1. Who we are

1.1 Sweep Certificates is operated by Sweep Certificates Limited, company number 13363378, registered in England and Wales. Registered office: 2a-3a Market Gate, Pershore, Worcestershire, WR10 1DZ. Email: info@sweepcertificates.co.uk.

1.2 In this policy, "we", "us" and "our" mean Sweep Certificates Limited. "You" means a signed-in user, a company that subscribes, or a visitor to our public pages, depending on the context.

1.3 We provide software to chimney sweeps, stove installers and similar trades in the UK and Ireland. The Service includes the website, the mobile app, booking.sweepcertificates.co.uk, and Premium API or AI agent access.

2. This policy

2.1 This policy explains how we process personal data. It covers people who work at sweep businesses, people who visit our marketing pages, and the householders and other customers whose details those businesses store in the Service.

2.2 It should be read with our cookie policy, terms and acceptable use policy.

2.3 Account holders can review and edit much of their own data once signed in. Company owners can export or ask us to delete a company account by emailing us.

3. Controller and processor

3.1 We are the controller of personal data we use to run our own business. That includes account and login data, billing, marketing to people who asked for a trial or subscribe, website analytics, support conversations about the product, and sign-up checks.

3.2 When a sweep business stores details of its own customers in Sweep Certificates, that business is the controller of those records. We are a processor. We host the data and use it only to provide the Service, on that business's instructions. Examples are names, addresses, emails, phone numbers, appliances, appointments, certificates, quotes, invoices, photos and booking details.

3.3 If you are a householder and you want a copy, a correction or deletion of data a sweep holds about you, contact that sweep first. We can help the sweep action the request. We will not treat their customer list as our marketing list.

3.4 This page describes that split in plain language. It is not a signed data processing agreement.

4. Personal data we process

4.1 Account data. Name, email, phone if you give one, login identifiers, company name, association choice, role, settings and marketing preferences. Login is provided by Auth0. If you use a social login, Auth0 may receive basic profile details from that provider.

4.2 Customer records. Data a sweep business enters about its own customers and jobs, as listed in 3.2. That data belongs to the sweep business.

4.3 Messaging data. Template text, recipient addresses or numbers, send times, and delivery metadata for email, SMS and WhatsApp. Message bodies are stored as needed to send, retry and show history. We sanitise HTML in emails to reduce malicious code. We do not read messages to moderate them.

4.4 Booking data. If online booking is on, we process the details a householder submits to book, plus the public profile text the sweep chooses to publish on booking.sweepcertificates.co.uk.

4.5 Transaction data. Plan, add-ons, invoices and payment status. Card payments are handled by Stripe. We do not store full card numbers. See Stripe's privacy policy.

4.6 Usage data. IP address, device and browser type, pages or screens used, and diagnostic logs. We use Azure Application Insights and similar tools to find faults and understand how the product is used.

4.7 Support data. Emails you send us, and questions you type into Ask for help. The in-product help may send your question to Google Gemini so we can draft an answer. Live chat is handled by our team. Do not send card numbers through chat.

4.8 Google Calendar data, only if you connect Google Calendar. We store the calendar ID you choose and a refresh token so the diary can stay in sync. Event details stay on Google's servers. We do not use this data for marketing. You can disconnect the calendar in company settings or from your Google account. We then delete the token and calendar ID we hold.

4.9 WhatsApp Business data, only if you connect WhatsApp Business. We store the Business Account ID, phone number ID, display number and an access token so we can send reminder or service messages you trigger. We do not use this for advertising or profiling. If you disconnect, we delete those tokens and IDs unless the law requires us to keep them.

4.10 Accounting connection data, only if you connect Xero, QuickBooks, FreeAgent or Sage. We store the tokens and identifiers needed to create or update contacts and invoices you choose to sync.

4.11 API and AI agent data. If you issue a v1 API key or connect an AI agent, we store the key identifier or OAuth grant and logs of calls, so we can secure the connection and show you what ran.

5. Why we process data and the legal bases

5.1 To provide the Service. Operating accounts, certificates, the diary, reminders, booking, billing and integrations. Legal basis for our relationship with you: contract. For your customers' data we process as a processor on your instructions.

5.2 To run and secure the product. Login, backups, fault diagnosis, abuse prevention and limited sign-up checks. Legal basis: legitimate interests in running a secure service, and contract.

5.3 To support you. Email and Ask for help, including automated draft answers. Legal basis: contract and legitimate interests in helping subscribers.

5.4 To send service messages to you. Billing, security and product notices. Legal basis: contract and legitimate interests.

5.5 To market to you. We may email account holders about the product. You can opt out. We do not use Google Calendar data, WhatsApp connection data, or your customers' details for our marketing. Legal basis: legitimate interests, or consent where the law requires it.

5.6 To meet the law and defend claims. Tax records, legal requests, and establishing or defending legal claims. Legal basis: legal obligation or legitimate interests.

5.7 Messages you send to your customers are sent on your instructions. You must have your own lawful basis for those messages. We do not take that decision for you.

6. Who we share data with

6.1 We share data with suppliers who help us run the Service, and only as needed for their role:

Auth0 for login
Stripe for payment
Microsoft Azure for hosting, files and Application Insights
database hosts for application data and, where used, help-search embeddings
email, SMS and WhatsApp providers, including Meta when WhatsApp Business is connected
Google, when you connect Calendar or when Ask for help uses Gemini
Xero, QuickBooks, FreeAgent or Sage, when you connect them
mapping or address-lookup providers when you use those features

6.2 We may share data with professional advisers or insurers if we need advice or to handle a claim. We may share data if the law requires it, or if we sell or reorganise the company, in which case the new operator must use it for the same purposes.

6.3 We do not sell personal data.

6.4 If you connect WhatsApp Business, we share the minimum needed with Meta and WhatsApp to keep the connection and to send messages you trigger. You must have any notices and opt-ins your customers need.

7. International transfers

7.1 Application data is hosted in the United Kingdom where we control the location.

7.2 Some suppliers are outside the UK or EEA, or may access data from there. That can include Auth0, Stripe, Google, Meta and others. When that happens we rely on an adequacy decision or on standard contractual clauses or a similar safeguard.

7.3 If you publish a booking profile or send a message, that content can be seen by the people you send it to, and may travel across the internet.

8. How long we keep data

8.1 We keep personal data only as long as we need it for the purpose we collected it, or as the law requires.

8.2 Account and billing data is kept while the account is open. After closure we may keep invoices and similar records for our tax and accounting duties, often up to six years.

8.3 Customer records stay until the sweep business deletes them or the company account is closed, subject to backups that expire in the ordinary cycle, and any legal hold.

8.4 Google Calendar tokens and WhatsApp connection data are deleted when you disconnect, unless we must keep them by law.

8.5 Support emails and chat may be kept so we can continue a conversation and improve the product.

9. Your rights

9.1 UK data protection law gives people rights to access, correction, erasure, restriction, objection, portability, and to complain to the Information Commissioner's Office. Where EU GDPR applies, for example to some Irish customers, similar rights apply and you may also complain to the Irish Data Protection Commission.

9.2 Those rights have limits. We will explain if we cannot do what you ask.

9.3 If we are the controller, email info@sweepcertificates.co.uk. If we are the processor of a sweep's customer records, we will pass a valid request to that business or tell you to contact them.

9.4 You can read more about these rights on the ICO site: https://ico.org.uk/for-the-public/.

9.5 We have not appointed a statutory data protection officer. Privacy questions go to the email above.

10. Cookies

10.1 We use cookies and similar technology. Strictly necessary cookies make login and the site work. Other cookies, where used, help with performance and remembering choices.

10.2 The detail sits in our cookie policy. You can refuse optional cookies in your browser. Blocking all cookies will stop parts of the site working.

11. Children

11.1 The Service is for trade businesses. We do not aim it at children. If you think we hold a child's data by mistake, email us.

12. Changes

12.1 We may update this policy by publishing a new version here and changing the last-updated date. We will try to email account owners about a change we think is material.

13. Contact

Sweep Certificates Limited, 2a-3a Market Gate, Pershore, Worcestershire, WR10 1DZ.

Email: info@sweepcertificates.co.uk.