Privacy notice
What we collect when you send us a story, what we do with it, who sees it, how long we keep it, and your rights.
The short version. We use your details to look at your story, get back to you, write it up and offer it to the press, and pay you if it is published. We do not sell your details or add you to mailing lists. You can ask us to delete your information at any time, apart from payment records the law requires us to keep.
1. Who is responsible for your information
Send My Story (sendmystory.co.uk) (“we”, “us”) is responsible for the personal information described here: we are its controller.
For anything about your personal information, including using any of your rights in section 9, email stories@sendmystory.co.uk.
2. What we collect
When you send us a story
- Your story, typed or as a voice recording, and a written transcript of any recording.
- Your name, how you would like us to contact you, and the phone number or email address for that.
- Your two tick boxes (your agreement to our terms, and your consent for sensitive details), with the date, time and version of the terms you agreed to.
- Technical information sent with the form: your IP address, your browser type, the page you sent it from, and, if you came from an advert, which advert it was and the click reference Facebook added to the link.
If you start the form and leave without sending it, we do not keep what you wrote. For 30 days we keep a note that the form was started, roughly how much was written, which page it was on, which advert (if any) brought you there with Meta’s click and browser references, and your IP address and browser type, so we can see where the form is hard to use. A voice note recorded on a form that was never sent is kept for 7 days so you can come back and send it. Nobody listens to it, and then it is deleted.
Afterwards, if you choose to give it
- Photos, videos and anything else you send us, with any captions, and the town and region you live in.
- What you tell us about your story by message, on a call or by email, including quotes.
- Recordings of our phone calls with you, and written transcripts of them.
- If your story is published, the bank details we need to pay you.
We record our phone calls with you so that your quotes are accurate. We will always tell you at the start of the call. We keep the recording and its written transcript with your story (see section 7).
Sensitive information
Personal stories often include information the law treats as especially sensitive, about you or about other people. It means details about health, relationships and sex life, sexual orientation, religion or beliefs, ethnic background, political views or trade union membership, genetic information (such as a DNA test), and anything about a crime. On our form, these are the “other personal matters” in the second tick box. Only tell us what you are comfortable sharing.
Ticking the second box is your explicit consent for us to use these details about you to write up and offer your story. You can withdraw it at any time (see section 9).
Do you have to give us this?
You do not have to give us any of this. We need your story, your name and one way to reach you before we can look at your story, and your bank details before we can pay you.
3. How we use it, and our legal basis
| What we do | Legal basis |
|---|---|
| Read and assess your story, contact you about it the way you asked, write it up using what you tell us as your quotes, and offer it to journalists and publications with your name and the photos you send us | Our agreement with you, set out in our contributor terms, which you accept with the first tick box |
| Handle sensitive details that are part of your story, such as your health or relationships, or anything about a crime (see section 2) | For details about you: your explicit consent, which you give with the second tick box. For details about other people: the rules in the Data Protection Act 2018 for journalism |
| Record our calls with you, and keep the recordings, messages and notes behind your story, so we can check what you told us and deal with any question, complaint or claim about it | Our legitimate interests in getting your story right, and in dealing with complaints and legal claims |
| Pay you and keep financial records | Our agreement with you, and our legal obligations under tax law |
| Keep the site secure, stop spam and fraud, and keep a record of what was agreed | Our legitimate interests in running a safe and accountable service |
| See where our form is hard to use, from forms that were started but not sent | Our legitimate interests in making the form easier to use |
| Measure which adverts bring in stories, help our adverts reach people with stories newsdesks want, and show our adverts again to people who have visited this site, using Meta’s tools (see adverts) | Our legitimate interests in knowing which adverts work, and in reaching people who have already shown an interest, so we spend less reaching the right people |
We do not make decisions about you by automated means. Voice notes and call recordings are transcribed automatically so that our team can read them, and AI tools help us write stories up, but a person decides what happens to every story.
4. Who we share it with
When we offer your story
- Journalists and publications, in the UK and sometimes in other countries. We share the write-up with your name, and the photos and anything else you send us for your story. We only pass on your contact details if you agree.
- Organisations involved in the coverage, such as an expert or business that comments in the same article, where that is needed to place your story. We share only what is needed. They do not see your story, your name or your photos before journalists do, and we never give them your contact details.
Companies that provide services to us
These companies act on our instructions and are not allowed to use your information for their own purposes:
- Bunny.net (Slovenia; we use its servers in the UK): stores your story and files, and delivers the pages of this website. When it delivers pages, it sees your IP address, but not what you put in the form.
- Hetzner Online (Germany): our own servers, where we keep backup copies of your story and files and run the message system our team uses.
- IDrive (United States): off-site backup copies of our servers.
- Backblaze (a US company; we use its service in the Netherlands): encrypted backup copies of our servers.
- Brevo (France): sends emails from us to our team and to you.
- Forward Email (United States): receives the emails sent to us, including our alerts about new stories, and passes them on to our own message system.
- Google (United States): our team’s email. Emails sent to any of our addresses other than stories@sendmystory.co.uk are passed on to it.
- AssemblyAI (a US company; we use its service in Ireland): turns voice notes and recordings of our calls into text. We tell it to delete the recording and the text as soon as we have the transcript, or as soon as the attempt fails.
- A call-recording app on our phone: records our phone calls with you. We always tell you at the start of the call. AssemblyAI then turns the recording into text.
- AI writing tools (United States): help our team write up stories from what you tell us.
WhatsApp, if you choose WhatsApp
WhatsApp (WhatsApp LLC, in the United States) carries our messages. Messages are end-to-end encrypted, so WhatsApp cannot read them, but it uses some information, such as your number and when messages are sent, for its own purposes under its own privacy policy. We use a WhatsApp account linked to our own message system, so our messages with you are also kept on our servers with your story.
Our bank, when we pay you
Our bank sends your payment by bank transfer. It keeps its own record of the payment, as banks must.
Meta, for adverts
Meta (Facebook and Instagram) receives information about your visit, about your story being sent and about it moving forward, as explained under adverts. Meta also uses it for its own purposes, under its own privacy policy.
We may also share information where the law requires it, for example with the police or a court. If we believe someone, especially a child, is at risk of serious harm, we may tell the police, social services or the emergency services. We may also share it with our professional advisers, such as our lawyers and accountants.
We never sell your information.
5. Adverts
Many people find us through adverts on Facebook and Instagram. To see which adverts bring in stories:
- When you arrive from an advert, the site notes which advert it was, including the click reference Facebook adds to the link. The note stays on your device for 7 days and is sent to us with your story.
- This website uses the Meta Pixel. It sets Meta’s cookies, and it tells Meta which of our pages you visit, when you send a story and when you add a photo. With each of these, Meta’s systems also automatically pick out basic details about the page, such as its title and description. If you are logged in to Facebook or Instagram in the same browser, Meta can link this to your account.
- When you send a story, our server also sends Meta a matching record. It includes the phone number or email address you gave us, your first name and our reference for your story in a scrambled (hashed) form, your IP address, your browser type and the click and browser references Meta’s Pixel sets. It never includes your story.
- When your story moves forward, for example when we take it on or it is published, our server tells Meta, so our adverts reach people with stories newsdesks want. We never tell Meta what your story is about.
We may also use this information to show our adverts again, on Facebook and Instagram, to people who have visited this site.
Meta Platforms, Inc., in the United States, is jointly responsible with us for collecting this information and sending it to Meta. What Meta does with it after that is up to Meta, under Meta’s privacy policy. If you contact us about your rights over what Meta holds, we will pass your request to Meta within 7 days. You can block or clear cookies in your browser (see our cookie page), control how Meta uses your information in your Facebook or Instagram ad settings, and object to this use by contacting us.
6. Information sent outside the UK
Some of the companies we use store or process information outside the UK:
- in the European Union (Hetzner, Bunny, Brevo, AssemblyAI’s service in Ireland and Backblaze’s in the Netherlands), which the UK treats as giving adequate protection;
- in the United States (Meta, WhatsApp, IDrive, Forward Email, Google, AssemblyAI and Backblaze as US companies, and our AI writing tools), where we rely on the UK Extension to the EU-US Data Privacy Framework for companies certified to it, or on the ICO’s approved contract terms.
Calls with you are recorded on our own phone, and AssemblyAI turns the recordings into text, as described above.
Sometimes we offer stories to journalists and publications outside the UK. If we offer yours, they receive the same information as a journalist in the UK would. We send it because it is needed for our agreement with you: offering your story to the press is what you asked us to do.
7. How long we keep it
| Information | How long |
|---|---|
| The note that a form was started but never sent (no words, no contact details) | 30 days |
| A voice note or photo that is not part of a sent story, including one you removed | 7 days |
| A story we could not use | 6 months after we told you, in case you send it again or ask about it |
| A story you withdrew before it was published | Deleted within 30 days of you withdrawing it. We cannot recall copies we have already sent to journalists |
| A story still being worked on | Until we reach a decision, and never more than 12 months without activity |
| A recording of a phone call with you, and its written transcript | Kept with your story, and deleted with it |
| A published story, with the notes, messages, photos, voice notes, call recordings and transcripts behind it | 2 years after it was first published, so we can deal with any question, complaint or claim about it |
| The record of your payment (your name, the amount, the date and the payment reference) | 7 years after payment, because tax law requires it |
| Your bank details | We delete the message with your bank details once the payment has gone through. Our bank keeps its own record of the payment |
| A record that you agreed to our terms, and when (a coded fingerprint, with no name, number or story) | Kept after your story is deleted, so we can show what was agreed |
If you ask us to delete your information, we do it straight away, except for anything the law requires us to keep. Deleted information stays in our encrypted backups until they are replaced, which takes up to 12 months. We only use a backup to restore our systems after a failure, and if we ever do, we delete your information again. A publication that has run your story keeps its own copy, under its own rules.
8. What is stored on your device
The form saves what you have written on your own phone or computer, so you do not lose it if the page closes. It is deleted when you send your story, or after 7 days. The site also remembers which advert brought you here, for 7 days, and the Meta Pixel sets Meta’s own cookies. The details, and how to remove them, are on our cookie page.
9. Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct it;
- ask us to delete it;
- withdraw your story, or any consent you gave us, at any time, without affecting anything we did before. Section 9 of our contributor terms explains what this means once your story is with journalists or has been published;
- object to, or ask us to limit, how we use it; and
- ask for the information you gave us in a format you can take elsewhere.
Email stories@sendmystory.co.uk, or tell us on WhatsApp or on a call, and we will reply within one month. There is no charge. We may need to check who you are before we act.
If you are unhappy with how we have handled your information, you can complain to us first. Our complaints page explains how: we confirm we have your complaint within 2 working days and send a full reply within 14 days. You also have the right to complain to the Information Commission, still known as the ICO, at ico.org.uk or on 0303 123 1113.
10. Children
This service is for people aged 18 and over. If we find that a story was sent by someone under 18, we will not take it forward. We will let them know, and delete what they sent us. If a story involves a child, we only use information or images of that child with the permission of a parent or guardian.
11. Keeping it safe
Your information travels over an encrypted connection and is stored on servers that only our team can reach. Each story has its own private tracking link, and we only ever store a scrambled version of it.
When you add photos on our website, we remove the hidden location details that phones save in them, such as where the photo was taken.
12. If someone mentions you in their story
People who send us stories sometimes mention others, such as a family member, a landlord or an employer. If that is you:
- we get your information from the person who sent us the story. It is whatever they tell us about you, which can include sensitive details;
- we use it to write up their story and offer it to journalists and publications, who may publish it;
- our legal basis is our legitimate interests in placing their story. For sensitive details, it is the rules in the Data Protection Act 2018 for journalism; and
- we keep it for as long as we keep their story (see section 7).
You have the rights in section 9. The law on journalism can limit some of them while a story is being prepared for publication.
13. Changes to this notice
If we change how we use your information, we will update this page and change the date at the top. If a change affects a story you have already sent us, we will tell you.