Privacy notice
Draft: to be reviewed before launch. Last updated [date].
Who we are
Stale Bricks is run by [company name], [registered address] ("we"). We are the controller of the personal data described here. Contact us at [privacy@yourdomain] about anything in this notice. ICO registration number: [ZA000000].
What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Email address, name, and your Google or Microsoft account id if you sign in that way | To create your account and sign you in | Contract |
| Recent searches, saved homes and alerts | To provide the features you use | Contract |
| Alert emails and a record of what we sent | To tell you about new homes in areas you chose | Contract (a service you set up; you can stop it in one click) |
| The fortnightly round-up email, and when you opted in | To send you the round-up you asked for | Consent, which you can withdraw at any time |
| Plan, amount, dates and Stripe reference numbers. We never see or store card details. | To give you paid access, and for tax and accounting records | Contract; legal obligation |
| A sign-in cookie, and server logs (IP address, browser) for security | To keep you signed in and protect the service from abuse | Strictly necessary; legitimate interests |
We don't use advertising or analytics cookies, and we don't sell or share your data for marketing. The only cookie is the one that keeps you signed in.
Who handles it for us
- Neon (database), hosted in London (AWS eu-west-2).
- [Hosting provider and region] (website and scheduled jobs).
- Stripe (payments). Stripe collects and stores card details and acts as a controller for its own fraud and legal duties.
- Resend (email delivery), which may process data in the United States under the UK International Data Transfer Addendum.
- Google or Microsoft, if you choose to sign in with them.
- Google Maps, which draws the maps. Your browser loads them from Google, so Google receives your IP address.
Each of these works under a data processing agreement. Property listings come from PropertyData; we send them no personal data.
How long we keep it
- Account, searches, saved homes and alerts: until you delete your account, or after [24] months without signing in.
- Payment records: 6 years after the end of the financial year they relate to (HMRC), without a link to a deleted account.
- Sign-in links expire after 15 minutes; sign-in sessions after 30 days.
- Server logs: [30] days.
Your rights
You can ask to see, correct, delete or move your data, object to or restrict how we use it, and withdraw consent. Your account page lets you download everything we hold and delete your account yourself. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.