Privacy notice
How Plotworthy handles personal data, written to be readable rather than defensive.
What we collect
Account details you give us (email, name, password held only as a hash by our authentication provider); the properties you search, save and generate reports for; quote enquiries you send, including the message and contact email; professional listing details if you publish one; messages sent through the contact form; and basic technical logs needed to run and secure the service.
Why we hold it
To provide the account and reports you asked for (performance of a contract); to pass a quote enquiry to the professional you selected (your request); to keep the service secure and prevent abuse (legitimate interests); and to meet accounting obligations where a payment is taken (legal obligation).
Who sees it
Our hosting and backend provider processes data on our behalf. When you request a quote, the enquiry and your contact email are shared with the professional you chose so that they can reply — that is the point of the feature. We do not sell personal data, and we do not sell or share your saved properties with anyone.
Property data
Planning, EPC, Land Registry and HMO licensing information shown in reports is public record data about properties, published by government and local authorities under open licences. It is not derived from your personal data.
How long we keep it
Account and saved-property data for as long as your account exists, and up to 30 days after deletion in backups. Quote enquiries are retained by the receiving professional under their own obligations. Contact-form messages are kept for 24 months. Billing records are kept for 6 years where required by UK tax law.
Your rights
Under UK GDPR you can request access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interests. Email us through the contact page and we will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).
Cookies and storage
We use only what the app needs to function: a session token held in your browser so you stay logged in, and local storage for interface preferences. No advertising or cross-site tracking cookies are set.
Security
Data is stored in managed infrastructure with encryption in transit, row-level access rules so one account cannot read another's data, and paid report content withheld at the server rather than hidden in the browser.
Questions? Contact us.