Privacy Policy

Last updated: [DATE]. Plain-English summary — not legal advice.

This page contains placeholders (in square brackets) for details specific to your business — legal entity name, registered address, and company number if applicable. Replace them before this goes live for real users. Everything else describes what the application actually does.

Who this covers

This Privacy Policy applies to Thobela LetComply, operated by [LEGAL BUSINESS NAME] ([REGISTERED ADDRESS IF REQUIRED]). Contact us at info@thobelaletcomply.co.uk with any questions about this policy or your data.

What we collect

Account information — your name, email address, and password (stored as a salted hash, never in plain text).
Property information — addresses and property type for the properties you add.
Compliance information — the certificate/renewal dates you record for each property (Gas Safety, EICR, EPC, alarms, deposit protection, HMO licence).
Uploaded documents — certificates or other files you upload against a compliance item, stored privately and never made public.
Usage and account activity — an audit trail of account-level events (sign-in, password changes, subscription changes) kept for security and support.

Why we collect it

To provide the service you signed up for: tracking your properties' compliance status, storing your certificates so you have one place to find them, and sending you reminders before a deadline lapses. We don't collect anything beyond what's needed to run the tracker.

How we use it

To show your dashboard and compliance status.
To send you transactional email — account verification, password resets, compliance reminders, and (if you haven't opted out) a weekly summary digest.
To respond to support requests.
To detect and prevent abuse of the service (for example, automated signup protection via Cloudflare Turnstile).

How long we keep it

For as long as your account is active. If you delete your account, your personal details (name and email) are anonymized immediately; your properties and compliance records are removed from your view. Backups of the database are retained for a limited rolling window (currently 14 days) purely for disaster recovery, after which they are automatically deleted.

Who we share it with

We don't sell or share your personal or property data with third parties for marketing purposes. Data passes through a small number of infrastructure providers strictly to run the service:

An email delivery provider, to send the transactional emails described above.
Cloudflare Turnstile, to verify that signups are coming from a real person rather than a bot (Cloudflare receives limited technical signals about your browser, not your account data).
Our hosting provider, which stores the application's database and uploaded files.

If we ever build the tradesperson-marketplace feature referenced in the product roadmap, your data will not be shared with tradespeople without your explicit, separate consent at that time.

Cookies and sessions

We use a single essential session cookie to keep you logged in. It's required for the application to function and isn't used for advertising or cross-site tracking. We don't use third-party analytics or advertising cookies.

Security

Passwords are stored as salted hashes, never in plain text. Uploaded documents are stored outside the public web root and are only ever served to the account that owns them (or, for support purposes, the operator). All traffic to the application is encrypted in transit (HTTPS).

Your rights

You can update your account details or opt out of the weekly digest at any time from Account Settings. You can permanently delete your account and personal data yourself, at any time, from the same page. For any other request relating to your data — including a request to see a copy of what we hold about you — email info@thobelaletcomply.co.uk.

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page and, where appropriate, notify active users by email.