Privacy Policy

1. Introduction

PostcodeProperty.ai ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our services.

We are committed to GDPR compliance and the principles of data minimization. We only collect data that is necessary to provide our services.

2. Information We Collect

2.1 Information You Provide

When you purchase a report, we collect:

• Email address: To send your report and order confirmations
• Property address/postcode: To generate your report

We do not collect your name, phone number, or physical address unless you voluntarily provide it when contacting support.

2.2 Developer Account Information

When you use our API or MCP developer services, we process:

• your sign-in and contact email address;
• your API account name, plan and subscription status;
• API key names, environment and shortened prefix (never the recoverable full key); and
• Stripe customer/subscription identifiers and billing-cycle information.

2.3 API and MCP Usage Information

To authenticate requests, enforce limits, calculate credits, operate the service, investigate abuse and support customers, we record limited request metadata. This can include the route or tool, request ID, key/account identifier, REST or MCP transport, timestamp, response status, credits, response time, cache state, data sections and the queried postcode where relevant.

We do not store the full API key, Authorization header, request or response body, payment-card details, or arbitrary AI prompts in the usage ledger. An account owner can see their own recent usage in the developer dashboard; other customers cannot. Access by our staff is restricted to people who need it for operations, security, billing or support.

2.4 Property and Source Data

Property, transaction, planning, environmental and location facts returned by the service come from the public, licensed or contracted sources identified in our provenance and attribution material. We keep that source data logically separate from developer-account and billing records. Do not submit secrets, special-category personal data or unnecessary personal information in API parameters or support requests.

2.5 Payment Information

Payment processing is handled entirely by Stripe. We do not receive, store, or have access to your full card details. Stripe's privacy policy governs their handling of your payment information.

2.6 Automatically Collected Information

We may automatically collect:

• IP address (for fraud prevention and security)
• Browser type and version
• Device information
• Pages visited and time spent
• Referring website

For purchase attribution, we keep a first-touch source, referring website hostname, campaign labels and up to 20 redacted page paths on your device for no more than 30 days. Query strings, fragments, form entries, full property/report identifiers, IP addresses and browser identifiers are excluded. This snapshot is sent to Stripe only when a signed-in account owner starts checkout, and is disabled when Global Privacy Control or Do Not Track is enabled.

3. How We Use Your Information

We use your information to:

• Generate and deliver your property reports
• Send order confirmations and download links
• Respond to customer support inquiries
• Prevent fraud and abuse
• Improve our services
• Authenticate API/MCP calls and enforce rate and credit limits
• Reconcile subscriptions, entitlements and usage
• Monitor availability, data-source health and security
• Comply with legal obligations

4. Legal Basis for Processing (GDPR)

We process your data under the following legal bases:

• Contract: Processing necessary to fulfill your order
• Legitimate interests: Fraud prevention, service improvement
• Legal obligation: Tax records, regulatory compliance

5. Data Sharing

We share your data only with:

• Stripe: Payment processing (as a data processor)
• Postmark: Email delivery (as a data processor)
• Cloud hosting providers: Data storage (as data processors)
• Operational providers: Distributed rate limiting, error monitoring and privacy-conscious product analytics

We do not sell your personal data to third parties. We do not share your data with advertisers or marketing companies.

6. Data Retention

We retain your data for the following periods:

• Order records: 7 years (for tax and legal compliance)
• Report download links: 30 days from purchase
• Support correspondence: 2 years
• Website analytics: 26 months (anonymized)
• Developer account and entitlement records: While your account is active and afterwards only as needed for contractual, tax, fraud, dispute and legal obligations
• Detailed API/MCP usage: For the period reasonably required for billing, limits, security and customer support; older data may be deleted or retained only in aggregated form

Enterprise agreements may specify a different usage-retention period. You may ask us for the retention position applying to your account or request deletion, subject to the legal and security exceptions above.

7. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Portability: Receive your data in a structured format
• Object: Object to processing based on legitimate interests
• Complaint: Lodge a complaint with the ICO

To exercise these rights, please contact us at hello@postcodeproperty.ai

8. Cookies

We use essential cookies for:

• Session management
• Security (CSRF protection)
• Payment processing

We do not use advertising cookies or third-party tracking cookies. We may use analytics cookies with your consent.

9. Data Security

We protect your data through:

• HTTPS encryption for all data transmission
• Encrypted database storage
• Regular security audits
• Access controls and authentication
• Secure cloud infrastructure

10. International Transfers

Your data may be processed in countries outside the UK/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

11. Children's Privacy

Our services are not directed at individuals under 18. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on our website.

13. Contact Us

For privacy-related inquiries:
Email: hello@postcodeproperty.ai

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk