What we collect, and what we don’t

Last updated 6 August 2026

Who we are

South House is a trading name of Scale Up Ltd, a company registered in England and Wales (company number 11359363), whose registered office is 3 Totman Crescent, Rayleigh, Essex, SS6 7UY.

Scale Up Ltd is the data controller for this website — meaning we decide what personal data is collected here and why. For anything in this policy, including any request about your own data, contact Matthew Baker:

• Email matthew@southhouse.io
• Phone 07976 945221

We are not required to appoint a Data Protection Officer, and have not appointed one. Matthew is the person who handles these requests.

The short version

• Until you choose “Accept” on the cookie banner, this site sets no cookies at all and runs no analytics.
• If you accept, Google Analytics 4 measures which pages get read. It is configured so that advertising and personalisation features stay switched off permanently — accepting analytics never turns on ad tracking here.
• Detailed analytics data is deleted automatically 14 months after your most recent visit, and the cookies on your own device expire sooner still, at 400 days. Aggregated, non-identifying totals are kept indefinitely — the detail is below, because one number alone would not be honest.
• If you send us an enquiry, we use it to reply to you and nothing else. We do not sell it, share it for marketing, or add you to a mailing list.
• You can withdraw consent whenever you like — “Cookie choices” at the bottom of every page reopens the banner.

Cookies and similar storage

Under the UK’s Privacy and Electronic Communications Regulations, nothing non-essential may be stored on or read from your device without your agreement. This site is built so that rule holds on the very first page load: the analytics tag starts in a denied state written into the page itself, before Google’s script has a chance to run. Declining is not an undo — the cookies are never set in the first place.

Before you choose anything

One item is stored, and only after you answer the banner: your answer itself.

Remembering that you said no is treated as strictly necessary — a site is allowed to remember a refusal without asking permission to remember it. We deliberately keep it in local storage rather than a cookie, which means it stays on your device and is never transmitted with requests to our server. It contains one word: “granted” or “denied”. It identifies nothing about you.

If you accept analytics

Google Analytics then sets two first-party cookies on southhouse.io:

Both are first-party: they are readable only by southhouse.io, and cannot be used to follow you to other websites.

Google’s own default for these is two years. We have shortened them to 400 days, so that the identifier expires inside the window of the data it identifies rather than lingering after it — see how long it is kept. Like the data, the clock restarts each visit. Four hundred days rather than a round fourteen months because that is the ceiling browsers enforce: Chrome and Firefox shorten any cookie written this way to 400 days no matter what a site asks for, and Safari routinely cuts it to a few days. So this is the longest these can survive, and for many people they will vanish sooner.

Changing your mind

Select Cookie choices in the footer of any page. The banner reopens and your new answer takes effect immediately — choosing “Decline” after having accepted stops any further data being sent. Withdrawing is deliberately no harder than agreeing was.

Clearing the cookies already set is done in your browser, which we cannot do for you. You can also block or delete cookies for any site through your browser settings, and install Google’s browser add-on to opt out of Google Analytics everywhere at once.

Google Analytics in detail

We use Google Analytics 4 to understand which pages guests and owners actually find useful — which homes get looked at, which guides get read, whether people find what they came for. It is the only analytics tool on this site.

What it records

• Pages you view, and in what order
• How you arrived — a search engine, a link from another site, or directly
• Approximate location, derived from your IP address. In practice this is city-level at best, and often less precise
• Device information: whether you are on mobile or desktop, browser, operating system, screen size and language
• How long you spend on a page, and whether you have visited before
• Some interactions Google measures automatically: how far down a page you scroll, clicks on links leading off this site, and file downloads

It does not record your name, your email address, or anything you type into a form on this site. We have not enabled any feature that would connect analytics data to an identifiable person, and we do not upload customer data to Google.

IP addresses

Your IP address is used by Google to work out that approximate location, and is then discarded. Google Analytics 4 does not log or store IP addresses. For traffic from the UK and Europe, that step happens on European servers before the data is passed on.

How long it is kept

“Fourteen months” is the figure usually quoted for Google Analytics, and on its own it would be misleading, because two separate clocks are running. Both, in full:

• Anything that identifies a browser — at most 14 months from your most recent visit. Individual events and user-level records held by Google are deleted on that schedule. The cookies in your own browser go sooner, at 400 days, which is deliberate: the identifier expires inside the life of the data it identifies, so nothing is left pointing at a record that has already gone. Note the “from your most recent visit” — both clocks restart each time you come back, so a guest who returns every summer never ages out. It is 14 months of inactivity, not 14 months flat.
• Aggregated reports — kept indefinitely. Totals of the “how many people read this page in March” kind sit outside that limit and are retained by Google with no expiry. They contain no individual-level data and cannot be traced back to a person, which is why they are treated differently — but they do mean 2026’s year-on-year figures will still exist years from now.

Fourteen months is the shortest of Google’s options that still allows one season to be compared against the same season a year earlier, which is the only reason we look at any of this. We have chosen it deliberately over the longer settings available, and shortened the cookies from Google’s two-year default so they expire first. You can delete them yourself at any time, and declining on the banner means they are never created.

Advertising features are off

Google’s tag supports several categories of storage. This site grants exactly one of them, and only with your consent:

• Analytics storage — denied until you accept, granted afterwards
• Advertising storage, advertising user data and ad personalisation — denied always. Accepting on the banner does not turn these on. There is no path through this website that enables them

So there is no remarketing, no advertising audience building, and no sharing of your behaviour with Google’s advertising products.

Google as a processor, and transfers abroad

Google Ireland Limited processes this data on our instructions under Google’s data processing terms. Doing so may involve transferring data to servers outside the UK, including the United States. Google relies on the UK Extension to the EU–US Data Privacy Framework and on standard contractual clauses to make those transfers lawful. Google’s own explanation is in its privacy policy, and there is a dedicated page on how Google handles data in its business products.

When you contact us

The contact form, the enquiry forms on the owner pages, and the Performance Review form all do the same thing: they send us an email. There is no database, no CRM, and no marketing platform behind them.

What you give us

From the contact and enquiry forms: your name, your email address, your phone number if you choose to add one (it is optional), and whatever you write in the message.

The Performance Review form asks for more, because the answer depends on it: the location of your property, a link to your existing listing if you have one, how you would describe your current position, what you would most like to improve, and anything else you want to tell us. Only your name, email and property location are required.

Where it goes

• The submission is sent as an email through Resend, an email delivery service acting as our processor, on European infrastructure
• It arrives in a South House mailbox hosted on Google Workspace, and is read by Matthew
• We reply to you directly. That is the entire purpose — enquiries are not passed to anyone else, sold, or used to build a marketing list

How long we keep it

Enquiries that do not lead to a booking or a working relationship are deleted within 24 months. Where an enquiry does become a booking or an ongoing arrangement, the correspondence is kept for as long as that relationship lasts, and afterwards for six years where it forms part of a record we are required to retain for tax or accounting purposes.

If you would rather we deleted your enquiry sooner, ask — see Your rights below. We will do it.

The hidden field

Each form contains a field that is hidden from view and left empty by real visitors. Automated spam scripts fill it in, which is how we identify and discard them. It collects nothing about you, and if you are using a screen reader or have styling disabled, simply leave the field marked “Website” blank.

Booking a stay

Bookings and payments do not happen on this website. When you select a home and continue to book, you leave southhouse.io for our booking engine, run by Guesty on southhouse.guestybookings.com.

From that point the booking engine’s own privacy notice and cookie practices apply in addition to this one, and they are not under our control. We never see or handle your card details on this site.

The one place this site talks to Guesty directly is the availability search: our server asks Guesty which dates are free and shows you the answer. That request carries the dates and the property, nothing about you, and it is read-only.

Hosting and server logs

This site is hosted by Vercel, which acts as our processor. Like any web host, Vercel’s servers automatically log requests — including IP address, the page requested, timestamp, and browser user agent. These logs exist to keep the site running and to deal with abuse or attacks; they are held briefly, are not used to build any profile of you, and are not combined with analytics data.

Two small things worth noting, because generic policies usually get them wrong. The typefaces used here are served from our own domain rather than fetched from Google Fonts, so displaying this page sends nothing to Google. And the WhatsApp button is an ordinary link — nothing loads from Meta unless you select it, at which point you are in WhatsApp and Meta’s policies apply.

What we do not do

• We do not sell or rent personal data. There is no circumstance in which we would
• We do not run advertising, retargeting or conversion pixels on this site
• There are no social media tracking pixels — no Meta pixel, no LinkedIn insight tag, no TikTok pixel
• We do not make automated decisions about you, and we do not profile you
• We do not add you to a mailing list because you sent an enquiry. If we ever start a newsletter, you will have to ask for it

Lawful bases

UK GDPR requires us to name a lawful basis for each use of your data. Ours are:

Your rights

Under UK data protection law you have the right to:

• Ask what personal data we hold about you, and get a copy
• Have inaccurate data corrected
• Ask us to delete it
• Ask us to restrict how we use it
• Object to us using it on the basis of legitimate interests
• Receive data you gave us in a portable form
• Withdraw consent at any time, without that affecting anything done before you withdrew it

To exercise any of these, email matthew@southhouse.io. There is no charge, and we will respond within one month. We may need to confirm who you are first — usually just replying from the address you originally wrote from is enough.

If you are unhappy with how we have handled your data, please tell us so we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to raise it with us first.

Changes to this policy

If we change how this site handles data, this page changes with it, and the date at the top is updated. If a change is significant — a new tool, a new purpose, anything requiring fresh consent — we will ask again rather than rely on you re-reading this page.

Questions about any of the above are welcome. Email matthew@southhouse.io or use the contact form.