Last updated: 14 Aug 2026
heardhere ("we", "us", "our") operates solar and 4G-powered nature monitoring stations that detect birds, bats, and weather conditions, and publishes the results on a public website for each station. This policy explains what personal data we collect, why, and what your rights are.
We're based in Cumbria, UK. You can reach us at hello@heardhere.uk.
If you create an owner account (as a station owner or team member invited by one), we collect your email address and a securely hashed password. We never store your password in plain text.
If you own or manage a station, we hold the details you or we provide about it: site name, description, location (coordinates and what3words), which sensors are enabled, and an optional public contact email.
Where a station's owner has switched this on, that station's public page offers a form for anyone — not just the owner — to sign up for the same weekly digest email the owner can receive. If you use it, we collect the email address you enter and which station it's for. Nothing is added to any send list, and no email sent to that address, until you click a confirmation link we send to it first; every weekly email you receive as a result includes a one-click unsubscribe link. This is a separate list from any station's own owner contact email, and we have no other information about you unless you separately hold an account.
Each station uploads bird and bat species detections (species name, confidence score, timestamp) and, where a weather sensor is fitted or a forecast fallback is used, weather readings. This data is not personal data about you, but is core to the service.
Each station identifies species by listening — a bird microphone by day, an ultrasonic bat detector by night. Only the result of that listening (species name, a confidence score, and a timestamp) is ever uploaded to heardhere or shown anywhere, including to the station's own owner. The recorded audio itself is never uploaded, never stored on our servers, and never played back anywhere on the site, the owner dashboard, or the on-site kiosk display — this was previously possible for a short-lived "species recordings" feature, which has been removed entirely.
We take this seriously because an outdoor microphone can incidentally pick up nearby conversation, not just wildlife. On the device itself, the software briefly holds a short window of raw audio while identifying a species, then automatically discards it — never later than the following day, and typically much sooner. We recommend stations are sited facing away from seating areas, doorways, and other spots where people gather and talk, for exactly this reason.
Each station periodically reports its own operating status — battery level, 4G signal strength, disk space, CPU temperature, and (for 4G-connected units) approximate data usage — so we can monitor the fleet and alert you to problems. This is technical data about the hardware, not about individuals.
Hardware purchases and subscription billing are processed through Stripe, our payment processor. Stripe handles your card details directly — we never receive or store them ourselves. We do receive limited billing metadata from Stripe (such as your subscription status and billing history) to run your account.
We use a single essential session cookie (hh_session) to keep you logged in to your owner dashboard. It's required for the login system to function and isn't used for tracking, analytics, or advertising.
On our public pages (the homepage, the stations directory, and each station's own pages — birds, bats, weather, naturalist notes, camera gallery, kids page, and printable reports), we use Cloudflare Web Analytics to see aggregate traffic: how many people visited, which pages, roughly what device and browser, and where visitors came from. It doesn't use cookies, doesn't collect anything that identifies you personally, and doesn't track you across other websites — Cloudflare's own privacy-first design is why we chose it over a conventional analytics tool. It isn't present on your owner dashboard, the admin panel, the on-site kiosk display, or any account/setup page — those aren't public content, so there's nothing to measure traffic on.
Like most web services, our infrastructure provider (Cloudflare) logs standard technical information for any request — IP address, browser type, timestamp — for security and abuse-prevention purposes.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and running your owner account and dashboard | Account data (email, password hash) | Contract (UK GDPR Art. 6(1)(b)) — necessary to provide the account you've signed up for |
| Publishing your station's public page, or keeping it private | Station data, detections, weather | Contract, carried out on your instruction — you control public vs. private via the privacy toggle |
| Fleet monitoring and fault alerting | Device health data | Legitimate interests (Art. 6(1)(f)) — keeping your paid-for hardware operational; we consider this processing necessary and proportionate, and it's a service outcome you'd reasonably expect |
| Sending transactional emails (welcome, password reset, weekly summary, fault alerts) | Account/contact email | Contract, for account-critical emails (welcome, password reset); legitimate interests, for the optional weekly summary and fault alerts, which you can ask us to stop |
| Generating AI naturalist commentary and reports | Detection and weather data (not personal data) | Contract — only run when you've used the feature; no personal data is sent to the AI provider for this purpose |
| Camera capture alerts — where a station has a camera enabled, each motion-triggered photo/video is relayed by email from the camera to us, screened by an AI model for people or pets, and, if clean, stored and (by default) published on the station's public page | Camera capture image/video, which may incidentally contain images of people | Legitimate interests (Art. 6(1)(f)) — providing the wildlife-camera feature you've enabled; a capture that the screening step flags as containing a person or pet is discarded outright and never stored. You can switch a station's camera gallery to "curated" mode from the owner dashboard to manually review captures before they're published, or disable the camera sensor entirely. |
| Public weekly-update sign-up — sending the weekly digest email to someone other than the station's owner who has separately signed up on the station's public page | Email address, which station it's for | Consent (Art. 6(1)(a)) — unlike the owner's own contact email above, this is a stranger's address with no existing account or contract relationship, so we rely on the confirmation click itself as consent, not on legitimate interests. You can withdraw consent at any time via the unsubscribe link in any email. |
Where we rely on legitimate interests, you can ask us what balancing test we applied, or object to that processing, by emailing hello@heardhere.uk.
We use a small number of third-party providers to run the service. We don't sell your data, and we don't share it with anyone for advertising purposes.
We may also disclose data where required by law, or to protect the rights, safety, or property of heardhere, our users, or the public.
Cloudflare, Stripe, Anthropic, and Resend all process some data outside the UK, principally in the United States. Each relies on a documented transfer mechanism under their own standard data processing agreement:
These are the mechanisms each provider publishes as standard for all customers on their current terms — we have not independently had our specific use of each service reviewed against their DPA, and this section should be checked against whichever version of each provider's DPA is current at the time this policy is relied upon.
Rather than a single blanket period, retention depends on the type of data:
If you're in the UK or EEA, UK GDPR / EU GDPR gives you the right to:
To exercise any of these rights, email hello@heardhere.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
heardhere is a hardware and dashboard service intended for station owners and their invited team members, who we expect to be adults. It is not designed, marketed, or directed at children, and we don't knowingly create an account for, or otherwise knowingly collect personal data from, a child. If you believe a child's personal data has ended up in our systems, contact us at hello@heardhere.uk and we'll delete it promptly.
We take reasonable technical measures to protect your data, including encrypted connections, hashed passwords, and access controls on our infrastructure. No online service can guarantee absolute security, but we treat account and station data with care.
We'll update this page if what we collect or how we use it changes, and update the "last updated" date above. For material changes, we'll aim to notify account holders directly.
Questions about this policy or your data: hello@heardhere.uk.