PRIVACY POLICY
Elsewhere (joinelsewhere.co)
Operated by Shreeyaa Khatri, London, United Kingdom
Last updated: July 2026
1. Introduction and Identity of the Controller
This Privacy Policy sets out the basis on which Shreeyaa Khatri, trading as Elsewhere ("we", "us", "our"), collects, uses, stores, and discloses personal data in connection with the operation of joinelsewhere.co and its associated services (the "Service").
We are the data controller in respect of personal data processed under this Policy. We are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact details of the controller:
Shreeyaa Khatri
London, United Kingdom
hello@joinelsewhere.co
If you have any questions about this Policy or wish to exercise your rights, please contact us at the address above.
2. Scope
This Policy applies to all personal data collected through:
- the Elsewhere website at joinelsewhere.co
- the Elsewhere onboarding questionnaire
- communications between you and Elsewhere by email or other means
It does not apply to third-party websites or services linked to from our website.
3. Personal Data We Collect
3.1 Data You Provide Directly
We collect the following categories of personal data that you provide to us:
(a) Account data
Your first name and email address, collected when you create an account via the Service.
(b) Questionnaire data
Responses to the Elsewhere onboarding questionnaire, including:
- Your current country and city of residence
- Your country of origin
- Your age group
- Your gender identity
- Your relationship status
- Your life stage
- Your personality, conversational style, and group preferences
- Your availability windows and timezone (derived from your location)
- Free-text responses describing your interests and what you are looking for in a group
(c) Payment data
Transaction records associated with your payment for the Service. Card details and payment instrument data are processed directly by Stripe Payments Europe, Ltd. and are not received, stored, or processed by us.
3.2 Data Collected Automatically
We may collect the following data automatically when you use the Service:
- Browser type and version
- Operating system
- Referring URLs
- Pages visited and time spent on the Service
- Approximate geographic location derived from IP address
3.3 Special Category Data
Certain questionnaire responses (specifically gender identity) may constitute special category data under Article 9 UK GDPR. We collect this data solely for the purpose of composing balanced groups and with your explicit consent, as indicated by your voluntary completion of the questionnaire.
4. Purposes and Legal Bases for Processing
We process your personal data on the following legal bases under Article 6 (and, where applicable, Article 9) UK GDPR:
| Purpose | Legal Basis |
|---|---|
| Creating and managing your account | Performance of a contract (Article 6(1)(b)) |
| Matching you into a group of five people from different countries | Performance of a contract (Article 6(1)(b)) |
| Scheduling and facilitating your group call | Performance of a contract (Article 6(1)(b)) |
| Processing your payment | Performance of a contract (Article 6(1)(b)) |
| Sending transactional emails (auth codes, group introduction) | Performance of a contract (Article 6(1)(b)) |
| Processing gender identity data for group composition | Explicit consent (Article 9(2)(a)) |
| Improving the Service through analytics | Legitimate interests (Article 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Article 6(1)(c)) |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests or fundamental rights and freedoms.
5. Recipients and Transfers of Personal Data
5.1 Third-Party Processors
We share your personal data with the following third-party processors, who process data on our behalf under appropriate data processing agreements:
| Processor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database hosting and authentication | European Union |
| Stripe Payments Europe, Ltd. | Payment processing | European Economic Area |
| Resend, Inc. | Transactional email delivery | United States (SCCs in place) |
| Vercel, Inc. | Website hosting and deployment | United States (SCCs in place) |
5.2 International Transfers
Where personal data is transferred to processors located outside the United Kingdom, we ensure that such transfers are subject to appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office, or the UK International Data Transfer Agreement (IDTA), as applicable.
5.3 Disclosure to Your Group
Upon formation of your group, your first name will be shared with the other members of your group as part of the introduction facilitated by Elsewhere. No other personal data is shared with other members without your consent.
5.4 Other Disclosures
We do not sell, rent, or otherwise disclose your personal data to third parties for marketing purposes. We may disclose personal data where required by law, regulation, or court order.
6. Retention of Personal Data
We retain your personal data for as long as your account remains active. Upon deletion of your account, we will remove your personal data from our systems within 30 days, subject to any legal obligation to retain records for a longer period.
Anonymised or aggregated data that cannot reasonably be used to identify you may be retained indefinitely for analytical purposes.
7. Your Rights Under UK GDPR
You have the following rights in respect of your personal data:
(a) Right of access (Article 15)
You have the right to obtain confirmation of whether we process personal data about you and, if so, to receive a copy of that data and supplementary information about how it is processed.
(b) Right to rectification (Article 16)
You have the right to require us to correct inaccurate personal data and to complete incomplete personal data.
(c) Right to erasure (Article 17)
You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis for processing.
(d) Right to restriction of processing (Article 18)
You have the right to request that we restrict the processing of your personal data in certain circumstances.
(e) Right to data portability (Article 20)
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
(f) Right to object (Article 21)
You have the right to object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
(g) Rights related to automated decision-making (Article 22)
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
(h) Right to withdraw consent
Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
To exercise any of the above rights, please contact us at hello@joinelsewhere.co. We will respond within one calendar month of receipt of your request. We may ask you to verify your identity before fulfilling your request.
8. Right to Lodge a Complaint
If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk | 0303 123 1113
We would, however, appreciate the opportunity to address your concerns before you approach the ICO and invite you to contact us in the first instance.
9. Cookies
We use strictly necessary cookies to maintain your authenticated session. We do not use advertising, tracking, or analytical cookies that require your consent. You can control cookie settings through your browser; however, disabling strictly necessary cookies may affect your ability to use the Service.
10. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These measures include encrypted data storage, row-level security policies enforced at the database level, and encrypted data transmission via TLS.
No method of transmission over the internet or electronic storage is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO in accordance with our obligations under UK GDPR.
11. Children
The Service is not directed at, and we do not knowingly collect personal data from, persons under the age of 18. If we become aware that we have collected personal data from a person under 18, we will delete that data promptly. If you believe we have inadvertently collected data from a minor, please contact us at hello@joinelsewhere.co.
12. Changes to This Policy
We may update this Policy from time to time. Where changes are material, we will notify you by email and update the "last updated" date at the top of this Policy. Your continued use of the Service following notification of changes constitutes your acknowledgement of the updated Policy.
13. Contact
For all data protection enquiries:
hello@joinelsewhere.co