In short
The version that fits in a paragraph.
We collect what you put in the application form or the message form, and nothing else. We use it to decide whether to offer you a room and to look after you while you're here. We don't sell it, share it for marketing, or pass it to anyone who isn't running the house. You can ask to see it, correct it, or have it deleted at any point, and we'll do it.
The rest of this page is the same thing in the detail the law expects.
Who we are
The data controller.
Moratorium House, 32 York Street, Blackpool, FY1 5AQ, United Kingdom.
For anything on this page—including requests to see or delete your data—use the message form on the main page, or write to us at the address above.
What we collect
Everything, listed.
If you apply
The application form is a Google Form. It asks for your name, email address, and optionally your phone number and Discord handle; a link to your CV, website or a social profile; when you'd like to arrive and for how long; whether you're working or studying and where; whether you'll have a full-time income while you're here; and free-text answers about your background, your view of AI risk, what you'd want to work on, and how you get on with housemates.
It also asks whether there's anything we should know to make your stay work—access needs, dietary requirements, health conditions—and for the name and email address of one person who can act as a character reference.
If you send us a message
The message form collects your name, email address and whatever you write in it.
Automatically
Our host keeps standard server logs, including IP addresses, for security and to keep the site running.
We also use Cloudflare Web Analytics to count visits, which tells us which pages people read and roughly where in the world they are. It was chosen because it does none of the usual things: no cookies, no fingerprinting, nothing stored in your browser, and no way to follow you to any other website. We can see that a page was read; we cannot see who read it.
Why, and on what basis
Our lawful bases.
- Assessing your application—legitimate interests. We can't decide who to offer a free room to without reading what people tell us about themselves.
- Replying to your message—legitimate interests. You wrote to us; answering is the point.
- Looking after you while you're here—legitimate interests, and contract where a stay is agreed.
- Health, disability and dietary information—explicit consent. See below.
- Keeping the site secure—legitimate interests.
Where we rely on legitimate interests, we've considered whether it's fair to you, and we think it is: you've chosen to contact us, and we only use what you send for the purpose you sent it for. If you disagree, you can object—see Your rights.
Special category data
Health, disability and anything the law treats as sensitive.
The application form invites you to tell us about access needs, health conditions and dietary requirements. Some of that is what UK data protection law calls special category data—information about health, and sometimes about religion or belief, which dietary requirements can reveal.
That question is optional and it does not affect whether you're accepted. If you answer it, you're giving explicit consent for us to use what you tell us for one purpose only: making your stay work. Nobody outside the running of the house sees it, and you can withdraw that consent at any time and we'll delete it.
Your referee
Someone else's data, given by you.
The form asks for a referee's name and email address. That's their personal data, not yours, so please ask them before you put them down. If we contact them, we'll tell them where we got their details. They have the same rights over their data as you have over yours.
Who else sees it
Four companies and nobody else.
- Google—the application form is a Google Form and responses are stored in Google Drive.
- Netlify—this site is hosted by Netlify, and messages sent through the message form pass through and are stored on their systems.
- Cloudflare—visit counts only, with no personal data attached to them.
- Our email provider—because form notifications and any reply we send arrive by email.
These are service providers acting on our instructions. We don't sell your data, we don't share it with other organisations, and we don't use it for marketing. Within the house, applications are read only by the people who decide on them.
Both Google and Netlify are American companies and your data may be stored or processed outside the UK. Both provide the safeguards UK law requires for international transfers, including standard contractual clauses.
Cookies
We don't set any. Google does.
This site sets no cookies of its own, and our analytics don't use them either, so there's nothing to consent to on our side and no banner to click away. However, the application form is embedded from Google, and loading it may allow Google to set cookies in your browser under their own terms. If you'd rather avoid that, don't scroll to the form—write to us through the message form instead, or by post.
How long we keep it
Not indefinitely.
- Unsuccessful applications—twelve months from the decision, then deleted. We keep them that long in case you apply again or ask us why.
- Applications we accept—for your stay, and twelve months afterwards.
- Messages—twelve months, unless they turn into something that needs keeping.
- Server logs—for the short period our host retains them.
Ask us to delete any of it sooner and we will, unless there's a specific reason we're required to keep it.
Your rights
What you can make us do.
Under UK data protection law you have the right to:
- Ask what we hold about you, and get a copy
- Have anything inaccurate corrected
- Have it deleted
- Ask us to stop using it, or restrict how we use it
- Object to us using it where we've relied on legitimate interests
- Receive it in a portable format
- Withdraw consent, where consent is what we relied on
Ask through the message form and we'll respond within one month. There's no charge, and asking will not count against a current or future application.
Complaints
If we get it wrong.
Tell us first and we'll try to put it right. If you're not satisfied, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. You can go to them directly without asking us first.
Last updated: July 2026. If this notice changes materially, we'll update this page and change the date.