Privacy Policy

1. Who is responsible for your data

The data controller is Products People Care About Limited, a company registered in England and Wales (company number 13311255), registered office 3rd Floor, 86–90 Paul Street, London, EC2A 4NE. For any privacy question or to exercise your rights, contact us at hello@productspeoplecareabout.com.

We are registered with the UK Information Commissioner's Office (ICO) under registration number [ICO REGISTRATION NUMBER — registration pending].

2. The personal data we collect

• Account data — your name and email address, and authentication data such as a hashed password and two-factor settings.
• Content you upload — plans, photographs, documents and project notes. These may contain personal data (for example a property address, or people appearing in photographs); you control what you upload.
• Usage and technical data — log data, IP address, device/browser information and actions within the app, used for security and to operate the service.
• Payment data — payments are handled by Stripe. We do not receive or store your full card number; we store only a Stripe customer/subscription identifier and limited card metadata (card brand and last four digits).

3. How and why we use your data (legal bases)

• To provide the service — creating your account, storing your projects and content, processing your subscription. Legal basis: performance of a contract.
• To secure and improve the service — monitoring, troubleshooting, preventing abuse and fraud. Legal basis: our legitimate interests in running a safe, reliable service.
• To process payments — via Stripe. Legal basis: performance of a contract.
• To send service communications — e.g. confirmation, billing and security emails. Legal basis: contract / legitimate interests.
• Where required, we rely on your consent (which you can withdraw at any time) or on compliance with a legal obligation.

4. AI processing

If you use the AI assistant, the relevant project content and your prompts are sent to Amazon Bedrock (part of Amazon Web Services), within our UK/EEA hosting region, to generate a response. We use this only to provide the assistant feature; your content is not used to train Amazon's or any third party's public models.

5. Who we share data with (processors)

We use carefully selected service providers who process data on our behalf under contract:

• Amazon Web Services (AWS) — hosting, file storage (S3), email delivery (SES), and the AI assistant (Amazon Bedrock).
• Stripe — payment processing.

We do not sell your personal data. We may disclose data where required by law or to protect our rights.

6. International transfers

We aim to keep data in the UK or European Economic Area. Where a provider processes data outside the UK/EEA, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

7. How long we keep it

We keep your account and content for as long as your account is active. After you close your account or delete content, we delete or anonymise it in the ordinary course, except where we must keep certain records (for example billing records for legal/tax purposes) or where it persists for a limited period in encrypted backups.

8. How we protect your data

We use encryption in transit (TLS), access controls, two-factor authentication for administrative access, encrypted backups and infrastructure hardening. No system is completely secure, but we take appropriate technical and organisational measures to protect your data.

9. Your rights

Under UK data protection law you have the right to access your data; to have inaccurate data corrected; to have your data erased; to restrict or object to processing; and to data portability. To exercise any of these, email hello@productspeoplecareabout.com. You also have the right to complain to the ICO (ico.org.uk), though we would welcome the chance to resolve your concern first.

10. Cookies and sessions

We use only strictly necessary cookies — to keep you signed in and to protect against cross-site request forgery. We do not use analytics, advertising or tracking cookies, and we do not share any browsing data with third parties for those purposes. Because our cookies are essential to providing the service you requested, no cookie-consent banner is required.

11. Children

Building is not intended for children and is offered only to adults aged 18 or over. We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. The current version and date are shown at the top of this page; we will notify you of material changes.