Privacy Policy
1. What we collect
- Account data: your email address and sign-in identity, handled by our authentication provider (Clerk).
- Valuation inputs: the property details you submit (postcode, size, type, tenure, asking price, or a listing link), the properties you choose to save, and your stated preferences.
- Billing data: if you subscribe to Premium, your payment is handled by Stripe. We receive your Stripe customer reference, subscription status and billing period, never your card number.
- Usage data: standard server logs (IP address, time, endpoint) used for security, rate limiting and reliability, a daily count of the scans you run, and aggregate, cookie-free page analytics.
The properties we value are not usually “your” personal data, but a postcode you search can reveal something about you, which is why we treat valuation inputs as personal data and protect them accordingly.
2. What we use it for, and the lawful basis
- Providing the service you ask for: running valuations, saving properties, managing your subscription (performance of a contract).
- Keeping the service secure and abuse-free: rate limits, scan allowances, logs (legitimate interests).
- Sending you service emails about your account and, if you have a free account, a short series of emails explaining how to get the most from BuyKnow and what Premium adds. You can stop these at any time with the link in each email (legitimate interests under the soft opt-in rules; we only email you about our own similar services).
- Improving the product with aggregate, de-identified usage patterns (legitimate interests). We do not sell personal data, and we do not use your data to train the valuation model. The model is trained on public HM Land Registry and EPC records only.
3. Where it lives and who processes it
Application data is hosted in the EU. Authentication is provided by Clerk, payments by Stripe, email by our transactional email provider and web hosting by Vercel, each acting as a processor under their standard data protection terms. Transfers outside the UK and EEA rely on adequacy regulations or the International Data Transfer Agreement. Encrypted backups are stored in the EU.
4. Retention
Account, saved-property and subscription data is kept while your account is active and deleted within 30 days of account deletion, except billing records we must keep for six years under tax law. Server logs rotate on a short cycle. Aggregated statistics that identify no one may be kept indefinitely.
5. Your rights
You have the usual UK GDPR rights: access, rectification, erasure, restriction, portability and objection. Email info@buyknow.app and we will respond within one month. You can complain to the Information Commissioner’s Office (ico.org.uk) at any time.
6. Cookies and similar technologies
We use only strictly necessary cookies and local storage:
- Sign-in session (Clerk): keeps you signed in. Expires when the session ends.
- Preferences: remembers that you have dismissed the cookie notice and your display choices. Stored in your browser only.
- Free area-lookup counter: a small counter for the signed-out area-trends allowance.
Page analytics are collected by Vercel Web Analytics without cookies and without identifying you across sites. Because none of this requires consent under the Privacy and Electronic Communications Regulations, we show a notice rather than a consent banner. If we ever add cookies that need consent, we will ask first.