Privacy Policy

We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Introduction

This Privacy Policy explains how Nodura Ltd ("we", "us", "our") collects, uses, stores, and protects your personal information when you use Home Concierge (the "Service").

2. Information We Collect

2.1 Information You Provide Directly

Account Information:

• Name (first and last)
• Email address
• Password (encrypted)
• Profile preferences

Service Content:

• Vehicle information (registration, make, model)
• Property details (addresses, types)
• Pet information (names, types, breeds)
• Personal items and administrative details
• Dates (expiry, renewal, service dates)
• Provider/company names
• Costs and reference numbers
• Notes and descriptions
• Uploaded documents (insurance certificates, MOT certificates, etc.)

Payment Information:

• Payment details are processed by Stripe and never stored on our servers
• We receive from Stripe: payment status, subscription type, last 4 digits of card

Communications:

• Support enquiries
• Feedback and survey responses
• Email communications with us

2.2 Information Collected Automatically

Usage Data:

• Pages visited and features used
• Time spent on the Service
• Actions taken (adding items, viewing documents)
• Browser type and version
• Device information (type, operating system)
• IP address and general location (city/country level)

Cookies and Similar Technologies:

• Authentication cookies (essential)
• Preference cookies (optional)
• Analytics cookies (optional)

See our Cookie Policy for detailed information.

2.3 Information from Third Parties

OAuth Authentication (Google Sign-In):

• If you sign in with Google, we receive: name, email address, profile picture

Payment Processor (Stripe):

• Subscription status and payment confirmations
• No full payment card details

3. How We Use Your Information

3.1 Legal Basis for Processing

We process your personal data under the following legal bases:

Contract Performance (GDPR Art. 6(1)(b)):

• Providing the Service
• Managing your account
• Processing payments
• Sending service notifications

Legitimate Interests (GDPR Art. 6(1)(f)):

• Improving the Service
• Preventing fraud and abuse
• Analysing usage patterns
• Sending product updates

Consent (GDPR Art. 6(1)(a)):

• Marketing communications (you can opt out)
• Optional analytics cookies
• AI document parsing (optional feature)

Legal Obligation (GDPR Art. 6(1)(c)):

• Complying with tax and financial regulations
• Responding to lawful requests from authorities

3.2 Specific Uses

We use your information to:

Provide the Service:

• Create and manage your account
• Store your tracked items and documents
• Send reminders and notifications
• Display your dashboard and data
• Sync across your devices

Process Payments:

• Handle subscription billing
• Manage refunds and cancellations
• Maintain payment records

Communicate with You:

• Send important service updates
• Respond to support requests
• Notify you of account activity
• Send reminders (email, SMS if enabled)

Improve the Service:

• Analyse usage patterns (anonymised where possible)
• Identify and fix bugs
• Develop new features
• Conduct user research

AI Features (with your use):

• Generate personalised insights about your tracked items
• Parse uploaded documents to extract dates and information
• Provide recommendations

Ensure Security:

• Detect and prevent fraud
• Monitor for security threats
• Enforce our Terms and Conditions

Marketing (with consent):

• Send newsletters and product updates
• Inform you of new features
• Conduct surveys

4. How We Share Your Information

4.2 Service Providers

We share data with trusted third parties who help us operate the Service:

Supabase (database, file storage and sign-in):

• Hosts your account, the items you track and the documents you upload
• Encrypted in transit and at rest; each account's rows and files are locked to that account at the database level (row-level security)
• Supabase runs on Amazon Web Services in the Europe (Ireland) region (eu-west-1). Your data is stored in the EU, not the UK, and the UK Government has an adequacy decision covering transfers to the EU

Lovable AI gateway and Google Gemini (document reading):

• Only when you choose to upload a document: its text is sent once to Google's Gemini model via Lovable's AI gateway, so the renewal dates and reference numbers can be read out of it
• The document itself stays in our storage; only the extracted text is sent, and it is not used to train models
• If you never upload a document, nothing goes to this provider

DVLA Vehicle Enquiry Service (car details):

• When you enter a registration, we look it up with the DVLA to fetch MOT and tax dates. The registration is the only thing sent

Stripe (payments):

• Processes subscription payments
• We receive payment status, plan and the last four digits of your card; never the full card number

Resend (email):

• Sends reminder and account emails to the address on your account

Google Analytics 4 (only if you accept analytics cookies):

• Page views and in-app events such as "item created", with IP anonymisation
• Runs only after you accept analytics cookies in the banner; you can withdraw that in Settings at any time

All service providers are contractually obligated to protect your data and use it only for specified purposes.

4.3 Legal Requirements

We may disclose your information if required by law:

• To comply with legal obligations or court orders
• To protect our rights or property
• To investigate fraud or security issues
• To protect the safety of users or the public

4.4 Business Transfers

If Nodura Ltd is acquired or merged with another company, your information may be transferred. We will notify you of any such change and your options.

5. Data Storage and Security

5.1 Where We Store Your Data

• Primary hosting: Supabase, AWS Europe (Ireland)
• Document storage: Encrypted cloud storage (EU/UK)
• Backups: Encrypted, geographically distributed

We take steps to ensure data is stored within the UK/EU where possible. Some service providers may process data in other jurisdictions with adequate protections.

5.2 Security Measures

We implement appropriate technical and organisational measures:

Technical Measures:

• Encryption in transit (TLS/SSL)
• Encryption at rest
• Secure authentication (bcrypt password hashing)
• Regular security audits
• Automated backups
• Firewall and access controls

Organisational Measures:

• Access limited to authorised personnel only
• Staff training on data protection
• Incident response procedures
• Data minimisation principles

5.3 Data Retention

5.4 Security Limitations

While we take security seriously, no system is 100% secure. You are responsible for:

• Keeping your password secure
• Not sharing your account access
• Reporting any suspected unauthorised access

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

6.1 Right of Access

Request a copy of all personal data we hold about you.

6.2 Right to Rectification

Request correction of inaccurate or incomplete data.

6.3 Right to Erasure ("Right to be Forgotten")

Request deletion of your personal data in certain circumstances.

6.4 Right to Restriction

Request that we limit processing of your data.

6.5 Right to Data Portability

Receive your data in a machine-readable format to transfer to another service.

6.6 Right to Object

Object to processing based on legitimate interests or for marketing purposes.

6.7 Rights Related to Automated Decision-Making

We do not make automated decisions that significantly affect you without human involvement.

6.8 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time.

6.9 How to Exercise Your Rights

To exercise any of these rights:

1. Log into your account and go to Settings
2. Or email us at: info@thehomeconcierge.co.uk
3. We will respond within 30 days

We may ask for identity verification before fulfilling requests.

7. Cookies and Tracking

7.1 Types of Cookies We Use

Essential Cookies (cannot be disabled):

• Authentication cookies
• Security cookies
• Session management

Functional Cookies (can be disabled):

• Preference cookies (remember your settings)
• Language preferences

Analytics Cookies (can be disabled):

• Usage analytics
• Performance monitoring

See our separate Cookie Policy for detailed information.

7.2 Your Cookie Choices

You can manage cookie preferences:

• In your browser settings
• Through our cookie consent banner
• In your account Settings

Disabling essential cookies will prevent you from using the Service.

8. Marketing Communications

8.1 Types of Marketing

With your consent, we may send:

• Product updates and new features
• Tips and best practices
• Surveys and feedback requests
• Special offers or promotions

8.2 Opting Out

You can opt out of marketing communications:

• Click "Unsubscribe" in any marketing email
• Update preferences in Settings → Notifications
• Email us at: info@thehomeconcierge.co.uk

You cannot opt out of essential service communications (e.g., security alerts, billing confirmations).

9. Children's Privacy

Home Concierge is not intended for users under 18 years old. We do not knowingly collect personal information from children.

If we become aware that we have collected data from a child, we will delete it promptly. Please contact us if you believe we have inadvertently collected such information.

10. International Data Transfers

10.1 Data Location

We primarily use service providers located in the UK and EU. Some providers may process data outside these regions.

10.2 Safeguards

When data is transferred internationally, we ensure:

• Adequate protections are in place (UK GDPR Art. 46)
• Standard Contractual Clauses are used where appropriate
• Providers comply with equivalent data protection standards

11. AI and Automated Processing

11.1 AI-Powered Features

We use AI to:

• Generate insights about your tracked items
• Parse uploaded documents to extract information
• Suggest reminders and due dates

11.2 Your Control

• AI features are optional - you can disable them
• AI-generated content is clearly marked
• You can correct or delete AI-generated insights
• No significant automated decisions are made about you

11.3 AI Data Usage

• Your data is used to provide personalised insights
• We do not use your data to train public AI models
• AI processing happens securely within our infrastructure or trusted providers

12. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for their privacy practices. We encourage you to read their privacy policies.

13. Changes to This Privacy Policy

13.1 Updates

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new policy on our website
• Sending you an email
• Displaying a notice in the Service

13.2 Acceptance

Continued use after changes take effect constitutes acceptance. If you do not agree, please stop using the Service and close your account.

14. Your California Privacy Rights (if applicable)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). Contact us for information about these rights.

15. Contact Us

15.1 Data Protection Enquiries

For privacy-related questions or to exercise your rights:

15.2 Supervisory Authority

If you are not satisfied with our response, you have the right to complain to:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

By using Home Concierge, you acknowledge that you have read and understood this Privacy Policy.