Legal
Privacy policy.
How we collect, use and protect your data. Last updated June 2026.
Contents
1. Introduction
Welcome to Havnwright ("we", "us", "our"). We are committed to protecting your privacy and being transparent about how we collect, use, and safeguard your personal information.
Havnwright operates a renovation information and tools website for UK homeowners and property professionals, and a separate mobile application for contractors (available on iOS and Android). The two are different in an important way for your privacy:
- The website is free and account-less. You do not create an account, you do not log in, and most of our tools run entirely in your browser. We only receive personal information if you choose to send it (for example, by using the contact form or subscribing to the newsletter).
- The contractor mobile app uses accounts. Contractors sign up and log in inside the app to manage their business. Account-based collection described below applies to the app, not the website.
Important Clarification
We are a research and information platform. Our cost estimates and recommendations are based on data analysis, NOT from actively working as contractors or professional consultants. Always seek professional advice for structural assessments and regulatory compliance.
Data Controller
- Company: Havnwright LTD
- Email: privacy@havnwright.com
- ICO Registration: ZC015131
This Privacy Policy explains how we handle your personal information in compliance with:
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Privacy and Electronic Communications Regulations (PECR)
2. Information We Collect
What we collect depends on how you use Havnwright. The website is account-less, and many of our tools never send your inputs to us at all.
2.1 Information You Give Us on the Website
The website does not ask you to create an account or set a password. We only collect personal information when you actively choose to send it:
- Contact form: your name, email address, your message, and the reason for getting in touch (and, optionally, your company name). We use this only to respond to your enquiry.
- Newsletter: your email address, if you choose to subscribe. You can unsubscribe at any time using the link in every email.
2.2 Tool Inputs
Most of our homeowner tools run in your browser. Where a tool does send data to us, we keep it anonymous.
- Cost calculator: project type, a partial postcode (for example the first part such as "SW1") for regional pricing, property type and size, and your selections. This is stored anonymously to improve our estimates for everyone and is not linked to your identity. We do not ask for your name, email, or full address, and the generated report and scope-of-works PDFs are produced on the spot and not stored.
- Planning checker, neighbour-letter generator, building-regulations guide, materials estimator, and retrofit tools: these run in your browser. Anything you type, including any names and addresses you enter into the neighbour-letter tool, stays on your device and is not sent to us or stored by us.
2.3 Technical and Security Data (Automatic)
- IP address: we process your IP address to keep the service secure, to apply rate limiting, and to prevent abuse. These security records are held in our logs. Separately, and only with your consent, your IP address may be processed by our analytics providers. We do not sell or advertise against your IP address.
- Browser type and version, device type and operating system
- Pages visited and time spent, and the page that referred you (analytics, with consent)
2.4 Contractor Mobile App Data
Scope of this section: the collection below applies to the Havnwright mobile app for contractors, available on iOS and Android. Homeowners use the website only (account-less) and can skip this section. There is no homeowner mobile app, and there is no signup or login on the website.
When a contractor creates an account and uses the mobile app, we collect:
- Account information: email address (required), name, company name, and a password (encrypted, we never see the plain text)
- Business data you enter: jobs, quotes, invoices, expenses, clients, and similar records you create to run your business in the app
- Device information: device type, operating system version, unique device identifiers, mobile network information
- Push notification tokens: to send you job updates, messages, and notifications (you can opt out in app settings)
- Photos and files: when you choose to upload project photos or documents using your device camera or storage
- Location data: approximate location (postcode level) for regional pricing. We do not collect precise GPS coordinates.
Mobile-Specific Services
The mobile app uses the following third-party services:
- Supabase: authentication and data storage (Supabase Privacy Policy)
- Firebase Cloud Messaging (FCM): push notifications (Google Privacy Policy)
- RevenueCat: in-app subscription processing on iOS and Android. RevenueCat mediates payments between the app, the Apple App Store, and the Google Play Store billing systems, and links subscriptions to your Havnwright account. (RevenueCat Privacy Policy)
- Sentry: crash and error reporting. When the app crashes or hits an error, technical diagnostic information (stack traces, device model, OS version, app version) is sent to Sentry to help us fix bugs. We do not send your photos, messages, postcode, or project content to Sentry. (Sentry Privacy Policy)
App Permissions
The mobile app may request the following permissions:
- Camera: to capture project photos, scan documents and receipts
- Photo Library / Storage: to upload documents and photos
- Microphone: optional. Used only when you tap the voice-input icon on a text field to dictate notes, diary entries, or messages instead of typing. Audio is processed for speech-to-text and is not retained as a recording.
- Speech Recognition: optional. Converts your spoken voice input into text on-device (iOS) or via the system speech recogniser (Android). Active only while you are dictating.
- Notifications: to send you updates and messages (optional)
You can manage app permissions in your device settings at any time.
App Store Data Sharing
When you download our app from the Apple App Store or Google Play Store, those platforms may collect additional information as described in their respective privacy policies. We do not control or have access to data collected by app stores.
3. How We Use Your Information
3.1 Running the Website
- Provide our free cost estimates, tools, and educational content
- Generate cost estimates based on the inputs you provide
- Respond to enquiries you send through the contact form
- Send our newsletter, if you have subscribed (you can unsubscribe at any time)
- Keep the service secure: rate limiting, abuse prevention, and fraud protection
3.2 Anonymised & Aggregated Data
To continuously improve the accuracy of our cost estimates for all users, we anonymise and aggregate data from calculator sessions. Specifically:
- Calculator usage: when you use our cost calculator, inputs such as project type, region, property type, and size category are stored as anonymised pricing signals. These are not linked to your personal identity and are used to improve the accuracy of estimates for all users.
- Published reports: we may publish anonymised, aggregated pricing reports (such as regional cost indices or renovation trend data). These reports contain only statistical summaries and can never be traced back to any individual.
Important: aggregated data is fully anonymised and cannot identify you. Because this data is no longer personal data under GDPR once aggregated, it cannot be individually extracted or deleted.
3.3 Running the Contractor App
- Create and manage contractor accounts
- Deliver app features (jobs, quotes, invoices, expenses, and similar tools)
- Send push notifications you have opted in to
- Process subscriptions via the app stores and RevenueCat
3.4 Legal Basis for Processing
| Purpose | Legal Basis |
|---|---|
| Responding to contact enquiries | Legitimate Interest |
| Newsletter | Consent |
| Cost calculator & anonymised pricing intelligence | Legitimate Interest (anonymised) |
| Security, abuse prevention & rate limiting | Legitimate Interest |
| Analytics & usage patterns | Consent |
| Contractor app account & features | Contract |
| Push notifications | Consent |
| Legal compliance | Legal Obligation |
4. Data Sharing & Disclosure
4.1 Service Providers
We work with trusted third-party providers. The providers marked "contractor app" are used only for the mobile app, not the website.
- Supabase: database and authentication (EU servers)
- Vercel: website hosting and CDN (and, with your consent, privacy- friendly analytics)
- Resend: transactional and newsletter email delivery (receives the email address and content of messages we send you)
- Upstash: distributed rate limiting (Redis). Stores short-lived counters keyed by IP address to throttle abusive request patterns. IP addresses are personal data under UK GDPR; retention here is minutes to hours. (Upstash's Privacy Policy)
- Cloudflare Turnstile: bot-protection challenge on the contact form. Cloudflare receives a challenge token from your device and returns a verification result; no message content or personal identifiers are sent. (Cloudflare's Privacy Policy)
- Sentry: crash and error reporting for the website and mobile app. Receives technical diagnostic data (stack traces, device model, OS version, app version) when something breaks, and may capture a small sample of anonymised session replays to diagnose errors. No project content is sent. (Sentry's Privacy Policy)
- Google Analytics: website usage analytics. Loaded only after you consent to analytics cookies. (Google's Privacy Policy)
- Anthropic:AI processing for certain features. Where we use AI, the content is processed only to deliver that feature and is not used to train AI models. (The website's public AI assistant is currently disabled.) (Anthropic's Privacy Policy)
- RevenueCat (contractor app):in-app subscription management on iOS and Android. Links App Store / Play Store subscription transactions to a contractor's Havnwright account. (RevenueCat's Privacy Policy)
- Apple App Store + In-App Purchase (contractor app): when a contractor downloads the app on iOS or pays for a subscription, Apple processes the transaction and shares anonymised or aggregated purchase information with us via RevenueCat. We do not see your Apple ID password or full card details. (Apple's Privacy Policy)
- Google Play (contractor app): when a contractor downloads the app on Android or pays for a subscription, Google Play processes the transaction and shares anonymised or aggregated purchase information with us via RevenueCat. We do not see your Google account password or full card details. (Google's Privacy Policy)
- Firebase Cloud Messaging (contractor app): push-notification delivery (device tokens and notification content). (Google's Privacy Policy)
4.2 What We Do NOT Do
- ❌ Sell your personal data to third parties
- ❌ Share your data for third-party marketing
- ❌ Provide your contact details to unsolicited marketers
- ❌ Take payments on the website (the website is free; the contractor app bills through the app stores)
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Contact form submissions | Up to 24 months (account-deletion requests: 6 years) |
| Newsletter subscription | Until you unsubscribe |
| Anonymous calculator & pricing signals | Indefinitely (fully anonymised, non-personal data) |
| Security & abuse-prevention logs (incl. IP) | IP addresses removed after 90 days |
| Website analytics | 26 months (anonymised, with consent) |
| Contractor app account & business data | While the account is active, then deleted on request |
| Contractor transaction records | 7 years (HMRC requirement) |
6. Data Security
6.1 Technical Measures
- Encryption: TLS/SSL in transit, AES-256 at rest
- Infrastructure: hosting on Supabase (SOC 2 Type II, ISO 27001) and Vercel (SOC 2 Type II) with DDoS protection
- Access Controls: row-level security at the database, role-based permissions, and MFA on administrative accounts. Access to data is granted only on a least-privilege basis to personnel who need it for a specific operational purpose.
- Application Security: strict Content Security Policy, HSTS, CSRF protection on authenticated mutations, tiered rate limiting, and file-type verification by magic bytes on uploads
- Monitoring: off-host error reporting via Sentry, and an append-only audit trail at the database level
- Vulnerability Disclosure: /.well-known/security.txt for responsible disclosure
6.2 Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33. If the breach is likely to result in a high risk to you, we will notify you directly without undue delay, explaining the nature of the breach and the steps we are taking to address it.
6.3 Your Responsibility (Contractor App)
If you have a contractor account in the mobile app:
- Use a strong, unique password
- Don't share your login credentials
- Report suspicious activity immediately
7. Your Rights (UK GDPR)
You have the following rights:
- Right to Access: request a copy of your data
- Right to Rectification: correct inaccurate data
- Right to Erasure: request deletion ("right to be forgotten")
- Right to Restrict Processing: limit how we use your data
- Right to Data Portability: export your data in a machine-readable format
- Right to Object: object to processing based on legitimate interests
- Right to Withdraw Consent: withdraw consent at any time
How to Exercise Your Rights
Newsletter: use the unsubscribe link in any newsletter email.
Contractor app account:you can delete your account and data from within the app's settings.
Any other request:
Email: privacy@havnwright.com
Subject: Data Subject Request - [Your Request Type]
Response time: within 30 days
Complaints
If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.
9. AI Data Processing
We use AI sparingly, and only to power specific features. Our AI partner is Anthropic (Claude).
9.1 Safeguards
- Where AI is used, content is processed only to deliver that feature
- We do not use your data to train AI models
- The website's public AI assistant is currently disabled
If we introduce new AI features, we will update this policy to explain how your data is used and protected.
10. Children's Privacy
Our services are not intended for users under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal information, contact us immediately at privacy@havnwright.com.
11. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices, services, or legal requirements.
- We'll update the "Last Updated" date
- Material changes will be notified to newsletter subscribers and app users
12. Contact Us
For privacy questions or data requests:
- Email: privacy@havnwright.com
- Response Time: within 5 business days (data requests within 30 days)