← Back
Privacy Notice
Last updated: June 2026 · Version 1.0
Prototype test notice — not the live privacy notice. The controller identity below is deliberately a placeholder, not a real company. This page exists so the product flow can be tested. The live notice, with the real controller identity and wording, will be published after data-protection review and before any genuine homeowner is onboarded.
This notice explains how Privy collects, uses, and protects your personal data. It is provided under Article 13 (data collected directly from you) and Article 14 (data received from your installer) of the UK General Data Protection Regulation (UK GDPR).
1. Who we are
Controller: Privy Prototype — demonstration only ("Privy", "we", "us"). Companies House number: Not applicable — prototype. Registered address: Prototype environment — not for correspondence.
ICO registration number: Not applicable — prototype.
Contact us about data matters: privacy@privyiot.co.uk
2. What data we collect and where it comes from
We collect personal data in two ways:
- Directly from you — when you create an account via our self-registration flow: your name, email address, property address, and notification preference.
- From your installer — when an installer provisions a Privy device at your property, they provide us with your name, email address, property address, and install date. If you activate via an installer-issued link, we receive the same information.
- Automatically from your device — continuous ultrasonic tank-depth readings, system health signals (battery, signal strength, temperature), and timestamps. Readings are associated with your property, not your identity.
3. Lawful basis for processing
- Contract performance (Article 6(1)(b)) — processing your contact details and tank readings to deliver the monitoring service you subscribed to, including alerts, monthly evidence summaries, and assessment certificates.
- Legal obligation (Article 6(1)(c)) — retaining assessment certificates to satisfy record-keeping obligations related to property conveyancing and environmental regulation.
- Legitimate interests (Article 6(1)(f)) — service improvement, fraud prevention, and security monitoring. We have assessed that these interests are not overridden by your rights.
4. How we use your data
- Delivering tank-level alerts via your chosen channel (SMS, WhatsApp, or email).
- Generating your monthly evidence summary and assessment certificates.
- Enabling your installer to access service history for your device.
- Sending account communications (account activation, billing, service changes).
- Anonymised analytics to improve sensor accuracy and alert thresholds.
We do not sell your personal data. We do not use your data for advertising.
5. Who we share your data with
- Your installer — as a joint controller, your installer can view your device's service history and readings to carry out maintenance. We have a data-sharing agreement in place.
- AWS (Amazon Web Services) — cloud infrastructure (EU West region). Data processed under a Data Processing Agreement.
- Stripe — payment processing. Stripe holds your payment card details; Privy does not store card numbers.
- Twilio — SMS and WhatsApp delivery. Only your mobile number and alert text are shared.
- Regulatory authorities — if required by law (e.g. the Environment Agency or ICO).
6. How long we keep your data
- Account data and readings — retained for the duration of your subscription plus 90 days after cancellation, to allow for account reinstatement. After that period they are permanently deleted.
- Assessment certificates — retained for 7 years from the date of issue, under our legal obligation to support property conveyancing records. Certificates contain your property postcode only — not your name or contact details.
- Billing records — retained for 6 years as required by HMRC accounting rules.
- Alert logs — retained for 2 years for service audit purposes.
7. Your rights
Under UK GDPR you have the right to:
- Access (Article 15) — request a copy of the personal data we hold about you. Use the "Download my data" button on the Account tab.
- Rectification (Article 16) — correct inaccurate data. Use the "Edit details" option on the Account tab, or contact us.
- Erasure (Article 17) — request deletion of your account and associated data. Use the "Delete my account" button on the Account tab. Note: assessment certificates are retained under our legal obligation (Article 17(3)(b)).
- Restriction (Article 18) — ask us to pause processing in certain circumstances.
- Data portability (Article 20) — receive your data in a machine-readable format. Use "Download my data".
- Object (Article 21) — object to processing based on legitimate interests.
To exercise any right, email privacy@privyiot.co.uk. We will respond within one month.
8. Automated decision-making
We use automated analysis to predict tank fill levels and determine when to send alerts. This does not produce legal or similarly significant effects — it is informational only and you remain in control of any emptying decisions.
9. Transfers outside the UK
All data is stored in AWS EU West (Ireland). Where sub-processors (Twilio, Stripe) may transfer data outside the UK, we ensure appropriate safeguards are in place under UK GDPR Chapter V (Standard Contractual Clauses or adequacy decisions).
10. How to complain
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO):
We would always prefer to resolve a concern directly first — please contact us at privacy@privyiot.co.uk.
11. Changes to this notice
We may update this notice. If we make material changes we will notify you by email before they take effect. The "last updated" date at the top of this page always reflects the current version.
Privy · Back to app · privacy@privyiot.co.uk