Privacy Policy | BuildWiz UK

Who we are

buildwiz.uk is operated by Octasoft Ltd, a company registered in England and Wales (company number 06633005), with its registered office at Belmont Suite, Paragon Business Park, Chorley New Road, Bolton, BL6 6HG. Our website address is https://buildwiz.uk.

If you have any questions about this privacy policy or how we handle your data, you can contact us at privacy@buildwiz.uk.

What data we collect

We collect the minimum amount of data needed to run the site:

Newsletter sign-up: your email address, collected when you subscribe to our newsletter, open an email-only guide or download, or request the budget spreadsheet. We use this solely to send you an email when we publish a new blog post, after you confirm the address. If you are signed in and ask for new posts, we use the address you signed in with and skip the confirmation email.
Notify-me requests: your email address (or the one you are signed in with), collected when you ask to be told when something is available, such as a product that is not on sale yet. We use it only to email you once when that thing becomes available. It does not add you to the newsletter.
Account sign-in: your email address when you sign in with an emailed link, or your name and email address from your Google account when you use Sign in with Google. We use this data only to create your account and recognise your Access Pass across devices.
Your projects: if you set up a project while signed in, we store what you enter: its name, type, size, budget, region and specification, the tasks you tick off, and any notes you write. We use this only to show it back to you.
Analytics: we use Vercel Analytics as our primary analytics tool. Vercel Analytics is a privacy-first, cookie-free service that does not collect personally identifiable information. All data is aggregated and no individual visitors can be identified. It does not require consent under UK GDPR or the Privacy and Electronic Communications Regulations. For more information, see Vercel's privacy policy.
Google Analytics (consent-based): we also use Google Analytics to collect additional usage data such as pages visited, time on site, and referral source. Google's script loads on every page, but until you accept analytics cookies in our banner it runs in Google's Consent Mode: it sets no cookies, and Google receives only basic, cookieless signals (for example that a page was viewed). After you accept, it uses cookies to recognise repeat visits. You can withdraw consent at any time by clearing your browser cookies or local storage. For more information, see Google's privacy policy.
Payment data: payments for the Access Pass are processed by Stripe. We never store your full card details on our servers; we store your email address and your Access Pass status so that we can recognise your purchase. Stripe handles all payment data in accordance with PCI DSS standards.
Rate My Quote: when you upload, photograph or paste a builder's quote, we send it to Google's Gemini API, which reads it to pull out the line items and terms. We do not store the document or its text, on our servers or in our logs: if reading fails, we log only the type of error, never the content. Google processes the document as our service provider under its paid-service terms, which means it is not used to train Google's models, but Google may keep it for a limited period to detect abuse of its service.
Rate My Quote reports: we save the report: the figures and categories, the line descriptions, exclusions, payment and guarantee terms as the reader extracted them from your quote, and our findings. A quote usually contains your builder's details as well as yours. The report has no field for a name or address and the reader is instructed not to copy them into line descriptions, but that relies on an AI model following an instruction, so a name can occasionally slip through. Email addresses, phone numbers, postcodes and bank details are removed from line descriptions by our own code before the report is saved. Reports are private to you. If you are signed in, the report is linked to your account and project. If you are not, it is linked to your browser and deleted after 30 days unless you sign in. You can delete any report from the page, and if you ask us to delete your account, we delete them all.
Anonymous price benchmark: unless you tick “Don’t include mine”, we also add the quote’s figures to an anonymous benchmark, such as extension type, region, specification, size rounded to 5m², the month, the total, line amounts by category and a count of findings. It holds no text from your quote, and we store no link between it and you, your account or your report. Once a report is deleted we cannot tell which entry was yours, so we cannot remove a single entry on request.
Contact form: your name, email address and message, which we email to our own inbox so we can reply. We keep the email only as long as we need it to deal with your enquiry.
Postcode lookups: when you enter a postcode to see which council decides planning applications for it, we send the postcode to postcodes.io to find its location, and that location to the government's planning data service (planning.data.gov.uk) to find the council. We do not store the postcode. If you choose “Remember my area”, your browser keeps the postcode district (such as OX1, not the full postcode) and the check's results so our guides can show local facts; “Forget my area” removes them.
Abuse protection: to stop automated abuse, some forms (sign-in, newsletter, Rate My Quote) count requests per IP address. Those counters expire within hours.
Link clicks: when you click a retailer link or one of our own calls to action, we record the page, the link and the time, to see which pages are useful. The record contains nothing about you: no IP address, account or cookie.

Our lawful basis

UK GDPR requires us to have a lawful basis for each use of personal data. Ours are:

Contract: your account, sign-in, projects, Access Pass purchase, and Rate My Quote reports, which we need in order to provide the service you asked for.
Consent: the newsletter, notify-me emails, and Google Analytics. You can withdraw consent at any time.
Legitimate interests: reading the quotes you submit to Rate My Quote, including the builder's details that appear on them (our interest, and yours, is in checking a quote you have received, and we keep as little of the builder's details as we can); the anonymous price benchmark; answering messages you send through the contact form; postcode lookups you ask for; abuse protection; and link click counts.
Legal obligation: keeping purchase and tax records for as long as the law requires.

Where we rely on legitimate interests, you have the right to object (see “Your rights under UK GDPR” below).

Signing in with Google

If you choose Sign in with Google, Google shares your name, your email address, and your basic profile with us so that we can sign you in. We use this information only to operate your account and unlock content you have paid for. We do not request or receive access to any other Google services or data (no Gmail, Drive, contacts, or files), and we never share or sell this information.

Google sign-in is optional: you can always sign in with an emailed link instead. You can ask us to delete your account data at any time at privacy@buildwiz.uk.

Third-party processors

We share your data only with the following third-party services, each of which processes data on our behalf:

Resend — email delivery for newsletters and notifications.
Vercel — website hosting and serverless functions.
Upstash — data storage for newsletter and notify-me email addresses, short-lived sign-in links, Rate My Quote phone hand-off codes (kept for 15 minutes and holding no quote content), and abuse-protection counters.
Vercel Analytics — privacy-first website analytics, included with our Vercel hosting (no cookies, no personal data, always active).
Google Analytics — website analytics (only active with your consent).
Stripe — payment processing for the Access Pass.
Neon — database hosting for account, project, Access Pass and Rate My Quote report data.
Google — optional Sign in with Google (only used if you choose it; see “Signing in with Google” above).
Google Gemini API — reads the quote documents you submit to Rate My Quote, to extract the figures. A second request sends only the extracted, redacted details: line items, figures and short quoted terms, never the document.

We do not sell, rent, or share your personal data with any other third parties.

International transfers

Some of these providers (Vercel, Stripe, Resend, Neon, Upstash and Google) are based in, or process data in, the United States or elsewhere outside the UK. Where personal data leaves the UK, it is protected by the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or otherwise by the provider's data processing terms incorporating the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. You can ask us for details at privacy@buildwiz.uk.

How long we keep your data

Newsletter emails: retained until you unsubscribe. When you unsubscribe (the link in every email, then the “Unsubscribe” button), your email is deleted from our mailing list. If you sign up but never confirm, we send nothing beyond the one confirmation email; ask us and we will delete the address.
Notify-me emails: retained until the relevant content is launched and you have been notified, or until you ask us to remove it.
Analytics data: Vercel Analytics retains aggregated, anonymous usage data — no personal data is involved. Google Analytics retains aggregated usage data and cookies expire after the standard retention period set by Google. No personally identifiable information is stored by us.
Payment data: managed by Stripe in accordance with their retention policies and legal obligations.
Account and sign-in data: your email address (and name, if you used Google sign-in) is retained while your account or Access Pass is active, and deleted when you ask us to at privacy@buildwiz.uk.
Rate My Quote reports: kept with your account until you delete them or your account. Reports made without signing in: 30 days. Anonymous benchmark entries: kept indefinitely, as they identify no one. Uploaded documents: not stored by us (see above for Google's abuse-monitoring retention).
Projects: kept until you delete the project or your account.
Purchase records: a record of each purchase (in Stripe and our accounts) is kept for six years, as UK tax law requires, even if you delete your account.

Your rights under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights:

Right of access: you can request a copy of the personal data we hold about you.
Right to rectification: you can ask us to correct any inaccurate data.
Right to erasure: you can ask us to delete your personal data.
Right to restrict processing: you can ask us to pause using your data while a concern is looked into.
Right to object: you can object to any use of your data that relies on legitimate interests.
Right to data portability: you can request your data in a machine-readable format.
Right to withdraw consent: you can unsubscribe from our newsletter at any time using the link in every email, or by contacting us directly, and withdraw analytics consent by clearing this site's cookies and local storage.
Right to complain: if you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

To exercise any of these rights, contact us at privacy@buildwiz.uk.

Cookies

Our primary analytics tool, Vercel Analytics, does not use cookies. It runs without any tracking cookies and does not collect personal data.

We set one essential, encrypted session cookie (bw_session) when you sign in, buy an Access Pass, get access to email-only guides, or use Rate My Quote without signing in. It remembers what you have access to and which quote reports are yours. It is strictly necessary to provide the service, contains no tracking data, lasts up to a year, and is removed when you sign out.

Signing in can also set short-lived, strictly necessary security cookies: bw_login_browser is a random number that lets a sign-in link tell whether it was requested in this browser (up to 15 minutes), bw_magic_link holds an emailed sign-in link between opening it and pressing Continue (up to 15 minutes), and bw_oauth_state protects a Google sign-in while you are on Google's page (up to 10 minutes). None of them track you, and they expire on their own or when sign-in finishes.

buildwiz.uk also uses analytics cookies provided by Google Analytics. These cookies are only set after you give consent via the cookie banner displayed when you first visit the site. If you decline or have not yet made a choice, no Google Analytics cookies are set (see “Google Analytics” above for what Google receives without them).

We also use your browser's local storage to remember your cookie choice, your progress through a guide, and that you have subscribed to the newsletter (including the email address you subscribed with, so we don't ask again), and, only if you ask us to, your area from the address check (postcode district and results, kept for up to 6 months). This stays on your device.

You can withdraw your consent at any time by clearing your browser's local storage or cookies for this site. There are no advertising cookies or third-party tracking cookies on buildwiz.uk.

Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this page periodically.

Contact

If you have any questions or concerns about this privacy policy, please contact us at privacy@buildwiz.uk.