Privacy Policy
1. What we collect
- Account data: your email address and sign-in identity, handled by our authentication provider (Clerk). You can sign in with a one-time email code or with Sign in with Apple (and, on the website, Google where offered). If you use Sign in with Apple and choose to hide your email, we receive a private relay address from Apple instead of your real one.
- Valuation inputs: the property details you submit (postcode, size, type, tenure, asking price, or a listing link), the properties you choose to save, and your stated preferences.
- Billing data: if you subscribe to Premium on the website, your payment is handled by Stripe. If you subscribe in the iPhone app, your payment is handled by Apple through the App Store, and we learn about it through RevenueCat, our in-app subscription provider. Either way we receive only a customer or transaction reference, the subscription status and the billing period, never your card number.
- Usage data: standard server logs (IP address, time, endpoint) used for security, rate limiting and reliability, a daily count of the scans you run, and aggregate, cookie-free page analytics.
The properties we value are not usually “your” personal data, but a postcode you search can reveal something about you, which is why we treat valuation inputs as personal data and protect them accordingly.
2. What we use it for, and the lawful basis
- Providing the service you ask for: running valuations, saving properties, managing your subscription (performance of a contract).
- Keeping the service secure and abuse-free: rate limits, scan allowances, logs (legitimate interests).
- Sending you service emails about your account and, if you have a free account, a short series of emails explaining how to get the most from BuyKnow and what Premium adds. You can stop these at any time with the link in each email (legitimate interests under the soft opt-in rules; we only email you about our own similar services).
- Improving the product with aggregate, de-identified usage patterns (legitimate interests). We do not sell personal data, and we do not use your data to train the valuation model. The model is trained on public HM Land Registry and EPC records only.
3. Where it lives and who processes it
Application data is hosted in the EU. Authentication is provided by Clerk, website payments by Stripe, in-app subscription records by RevenueCat, email by our transactional email provider and web hosting by Vercel, each acting as a processor under their standard data protection terms. Purchases in the iPhone app, and Sign in with Apple, are provided by Apple under Apple’s own terms and privacy policy; Apple acts as an independent controller for that data. Transfers outside the UK and EEA rely on adequacy regulations or the International Data Transfer Agreement. Encrypted backups are stored in the EU.
4. Retention
Account, saved-property and subscription data is kept while your account is active and deleted within 30 days of account deletion, which you can do yourself at any time on the Account page, on the website or in the app, except billing records we must keep for six years under tax law. Server logs rotate on a short cycle. Aggregated statistics that identify no one may be kept indefinitely.
5. Your rights
You have the usual UK GDPR rights: access, rectification, erasure, restriction, portability and objection. Email info@buyknow.app and we will respond within one month. You can complain to the Information Commissioner’s Office (ico.org.uk) at any time.
6. Cookies and similar technologies
We use only strictly necessary cookies and local storage:
- Sign-in session (Clerk): keeps you signed in. Expires when the session ends.
- Preferences: remembers that you have dismissed the cookie notice and your display choices. Stored in your browser only.
- Free area-lookup counter: a small counter for the signed-out area-trends allowance.
Page analytics are collected by Vercel Web Analytics without cookies and without identifying you across sites. Because none of this requires consent under the Privacy and Electronic Communications Regulations, we show a notice rather than a consent banner. If we ever add cookies that need consent, we will ask first.