply within one month.
If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.