Privacy notice

Version 0.1 — 2026-09-05. Draft, not yet published.

This notice explains how Climcove Ltd collects and uses personal data when you use climcove.com or app.climcove.com. We have tried to write it in plain English rather than legal shorthand. If anything is unclear, contact us at the address at the end of this notice.

1. Who we are

Climcove Ltd is the "controller" of the personal data described in this notice — the organisation that decides why and how it is used, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

• Registered office: [Registered office address]
• Company number: [Company number]
• ICO registration number: [ICO registration number — register before launch]
• Privacy contact: privacy@climcove.com
• General contact: contact@climcove.com

We have not appointed a data protection officer, as we are not required to. A named data-protection lead within Climcove is responsible for handling privacy requests and can be reached at privacy@climcove.com.

2. What this notice covers

This notice covers two places:

• climcove.com, our public landing site. It collects no personal data, sets no cookies, runs no analytics or third-party scripts, and loads its fonts from our own servers rather than a third party.
• app.climcove.com, where you complete the home survey, view your specification, request quotes, and where installer and Climcove staff accounts operate (the installer portal and the ops console).

It applies to homeowners using the service, and to installer businesses and their staff.

3. What we collect

If you are a homeowner

• Survey answers: property type, age band, tenure, your goal for the project, current heating, room dimensions, windows, orientation, and similar details about your home, so we can produce a specification.
• Postcode: we store your full postcode. Only the outward part (for example, SW11) is shown to installers before they accept your specification.
• Photos: optionally, photos of rooms and the outside of your home, to help us assess the installation. See "Photos" below for how these are handled.
• Job reference: an identifier for your survey and specification.
• Account and contact details: if you create an account or request quotes, your email address, full name, and phone number.
• Installer choices and quotes: which installers you selected and the quotes you receive.
• Messages: anything you send us, for example through support requests.
• Technical data: your IP address, used transiently at the edge of our network for rate limiting (this is hashed and not stored in any database), and briefly in short-lived hosting logs; your browser type.

Photos, specifically

Location metadata (EXIF data, including GPS coordinates) is removed from every copy of a photo that anyone sees. The original file you upload is kept in secure storage in the EU so we can reprocess it if needed; it is never served to anyone, including our own staff, and it is deleted on the schedule in section 8. Installers and Climcove staff only ever see a reduced, metadata-free copy, and only through links that expire within 15 minutes. Photos are never held in a publicly accessible location.

Photos are analysed automatically in two ways: first, by Cloudflare Workers AI, to check basic quality (whether an image is blurred, too dark, or shows the expected subject); second, by Google's Gemini model, accessed through Cloudflare's AI Gateway, to extract details about the room and equipment that feed into your specification. Where this automated analysis produces a low-confidence result, a member of our staff reviews it before an installer ever sees it. No result below our confidence threshold is allowed to change the price shown to you.

If you are an installer or installer staff member

• Company name, Companies House number, REFCOM/F-Gas registration and its expiry date, MCS number, and insurance expiry date.
• Base postcode and coverage radius.
• Staff name, email address, and phone number.
• A Stripe customer ID and payment metadata (a PaymentIntent ID) relating to fees paid to accept a specification. We do not see or store your card details — Stripe handles these directly.

Technical data (all users)

We use your IP address transiently, at the network edge, to rate-limit requests and prevent abuse — it is hashed and not stored in any database — and it appears briefly in short-lived hosting logs. We also record basic browser type information.

4. Cookies and browser storage

climcove.com sets no cookies at all.

app.climcove.com sets exactly one cookie: cc_anon, a strictly necessary, anonymous session cookie that lets you leave the survey and come back to finish it later. It is HttpOnly, Secure, uses SameSite=Lax, and lasts 30 days. It does not identify you and is not used for advertising or analytics.

Installer and staff sign-in state is kept in your browser's local storage by our authentication provider, Supabase Auth. This is also strictly necessary — it keeps you signed in — and is not used for tracking.

We use no advertising or analytics cookies anywhere on our sites. Because we only use cookies and storage that are strictly necessary for the service to function, UK law does not require us to show a cookie consent banner, and we do not show one.

5. Why we use it, and our lawful basis

6. Automated processing

Your specification — the room-by-room recommendation, price band, running-cost estimates, and grant and planning indications — is calculated automatically from your survey answers and any photos you upload. This is a price and design estimate, not a decision that produces a legal or similarly significant effect on you (for example, it does not decide whether you are approved for anything or determine your legal rights). Where our photo analysis produces a low-confidence result, it is checked by a member of our staff before it is used, and no low-confidence result is permitted to change the price shown to you.

7. Who we share it with

Installers

We share your specification with at most three installers — only the ones you choose. Before an installer pays to accept your specification, they can see the specification itself and your outward postcode (for example, SW11). They cannot see your name, contact details, full postcode, or photos at this stage.

Your name, contact details, and full postcode are only released to an installer once they pay to accept your specification. This is recorded with a timestamp, and installers cannot see this information beforehand — this is enforced at the database level, not just in the application.

We never sell your data, and we never pass your enquiry to installers you did not choose.

Sub-processors

We use a small number of specialist service providers ("sub-processors") to run Climcove. Each is bound by a data processing agreement.

Status of executed data processing agreements: [to be confirmed before launch].

International transfers

Where personal data is transferred outside the UK — currently to Google (US) and Stripe (US) as set out above — we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent recognised transfer mechanism, to make sure your data stays protected.

8. How long we keep it

If you ask us to erase your data, we remove your photos, your job record, and everything linked to it, subject to any legal obligation we have to retain specific records (such as payment records for tax purposes).

9. Your rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data, in certain circumstances.
• Restriction of how we use your data, in certain circumstances.
• Portability — to receive your data in a structured, commonly used format, or have it sent to another organisation.
• Object to certain uses of your data, including where we rely on legitimate interests.
• Withdraw consent at any time, where we rely on consent (for example, marketing).

To exercise any of these rights, email privacy@climcove.com. We will respond within one month. We may need to verify your identity before acting on a request. There is normally no fee.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk, telephone 0303 123 1113. We would appreciate the chance to address your concern first, but you are not required to contact us before contacting the ICO.

10. Security

We take the security of your data seriously. Our measures include:

• HTTPS with HSTS (HTTP Strict Transport Security) across our services.
• A content security policy to reduce the risk of malicious scripts.
• Database row-level security, so installers can only ever read the data they are entitled to see.
• An append-only audit log of staff actions.
• Short-lived, signed links for photo access, which expire within 15 minutes.
• EU/UK data residency for our database and photo storage.
• No personal data is stored in edge key-value caches.

11. Children

Climcove is intended for adults aged 18 and over. Please do not use the service if you are under 18.

12. Changes to this notice

We may update this notice from time to time. When we do, we will post the update here with a new version date. If a change is material, we will also notify account holders by email.

13. Contact us

For any question about this notice or how we handle your data, contact our privacy team:

• Email: privacy@climcove.com
• General enquiries: contact@climcove.com
• Registered office: [Registered office address]