1. Who we are
1.1 Sweep Certificates is operated by Sweep Certificates Limited, company number 13363378, registered in England and Wales. Registered office: 2a-3a Market Gate, Pershore, Worcestershire, WR10 1DZ. Email: info@sweepcertificates.co.uk.
1.2 In this policy, "we", "us" and "our" mean Sweep Certificates Limited. "You" means a signed-in user, a company that subscribes, or a visitor to our public pages, depending on the context.
1.3 We provide software to chimney sweeps, stove installers and similar trades in the UK and Ireland. The Service includes the website, the mobile app, booking.sweepcertificates.co.uk, and Premium API or AI agent access.
2. This policy
2.1 This policy explains how we process personal data. It covers people who work at sweep businesses, people who visit our marketing pages, and the householders and other customers whose details those businesses store in the Service.
2.2 It should be read with our cookie policy, terms and acceptable use policy.
2.3 Account holders can review and edit much of their own data once signed in. Company owners can export or ask us to delete a company account by emailing us.
3. Controller and processor
3.1 We are the controller of personal data we use to run our own business. That includes account and login data, billing, marketing to people who asked for a trial or subscribe, website analytics, support conversations about the product, and sign-up checks.
3.2 When a sweep business stores details of its own customers in Sweep Certificates, that business is the controller of those records. We are a processor. We host the data and use it only to provide the Service, on that business's instructions. Examples are names, addresses, emails, phone numbers, appliances, appointments, certificates, quotes, invoices, photos and booking details.
3.3 If you are a householder and you want a copy, a correction or deletion of data a sweep holds about you, contact that sweep first. We can help the sweep action the request. We will not treat their customer list as our marketing list.
3.4 This page describes that split in plain language. It is not a signed data processing agreement.
4. Personal data we process
4.1 Account data. Name, email, phone if you give one, login identifiers, company name, association choice, role, settings and marketing preferences. Login is provided by Auth0. If you use a social login, Auth0 may receive basic profile details from that provider.
4.2 Customer records. Data a sweep business enters about its own customers and jobs, as listed in 3.2. That data belongs to the sweep business.
4.3 Messaging data. Template text, recipient addresses or numbers, send times, and delivery metadata for email, SMS and WhatsApp. Message bodies are stored as needed to send, retry and show history. We sanitise HTML in emails to reduce malicious code. We do not read messages to moderate them.
4.4 Booking data. If online booking is on, we process the details a householder submits to book, plus the public profile text the sweep chooses to publish on booking.sweepcertificates.co.uk.
4.5 Transaction data. Plan, add-ons, invoices and payment status. Card payments are handled by Stripe. We do not store full card numbers. See Stripe's privacy policy.
4.6 Usage data. IP address, device and browser type, pages or screens used, and diagnostic logs. We use Azure Application Insights and similar tools to find faults and understand how the product is used.
4.7 Support data. Emails you send us, and questions you type into Ask for help. The in-product help may send your question to Google Gemini so we can draft an answer. If Gemini is unavailable, we may send it to xAI instead. Live chat is handled by our team. Do not send card numbers through chat.
4.8 Google Calendar data, only if you connect Google Calendar. We store the calendar ID you choose and a refresh token so the diary can stay in sync. Event details stay on Google's servers. We do not use this data for marketing. You can disconnect the calendar in company settings or from your Google account. We then delete the token and calendar ID we hold.
4.9 WhatsApp Business data, only if you connect WhatsApp Business. We store the Business Account ID, phone number ID, display number and an access token so we can send reminder or service messages you trigger. We do not use this for advertising or profiling. If you disconnect, we delete those tokens and IDs unless the law requires us to keep them.
4.10 Accounting connection data, only if you connect Xero, QuickBooks, FreeAgent or Sage. We store the tokens and identifiers needed to create or update contacts and invoices you choose to sync.
4.11 API and AI assistant data. If you issue a v1 API key, we store the key record and a short usage record for each v1 call. If you connect an AI assistant, we store the connection. Section 7 says what those records contain, what we send to the assistant, and how long we keep them. We do not receive the conversation you have with the assistant.
4.12 In-product assistants. If you use Explain this or Ask about your reports, the settings assistant, or the form assistant, we send your question and the information the assistant needs to Google Gemini so it can answer. If Gemini is unavailable, some of these assistants use xAI instead. We remove customer names and references from report figures before we send them.
5. Why we process data and the legal bases
5.1 To provide the Service. Operating accounts, certificates, the diary, reminders, booking, billing and integrations. Legal basis for our relationship with you: contract. For your customers' data we process as a processor on your instructions.
5.2 To run and secure the product. Login, backups, fault diagnosis, abuse prevention and limited sign-up checks. Legal basis: legitimate interests in running a secure service, and contract.
5.3 To support you. Email and Ask for help, including automated draft answers. Legal basis: contract and legitimate interests in helping subscribers.
5.4 To send service messages to you. Billing, security and product notices. Legal basis: contract and legitimate interests.
5.5 To market to you. We may email account holders about the product. You can opt out. We do not use Google Calendar data, WhatsApp connection data, or your customers' details for our marketing. Legal basis: legitimate interests, or consent where the law requires it.
5.6 To meet the law and defend claims. Tax records, legal requests, and establishing or defending legal claims. Legal basis: legal obligation or legitimate interests.
5.7 Messages you send to your customers are sent on your instructions. You must have your own lawful basis for those messages. We do not take that decision for you.
6. Who we share data with
6.1 We share data with suppliers who help us run the Service, and only as needed for their role:
- Auth0 for login
- Stripe for payment
- Microsoft Azure for hosting, files and Application Insights
- database hosts for application data and, where used, help-search embeddings
- email, SMS and WhatsApp providers, including Meta when WhatsApp Business is connected
- Google, when you connect Calendar, or when Ask for help or an in-product assistant uses Gemini
- xAI, when Ask for help or an in-product assistant uses the backup assistant
- the AI assistant provider you choose, such as OpenAI for ChatGPT, Anthropic for Claude, or Google for Gemini, when you connect that assistant
- Xero, QuickBooks, FreeAgent or Sage, when you connect them
- mapping or address-lookup providers when you use those features
6.2 We may share data with professional advisers or insurers if we need advice or to handle a claim. We may share data if the law requires it, or if we sell or reorganise the company, in which case the new operator must use it for the same purposes.
6.3 We do not sell personal data.
6.4 If you connect WhatsApp Business, we share the minimum needed with Meta and WhatsApp to keep the connection and to send messages you trigger. You must have any notices and opt-ins your customers need.
6.5 If you connect an AI assistant, we send that assistant the results of the tool calls it makes. We send those results only to an assistant you have connected. Section 7 explains what that includes.
7. AI assistants (ChatGPT, Claude and other MCP clients)
7.1 You can connect an AI assistant, such as ChatGPT, Claude, Gemini where it is available, or another app that uses MCP, from Company settings, then AI agents. MCP is the way that app calls tools on Sweep Certificates. You choose the app and the provider. Their terms and privacy policy apply to the conversation in their product. We do not choose the provider for you.
7.2 We do not receive that conversation. We receive the tool call the assistant sends, and we return the tool result. A tool call asks us to read or change records in your company. For example, a customer search or a diary update. The call can include details the assistant sends, such as a name or address you asked it to save.
The result can include personal data, because that is the data the tool was asked for. It can include:
- customer, quote, and portfolio names, known-as names, and occupier role
- addresses, postcodes, and what3words locations
- phone numbers, and whether a number can receive WhatsApp
- email addresses
- notes, tags, and to-do titles and descriptions
- map coordinates, distance, and travel time
- appointment dates, times, sweep names, payment, and cancellation reasons
- appliance location, type, make, and model
- portfolio invoice contact name, address, email, and phone
- absence dates and reasons for people who work at your business
- names and roles of people who work at your business. Their email addresses are not included
- your company contact details, business address, and the text of message templates
- the subject and recipient of a sent message, the template name, and whether it was delivered or why it failed. The message body is not included
- links to certificates, other documents, and photos, with file names and photo descriptions
- report figures, such as counts, rates, and revenue totals, which can be broken down by sweep, postcode area, customer source, appointment type, appliance type, fuel, or cancellation reason. Customer names are not included
- form names, descriptions, questions, version numbers, and change notes. Completed forms are not included
The assistant then holds that result under the provider's terms.
7.3 You are the controller of your customers' records, as in 3.2. When you connect an assistant, you instruct us to release those records to it. You need your own lawful basis for that sharing, and your own privacy notice if your customers should be told. We process that release on your instructions. We are not the controller of the copy the provider then stores.
7.4 We store the connection so we can check later calls and so you can see it under Connected apps. The record includes the app name the assistant gives us, the address it may return to, the permissions granted, the company, the user who selected Authorise, and the access token and refresh token for that connection. We do not store the chat. An access token lasts about one hour. A refresh token stops working if the assistant has not used it for 30 days, and every connection ends 180 days after it was first authorised. You then need to connect again. If an old refresh token is used again after it has been replaced, we revoke the connection, because that can mean the token was copied.
7.5 We do not keep a log of every tool call. There is no cleanup job that deletes AI assistant calls after a set number of days, because those calls are not stored as a call log. When a tool changes a record, we add a line to your Activity logs. The line names the change and starts with MCP. If the tool deletes a customer, appointment, portfolio, quote or to-do, that line can also store a shortened copy of the deleted record. A failed tool call may appear in our diagnostic logs with the tool name, as in 4.6. That diagnostic log is not the conversation. v1 API keys are separate. For each v1 call we store the route, method, status code, response size, caller IP address, key, company and time. We do not store the request body or the response body in that usage record, and we delete each usage record 90 days after the call. Activity lines written by an assistant are kept like your other Activity logs, with your company's records, as in 9.3.
7.6 An owner or administrator can select Revoke on AI agents. Revoke marks the connection inactive, marks its tokens revoked, and stops further calls. It does not delete the activity lines or data already sent to the assistant. We delete the connection record 30 days after it is revoked. Disconnecting the assistant in ChatGPT, Claude or another app also stops further calls from that app. The connection then ends once its refresh token has not been used for 30 days, and we delete the record 30 days after that. Ask the provider if you want the copy they hold deleted. A registration that never completes is marked inactive after 24 hours and deleted after 7 days.
8. International transfers
8.1 Application data is hosted in the United Kingdom where we control the location.
8.2 Some suppliers are outside the UK or EEA, or may access data from there. That can include Auth0, Stripe, Google, Meta, and, when you connect them, OpenAI, Anthropic or another AI assistant provider. When that happens we rely on an adequacy decision or on standard contractual clauses or a similar safeguard.
8.3 If you publish a booking profile or send a message, that content can be seen by the people you send it to, and may travel across the internet. Tool results sent to an assistant you connected can also travel to that provider.
9. How long we keep data
9.1 We keep personal data only as long as we need it for the purpose we collected it, or as the law requires.
9.2 Account and billing data is kept while the account is open. After closure we may keep invoices and similar records for our tax and accounting duties, often up to six years.
9.3 Customer records stay until the sweep business deletes them or the company account is closed, subject to backups that expire in the ordinary cycle, and any legal hold. That includes job history, which sweeps keep for insurance. Records of sent messages are kept as proof of what was sent while the company account is open, including after the customer they were sent to is deleted.
9.4 Google Calendar tokens and WhatsApp connection data are deleted when you disconnect, unless we must keep them by law.
9.5 Support emails and chat may be kept so we can continue a conversation and improve the product.
9.6 A nightly job deletes AI assistant connection records 30 days after the connection is revoked or ends, registrations that never complete after 7 days, and v1 API usage records 90 days after the call. Activity lines written by an assistant follow 9.3. Sections 7.4 to 7.6 give the detail.
10. Your rights
10.1 UK data protection law gives people rights to access, correction, erasure, restriction, objection, portability, and to complain to the Information Commissioner's Office. Where EU GDPR applies, for example to some Irish customers, similar rights apply and you may also complain to the Irish Data Protection Commission.
10.2 Those rights have limits. We will explain if we cannot do what you ask.
10.3 If we are the controller, email info@sweepcertificates.co.uk. If we are the processor of a sweep's customer records, we will pass a valid request to that business or tell you to contact them. If a provider holds a copy because you connected an assistant, contact that provider as well.
10.4 You can read more about these rights on the ICO site: https://ico.org.uk/for-the-public/.
10.5 We have not appointed a statutory data protection officer. Privacy questions go to the email above.
11. Cookies
11.1 We use cookies and similar technology. Strictly necessary cookies make login and the site work. Other cookies, where used, help with performance and remembering choices.
11.2 The detail sits in our cookie policy. You can refuse optional cookies in your browser. Blocking all cookies will stop parts of the site working.
12. Children
12.1 The Service is for trade businesses. We do not aim it at children. If you think we hold a child's data by mistake, email us.
13. Changes
13.1 We may update this policy by publishing a new version here and changing the last-updated date. We will try to email account owners about a change we think is material.
14. Contact
Sweep Certificates Limited, 2a-3a Market Gate, Pershore, Worcestershire, WR10 1DZ.
Email: info@sweepcertificates.co.uk.
See also all policies.