Privacy Policy — Track My Build

Track My Build Ltd ("we") is the data controller for personal information processed through the Platform. This policy explains what we collect, why, and your rights under UK GDPR and the Data Protection Act 2018.

Data we collect

Account data — name, email, role (customer or builder), password hash.
Project data — project titles, descriptions, milestones, uploaded photos, invited team members.
Payment data — processed by Stripe. We never see or store full card numbers.
Verification data — for Builders receiving payouts, KYC / AML details required by law and held by Stripe.
Technical data — IP address, browser, device, and usage logs for security and abuse prevention.

Why we use it

To provide the payment protection service (contract performance).
To meet legal obligations (AML, tax, record-keeping).
To keep the Platform secure and prevent fraud (legitimate interest).
To send transactional emails (invites, milestone approvals, payment confirmations).
To respond to your support requests.

Sharing

We share data only with processors that help us run the service:

Stripe — payments, protected client account, KYC, payouts.
Supabase — encrypted database and file storage (EU region).
Email provider — transactional email delivery on our behalf.
Team members you explicitly invite to a project.

We never sell personal data. We may disclose data if required by law or a valid court order.

Retention

Account and project data is retained for the life of your account plus 7 years to meet UK financial record-keeping obligations. You can request earlier deletion of non-financial data (project photos, descriptions) at any time.

Your rights

Under UK GDPR you can request to:

Access the personal data we hold about you.
Correct inaccurate data.
Delete data (subject to legal retention limits above).
Export your data in a portable format.
Withdraw consent or object to processing.
Complain to the ICO (ico.org.uk).

To exercise any right, email privacy@trackmybuild.co.uk. We respond within 30 days.

Security

All traffic is served over TLS 1.3. Data at rest is encrypted. Passwords are hashed with bcrypt. Access to production systems is restricted and logged. We enforce role separation so a customer account cannot see builder-only data and vice versa.

Cookies

We use strictly necessary cookies to keep you signed in and to remember your session preferences. We do not use advertising cookies.

Contact

Track My Build Ltd — privacy@trackmybuild.co.uk