HouseCloud Privacy Policy

The data controller is [TO FILL IN: legal business name or sole trader name], trading as HouseCloud, at [TO FILL IN: business correspondence address].

Privacy contact: [TO FILL IN: monitored privacy email address]. ICO registration: [TO FILL IN: registration number, or confirmed exemption where applicable].

See our Contact page for support and privacy enquiries.

• Account information, such as your email address, account identifier and sign-in details.
• Files and records you choose to save, including receipts, warranties, home and vehicle information, subscriptions, health details and reminders.
• Information extracted from documents when you choose AI scanning, and details you confirm or correct.
• Membership, usage allowances and purchase records, where applicable.
• Support correspondence and technical information needed to operate and troubleshoot the service.
• Website usage statistics, such as visited pages, referral sources and device categories. These statistics do not tell us the names of individual visitors.

Only upload information you have the right to store. Avoid including unnecessary sensitive details or information about other people.

We use information to provide your account, store and retrieve your records, carry out scans you request, send account messages and reminder emails, manage memberships and respond to support requests. The proposed legal basis for these core services is performance of our contract with you.

Protecting accounts, preventing misuse, troubleshooting and understanding basic service usage may rely on legitimate interests, balanced against your rights. Legal obligations may require us to retain certain transaction or business records. Where consent is required, including for non-essential tracking or marketing, it must be obtained separately and can be withdrawn.

Health information and some uploaded documents may contain special-category data. [TO FILL IN: confirm an appropriate UK GDPR Article 9 condition and any required explicit-consent process before processing this data; an upload alone is not explicit consent.]

Normal documents are stored privately with access restricted to your account. Files are opened using short-lived links rather than permanent public addresses. Someone with a valid temporary link may be able to open the file until it expires, so do not share these links.

Private Vault adds a separate PIN or a device passkey on supported devices and locks after five minutes of inactivity. Vault access is checked separately from your normal sign-in. Paid memberships and related features are opening soon; availability is shown in the app.

Face ID or fingerprint verification is handled by your device’s passkey system; HouseCloud does not receive your facial image or fingerprint template. HouseCloud stores passkey credentials used to verify an unlock. Optional app lock is an additional privacy screen, not a replacement for account security.

No online service can guarantee absolute security. Keep your device, account password and Vault PIN secure.

When you choose scanning, the selected document and the instructions needed to read it are sent through Lovable AI to OpenAI for extraction. The scan request disables result storage, but this is not a guarantee that providers keep no operational logs. You can instead enter record details manually without requesting an AI scan. Review extracted information before saving it; AI can make mistakes.

[TO FILL IN: confirm the AI providers’ legal entities, processing locations, retention periods and whether submitted documents may be used for model training under the applicable service terms.] Do not assume AI processing stays in the UK.

HouseCloud uses Lovable Cloud for hosting, account services and private file storage, Lovable AI and OpenAI for requested scans, and Lovable Email for account and reminder messages sent from notify.housecloud.store. Stripe handles website payment processing where purchases are enabled; HouseCloud does not store your full payment card details. Live payments are not currently enabled.

[TO FILL IN: confirm the legal entities, email and analytics providers, their privacy notices and the relevant processing agreements.] App-store purchases and phone push notifications are not currently offered.

Information may also be disclosed where required by law, to protect users and the service, or in a business transfer subject to applicable safeguards.

Our providers may process information outside the UK. We do not claim UK-only hosting.

[TO FILL IN: verify the countries involved and applicable safeguards, such as UK adequacy regulations or approved contractual safeguards, including any required transfer assessments.]

The web app uses browser storage for sign-in sessions, app-lock preferences and activity timestamps. A sidebar preference cookie, where used, lasts seven days. We also receive website traffic statistics, including page visits and referral sources.

[TO FILL IN: confirm a cookie and browser-storage inventory, analytics provider, data collected, expiry periods and whether consent is required. Where non-essential tracking requires consent, implement that choice before enabling it.] This policy does not itself obtain cookie consent.

Documents and records remain in your account until you delete them or request account deletion. Cancelling or downgrading a membership does not automatically delete your documents. You can delete individual documents or use My Account to request deletion of your account and stored files.

[TO FILL IN: confirm deletion completion times, backup retention and expiry, technical log retention, support-message retention, and any legal retention period for transaction records.] Deleting account content may not immediately remove copies in backups or records that must be retained by law; confirm the actual arrangements before finalising this policy.

Depending on the circumstances, you may have rights to access, correct or erase your information, restrict or object to processing, receive eligible information in a portable format, and withdraw consent without affecting earlier lawful processing. A data portability request is not the same as an in-app export feature.

Contact [TO FILL IN: privacy email] to make a request. We may verify your identity. We normally respond within one month; some complex requests may take longer where the law allows.

You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. You do not need to contact us first.

Proposed default: HouseCloud is intended for adults aged 18 and over. [TO FILL IN: confirm the minimum age and align sign-up and service terms with it.] If you believe a child has provided information without appropriate permission, contact the privacy address once confirmed.

We may update this policy as the service changes. The effective date will be shown above, and significant changes will be communicated where required.