How OurGrapeVine collects, uses, and protects your information
THURLOW KEMP LTD (trading as OurGrapeVine) operates the OurGrapeVine activity monitoring service at ourgrapevine.co. We are the "data controller" for the personal information described in this Policy, which means we decide how and why your information is used.
Our registered details are set out in section 10 below.
If you are an Owner, when you register we collect:
If you are a Follower, we collect:
For everyone, we keep a record of when you accepted our Terms & Conditions and confirmed you are 18 or over, and whether you chose to receive updates from us.
Once an Owner's Account is active, we collect:
For both Owners and Followers, we also collect:
We use one cookie, and only one. It records that you have signed in, so you are not asked for an email code every time you open the Service. It holds no information about you beyond that, it is not used for advertising or analytics, and it is not shared with anyone.
It is a “strictly necessary” cookie: without it you could not stay signed in, so you will not be asked to consent to it — but you should know it is there. It lasts for up to 180 days, and the clock restarts each time you use the Service, so an active account stays signed in. We chose a long period deliberately: being signed out unexpectedly is a real barrier for the people this Service is for. Signing out, or clearing your browser’s cookies, removes it immediately.
If you share a computer or device with other people, anyone using that browser will be able to open your account until you sign out. On a shared machine, sign out when you have finished.
We do not collect video, audio, or photographic imagery. The Service collects activity signals, not information intended to diagnose or assess a person's health or medical condition. Activity data shows only that a configured activity signal was or was not detected. It does not tell us where a person is, what they are doing, or whether they are healthy, unwell, safe, or in need of assistance. The Service is not a medical device.
We use your information to:
We do not use your information for automated decision-making that has a legal or similarly significant effect on you, and we do not sell your information to anyone.
Under UK GDPR, we must have a lawful reason to process your information. We rely on:
| What We Do | Our Legal Basis |
|---|---|
| Providing your Account and the core Service | Performance of a contract with you |
| Collecting data from an optional Activity Signal | Your explicit consent |
| Sharing your activity summary with a Follower you invite | Your explicit consent |
| Sending an invitation email to someone an Owner has invited | Our legitimate interests, and the Owner's, in letting Owners invite the people they choose |
| Providing a Follower account, including showing your name and messages in the chat | Performance of a contract with you |
| Sending updates and tips about OurGrapeVine | Your consent |
| Keeping records of when you accepted our Terms and confirmed your age | Our legitimate interests in being able to show what was agreed |
| Sending alerts by text message to an Owner or Nominated Contact who has given us their mobile number for this | Performance of a contract with you |
| Taking payment if you subscribe | Performance of a contract with you |
| Keeping the Service secure and working properly | Our legitimate interests |
| Improving the Service using aggregated or pseudonymised data | Our legitimate interests. You can object to this at any time (see section 8) |
| Meeting legal obligations, such as responding to a court order | Legal obligation |
Full details of the legal basis for each type of processing are set out in our Terms & Conditions.
If you are an Owner, we share an activity summary with any Follower you invite — for example, whether you have had activity today. We do not share your raw Activity Signal data or your other Account details with a Follower.
If you are a Follower, the Owner of an Account you follow, and any other Followers of that Account, can see your name and the messages you post in its chat. The Owner can also see that you follow their Account. We do not share your email address with other Followers.
We use a small number of trusted service providers to help us run OurGrapeVine, including:
These providers only process your information on our instructions and are contractually required to keep it secure.
We may share your information with law enforcement, regulators, or courts if we are legally required to do so.
We store your information on servers in the European Union, in Sweden. The UK recognises the countries of the EU and European Economic Area as providing an adequate level of protection for personal information, so no additional safeguards are needed for this.
Some of our service providers, such as Stripe, may also process information outside the UK and the European Economic Area. Where they do, they use the safeguards UK law requires, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
| Information | How Long We Keep It |
|---|---|
| Activity Signal data (Check-In, smart plug) | 12 months from collection |
| Daily or monthly activity totals | 7 years, for financial and audit purposes |
| Account and registration details, for Owners and Followers, including records of what you agreed to | Duration of your Account, plus 6 years after closure |
| Mobile phone numbers | Until you remove it, stop being a Nominated Contact, or close your account |
| Chat messages | For as long as the Account they were posted in is open, then deleted with that Account's data |
| Invitations that are not accepted | Until the invitation is accepted or cancelled |
| Backup copies of any of the above | Up to 30 days. Information you ask us to delete is removed from our backups as they expire, within 30 days |
| Support messages | 3 years from your last contact with us |
When a retention period ends, we securely delete or anonymise the information. You can ask us to delete your information earlier — see section 8.
We apply measures appropriate to the size of our service and the sensitivity of the data we hold. Traffic between your device and the Service is encrypted using HTTPS. We hold only the data we need, and we never collect or store payment card details — those go directly to our payment processor. Access to systems holding personal data is limited to those who need it to run or support the Service.
We are a small organisation and do not hold formal security certifications. If we ever become aware of a data breach likely to put your rights at risk, we will notify you and the ICO without undue delay, as required by law.
Signing in uses a single-use code sent to your email address, so there is no password to remember or lose. Please keep those codes to yourself, and contact us straight away if you think someone has accessed your Account without permission.
Our emails and text messages will never ask you for your sign-in code, payment details or any other personal information. If you receive a message that claims to be from us and does, do not respond to it, and let us know at support@ourgrapevine.co.
Under UK GDPR, you have the right to:
To exercise any of these rights, contact us using the details in section 10. We'll respond within one calendar month, free of charge in most cases.
Closing your account and deleting your information. To close your account, email support@ourgrapevine.co from the email address registered on your account, and tell us if you also want your information deleted. We will confirm by email once we have done so. Some records, such as what you agreed to, are kept for the periods set out in section 6.
OurGrapeVine is intended for adults aged 18 and over. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us and we will remove it.
If you have any questions about this Policy or how we handle your information, please contact us:
| Company name | THURLOW KEMP LTD |
| Registered address | [REGISTERED ADDRESS], United Kingdom |
| Company number | 03767009 |
| ICO registration number | Z7469706 |
| Contact | support@ourgrapevine.co |
If you are unhappy with how we have handled your information, you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
We may update this Policy from time to time. If we make a material change, we will notify you by email before it takes effect. Minor updates, such as corrections, may be made without prior notice — the version number and effective date at the top of this page will always reflect the current version.