Privacy Policy

Last updated: [go-live date]

This policy explains how [LEGAL/TRADING NAME] ("CoverWatch", "we", "us") collects and uses personal data when you use the CoverWatch service at coverwatch.co.uk. We are the "data controller" for the account information you give us. For the information you upload about your subcontractors, we act as a "data processor" on your behalf — you remain the controller of that data.

1. What we collect

Account data

Your name, email address, company name, and a securely hashed password.

Content you enter

Details about your subcontractors (name, contact email, phone, trade, contract value) and their insurance certificates (coverage, insurer, policy number, limits, dates, and any document you upload).

Billing data

If you subscribe, payment is handled by Stripe. We receive your subscription status but never see or store your card details.

Technical data

A single essential session cookie to keep you signed in, plus standard server logs (e.g. IP address, timestamps) used to run and secure the service.

2. Why we use it, and our lawful basis

To provide the service (accounts, tracking, reminders) — basis: performance of our contract with you.
To send certificate reminders to your subcontractors on your instruction — basis: your legitimate interest as controller.
To run, secure and improve the service — basis: our legitimate interests.
To take payment — basis: performance of our contract.
To meet legal obligations (e.g. tax records) — basis: legal obligation.

3. Who we share it with (sub-processors)

We use a small number of trusted providers to run CoverWatch. We do not sell your data to anyone.

Provider	Purpose
Stripe	Payment processing
Brevo (Sendinblue)	Sending reminder emails
Cloudflare	DNS, network security and delivery
[HOSTING PROVIDER / self-hosted]	Application hosting and data storage

Some providers may process data outside the UK; where they do, appropriate safeguards (such as UK/EU standard contractual clauses) apply.

4. How long we keep it

We keep your account and content data for as long as your account is active. If you close your account we delete or anonymise personal data within [e.g. 90 days], except where we must keep records to meet a legal obligation.

5. How we protect it

Data is encrypted in transit (HTTPS). Access is restricted, and passwords are stored only as salted hashes. No system is perfectly secure, but we take reasonable measures appropriate to the data we hold.

6. Your rights

Under UK data protection law you have the right to access, correct, delete, restrict or object to our use of your personal data, and to data portability. To exercise any of these, email [[email protected]]. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies

We use only one strictly-necessary cookie, to keep you signed in. We do not use advertising or third-party tracking cookies.

8. Changes

We may update this policy; the "last updated" date above will change and, for significant changes, we'll notify you by email.

9. Contact

[LEGAL/TRADING NAME], [BUSINESS ADDRESS] — [[email protected]].