Privacy Notice

OneShoal.com is operated by DWH Venture Works Limited (company number 17390937), registered office 128 City Road, London, EC1V 2NX, United Kingdom. DWH Venture Works Limited is the controller of the personal information described in this notice.

Version 1.0 — effective 6 September 2026

For privacy questions or to exercise your rights, contact privacy@oneshoal.com.

1. What this notice covers

This notice explains how we handle personal information when you use OneShoal, including marketplace listings, wanted listings, profiles, messages, business profiles, My Tanks, fishkeeping tools, species information, reviews and reputation features, alerts, AI-assisted features and any paid, featured or sponsored services we make available.

OneShoal is designed as a marketplace and fishkeeping platform. Users normally contract directly with one another. This notice concerns OneShoal's use of personal information; it does not replace a seller's own privacy obligations where a seller is independently responsible for personal information it receives.

2. Information we may collect

Depending on how you use OneShoal, we may process:

Account and authentication data, such as your name, email address, sign-in information, account type, settings and security records.
Profile information, including display name, avatar, biography, fishkeeping interests and information you choose to make public.
Business and verification information, such as business identity, trading details, public business contact details, licences, registrations, credentials and evidence submitted for checks.
Location information. We may store a precise or more detailed location privately when you provide it so that distance and local search features work. We normally show other users only an approximate area or locality for private users. A business may choose to publish its business address or other public contact information in a feature intended for that purpose.
Marketplace content, including For Sale and Wanted listings, descriptions, photos, species or product information, price, availability and listing history.
Messages and enquiries, including the content and metadata of messages sent through OneShoal and any collection, delivery or contact details you deliberately share with another user.
My Tanks and fishkeeping data, including tank setup, livestock, equipment, water readings, notes, reminders, photos and related information. Tank information is private unless you deliberately use a feature that makes specified content public.
AI-assisted feature data, including photos or text you submit to Fish Scan, Tank Scan or similar tools, generated suggestions, corrections, confidence or quality information and technical metadata needed to provide and improve the feature.
Reviews, reputation and transaction signals, where those features are enabled, such as reviews, ratings, reported completion of a transaction and anti-manipulation signals.
Safety, moderation and support information, including reports, complaints, blocked users, enforcement actions, fraud or abuse indicators and correspondence with us.
Technical and usage information, including IP address, device and browser information, coarse country or region, timestamps, security events, errors, rate-limiting data and permitted analytics events.
Privacy and communications choices, including cookie/storage choices, consent records, alert settings, marketing preferences and delivery records.
Payment and subscription records, when paid features are enabled, such as the plan or feature purchased, amount, currency, payment status and provider identifiers. Our payment provider processes full payment-card details; OneShoal should receive only the payment and billing information reasonably needed to operate the service, keep records and handle support.

Please do not put sensitive or unnecessary personal information in public listings, profile text or messages.

3. Where information comes from

We may obtain information:

directly from you;
from other OneShoal users, for example through reviews, reports or transaction-related interactions;
from service providers that help us operate, secure, map, communicate, analyse or take payments for the service; and
from official or public sources where reasonably necessary to verify a business, licence, registration or other credential.

4. Why we use personal information and our lawful bases

We use personal information only where we have a lawful basis. Depending on the activity, this may include:

Providing your account and the service — contract. This includes authentication, profiles, marketplace listings, messaging, My Tanks, wanted alerts and user-requested AI features.
Operating and protecting OneShoal — legitimate interests. We use proportionate information to secure the service, prevent fraud and abuse, investigate reports, moderate content, enforce our Terms, maintain service integrity and understand operational performance. Our interests are in running a safe, reliable marketplace and protecting users and the business.
Legal and regulatory obligations — legal obligation. We may process information where required to comply with applicable law, regulatory duties, court orders or lawful authority requests.
Business and credential verification — legitimate interests and, where applicable, legal obligation. We may check information supplied by business users against appropriate sources to reduce misrepresentation and support trust.
Payments, subscriptions and accounting — contract and legal obligation, when paid features are enabled.
Optional analytics in the UK — consent, where consent is required. Non-essential analytics will not be activated for a UK user before the required choice is made.
Promotional marketing — consent where required. You can withdraw marketing consent or unsubscribe at any time.
Service communications — contract or service operation. Messages about your account, enquiries, wanted alerts, saved searches, listing activity, security or other features you requested are service communications rather than promotional marketing.
Legal claims and dispute handling — legitimate interests, where necessary to establish, exercise or defend legal rights.

We may display clearly labelled contextual sponsored or featured placements using information such as the page, search, category, country or general area being viewed. Where this is done without behavioural profiling or non-essential device tracking, it does not require us to build an advertising profile about you. Behavioural advertising, marketing pixels or similar tracking will only be used where the required consent or other lawful basis exists.

5. What is public and what stays private

OneShoal is local-first, but we aim to protect private users' exact location. For private accounts, an exact home address, precise coordinates, email address and telephone number are not public by default. Search and listing features should normally expose only an approximate area or locality.

You may choose to share additional information in messages with another user. Businesses may deliberately publish a business address, website, telephone number or other business information where the product provides a field intended for public display. Information you deliberately publish can be seen, copied or shared by others, so only publish what you are comfortable making public.

6. AI-assisted features and automated processing

AI features can make mistakes. Fish identification, tank analysis, compatibility, care and similar outputs are suggestions and estimates, not guaranteed facts, veterinary advice or legal determinations.

We may use automated signals to detect spam, fraud, abuse, prohibited content or other safety concerns. We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects on you. Where an automated signal contributes to a significant account restriction or enforcement decision, we aim to provide appropriate human review or an appeal route where required and practicable.

Content submitted to an AI-assisted feature is processed to provide and operate that feature. We do not grant ourselves a general right under this notice to use private messages or private tank content to train third-party general-purpose AI models. If that practice were ever proposed, we would first assess the lawful basis, contractual position and transparency or consent requirements and update users before doing so where required.

7. Who we share information with

We may share information only as reasonably necessary with:

hosting, database, authentication, security, communications, mapping, AI and other infrastructure providers used to run OneShoal;
analytics providers where the relevant consent and controls permit their use;
payment providers such as Stripe if and when paid services are enabled;
professional advisers, insurers, auditors and service providers who owe appropriate duties of confidentiality;
law-enforcement bodies, regulators, courts or other authorities where required or permitted by law;
a buyer, investor or successor in connection with a genuine corporate reorganisation, financing, sale or acquisition, subject to appropriate safeguards; and
other users where you choose to publish information or send it to them through the service.

Current technical suppliers may include services such as Supabase, Google Maps Platform and Google AI services where those services are actually enabled in the relevant feature. Our Cookie Notice and live technology register provide additional information about technologies used on your device.

We do not sell personal information to advertisers. Paid visibility or contextual sponsorship on OneShoal does not give an advertiser access to your private account data or private conversations.

8. International transfers

Some suppliers may process information outside the United Kingdom. Where UK data-protection law requires safeguards for an international transfer, we use an applicable UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with supplementary measures where required. Where EU or EEA data-protection law applies separately, we use the applicable EU transfer mechanism.

You can contact privacy@oneshoal.com for more information about safeguards relevant to your data.

9. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute requirements.

Typical periods or criteria include:

account, profile, listings and tank information: while your account is active and for a limited operational period after closure or deletion, subject to backups, legal obligations, disputes and safety needs;
essential security/rate-limit logs: typically around 30 days, unless an incident requires longer retention;
consent and privacy-choice records: typically around 12 months or for the period needed to demonstrate the relevant choice and policy version;
payment, tax and accounting records: for the period required by applicable tax and accounting law once paid services are enabled;
moderation, fraud, safety and dispute evidence: for as long as reasonably necessary to investigate, prevent repeat abuse, resolve a dispute or meet legal obligations; and
backups: deleted information may remain temporarily in protected backups until normal backup rotation removes it.

We may anonymise information so it can no longer identify you and retain the anonymised information for statistical or operational purposes.

10. Your rights

Subject to the law and any applicable exemptions, you may have rights to:

be informed about how your information is used;
access your personal information;
correct inaccurate or incomplete information;
request deletion in appropriate circumstances;
restrict processing in appropriate circumstances;
receive certain information in a portable format;
object to processing based on legitimate interests, including a specific right to object to direct marketing;
withdraw consent at any time where processing relies on consent, as easily as you gave it; and
ask for safeguards around certain automated decision-making.

We normally respond to valid UK data-rights requests within one month, subject to the extensions and exemptions permitted by law. We may need to verify your identity.

Contact privacy@oneshoal.com to exercise a right. You can also complain to the UK Information Commissioner's Office. If you are outside the UK, mandatory privacy rights and complaint routes in your country may also apply.

11. Children

OneShoal accounts and marketplace transactions are intended for people aged 18 or over. The service is not directed at children. This age rule does not replace any separate legal duties that may apply to publicly accessible or user-to-user parts of the service.

12. Security

We use technical and organisational measures intended to protect information against unauthorised access, loss, misuse or alteration. No online service can guarantee absolute security. You are responsible for protecting your sign-in details and should tell us promptly if you believe your account has been compromised.

13. Changes to this notice

We may update this notice as OneShoal develops or the law changes. We will keep the version and effective date visible. If we introduce a material new use of personal information, we will bring it to users' attention before starting that processing where required and obtain a new consent where the law requires one.

14. Contact

Privacy: privacy@oneshoal.com General support: support@oneshoal.com Controller: DWH Venture Works Limited trading as OneShoal.com Registered office: 128 City Road, London, EC1V 2NX, United Kingdom Company number: 17390937