1. Who We Are
InspectIQ (“we”, “us”, “our”) provides an AI-assisted property defect analysis service for property owners in the United Kingdom. We are the data controller for the personal data described in this policy.
If you have questions about how we handle your data, please contact us at hello@inspectiq.uk.
2. What Data We Collect
| Data | Purpose | Legal Basis |
|---|---|---|
| Email address | Account creation and authentication | Contract performance |
| First name, last name, phone (optional) | Profile personalisation and contractor lead matching | Legitimate interest / consent |
| Property addresses and postcodes | Identifying the property being inspected | Contract performance |
| Property photographs | AI defect analysis to generate your report | Contract performance |
| Questionnaire responses | Providing context for AI analysis | Contract performance |
| Payment references | Recording that payment was made (we never see card numbers) | Contract performance |
| AI analysis results and PDF reports | Delivering the service you paid for | Contract performance |
| Browser and device information | Error monitoring and service reliability (via Sentry, when configured) | Legitimate interest |
| Terms acceptance record | When you accept our Terms of Service, we record the date, version accepted, and your IP address for legal compliance purposes | Legitimate interest |
3. How We Use Your Data
We use your personal data to:
- Create and manage your account
- Process your property photographs through AI analysis
- Generate and deliver inspection reports
- Process payments via Stripe
- Match you with local contractors if you opt into our contractor leads service
- Monitor and improve service reliability
- Improve the accuracy and quality of our analysis
- Contribute to anonymised property defect research (containing no names, email addresses, or property addresses)
- Comply with legal obligations
4. How Your Photos Are Processed
When you upload property photographs, they are sent to OpenAI's API for AI-powered defect analysis. OpenAI processes images solely to generate analysis results and does not retain your images beyond the duration of the API request, in accordance with their enterprise privacy commitments. Your photos are not used to train AI models.
Your original photographs are stored securely in our database (hosted by Supabase) and are accessible only to you through your account.
5. Payment Data
All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. We never receive, store, or have access to your full card number, CVV, or other sensitive payment details.
We store only a reference to your Stripe payment session and payment intent so that we can verify your purchase and deliver your report.
6. Contractor Leads (Optional)
If you choose to use our contractor matching service, we collect additional contact details (name, email, phone number, and postcode area) with your explicit consent. This information is shared with relevant local contractors to provide you with repair quotes.
Contractors do not receive your full property address or postcode until you accept their quote. You may withdraw your consent at any time by contacting us.
7. Third-Party Services
We share data with the following third-party service providers, each of which processes data in accordance with their own privacy policies:
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Database, authentication, and file storage | All account and inspection data |
| Stripe | Payment processing | Payment details (handled directly by Stripe) |
| OpenAI | AI defect analysis | Property photographs and inspection context |
| Vercel | Application hosting and analytics (when configured) | Standard web request data |
| Sentry | Error monitoring (when configured) | Error logs, browser/device information |
| Upstash | Rate limiting (when configured) | Anonymised request counters |
| Resend | Email notifications for contractor leads | Lead contact details (name, email, phone, postcode area) |
| postcodes.io | UK postcode area lookup | Postcode only (no personal data) |
| Energy Performance Certificate Register (epc.opendatacommunities.org) | Property energy performance data lookup | Postcode only (no personal data) |
8. Data Retention
We retain your data for the following periods:
- Active accounts: We retain your data (photos, reports, analysis results, property information) for as long as your account is active.
- Account deletion: When you delete your account, we remove your personal information (name, email, property address) within 30 days. Anonymised data (defect photos, analysis results, cost data — with no identifying information) is retained to improve our analysis and contribute to property defect research.
- Inactive accounts: If you have not logged in for 2 years, we will email you a reminder. If your account remains inactive for 3 years total, we treat it the same as a deletion — personal data is removed, anonymised data is retained.
- Payment records: Retained for 7 years to comply with UK tax and accounting requirements.
- Contractor lead data: Retained for 12 months after the lead is created, then automatically deleted unless the lead is still active.
9. Your Rights
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Ask us to correct inaccurate or incomplete data.
- Right to erasure: Ask us to delete your personal data (subject to legal retention obligations).
- Right to data portability: Receive your data in a structured, commonly used format.
- Right to restrict processing: Ask us to limit how we use your data.
- Right to object: Object to processing based on legitimate interest.
To exercise any of these rights, contact us at privacy@inspectiq.uk. We will respond within one month.
If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
10. Cookies
We use only essential cookies required to maintain your authentication session. We do not use advertising, analytics, or third-party tracking cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| Supabase auth token | Keeps you signed in | Session (until you sign out or token expires) |
Because we use only strictly necessary cookies, we do not require your consent to set them under UK privacy regulations.
11. International Data Transfers
Some of our third-party service providers (including Supabase, OpenAI, Stripe, and Vercel) may process your data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner, or the service provider's participation in recognised data protection frameworks.
12. Children
InspectIQ is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children.
13. Changes to This Policy
We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by email or by displaying a notice within the service. The “Last updated” date at the top of this page indicates when the policy was last revised.
14. Contact Us
If you have any questions about this Privacy Policy or how we handle your data, please contact us:
- Email: hello@inspectiq.uk
This Privacy Policy is provided for transparency and does not constitute legal advice. If you require legal guidance regarding your data protection rights, please consult an independent legal adviser.