This policy explains what PlasterFlow collects, why it collects it, how long it is kept and what you can do about it. It applies to the PlasterFlow iPhone app, Mac app and web app, and to this website.
Who is responsible. PlasterFlow is a product of
Plaster and Rendering Solutions Limited, a company registered in England and Wales, company number
09075271. That company is the data controller for the purposes of UK data protection law. For anything to do with this policy or your data, contact
support@plasterflow.com.
1. Two different kinds of data
This distinction matters, so it comes first.
- Your account data — the email address you sign in with, and your subscription status. This is about you, and we are responsible for it.
- Your business data — your jobs, your customers' names and addresses, your quotes, your invoices, your photos and your prices. You put this in; you decide what goes in it; it belongs to your business. We store and protect it on your behalf and we do not look through it, mine it, or share it.
Where your business data includes information about your customers, you are the controller of that information and PlasterFlow acts as your processor — we handle it only to provide the service to you.
2. What we collect
Account and authentication
- Your email address, needed to sign you in and to send password resets.
- Your password, stored only as a secure hash — never in a readable form, and not visible to us.
Your business data
- Jobs, site visits, quotes, invoices, scopes of works and notes.
- Customer names, addresses, phone numbers and email addresses that you enter.
- Materials lists, your prices, coverage rates and cost records.
- Photos you take or upload against a job, including render previews.
- Your business details — trading name, logo, contact details, bank details for the invoice, VAT position and, if you have them, limited company details.
Location
- Your device's location, on the phone and Mac apps only, and only to give you the weather forecast and rendering verdict for where the job is.
- You can refuse or switch this off in your device settings at any time. The app then falls back to the area or postcode you have saved, and everything else carries on working.
- Location is used to fetch a forecast. It is not stored as a history of where you have been.
Payment
- Subscriptions are handled by Stripe. Your card details go to Stripe and never touch our systems — we hold only whether your subscription is active and the reference that ties it to your account.
Technical
- Device type and operating system version, for diagnosing crashes.
- Timestamps on records you create and change, which is also what makes syncing between your devices work.
- Basic error information when something fails, so it can be fixed.
This site does not run advertising trackers, and it sets no cookies for analytics or marketing.
3. Why we use it, and our lawful basis
4. What we do not do
- We do not sell your data, or your customers' data, to anyone.
- We do not share your jobs, customers or prices with other PlasterFlow users.
- We do not use your business data to market to your customers.
- We do not use your data to train anything, and we do not sell access to it.
- We do not email you marketing without your agreement, and any such email has an unsubscribe link.
5. Who processes it for us
A small number of suppliers, each doing one job, each under a contract that requires them to protect it:
- Supabase — database, file storage and sign-in (privacy policy)
- Stripe — subscription payments (privacy policy)
- Vercel — hosting for the web app and this website (privacy policy)
- Apple — app distribution and, on iPhone, push notifications (privacy policy)
- Ministry of Housing, Communities & Local Government — public Energy Performance Certificate data for the property lookup, from a postcode only (the service)
- Google — the supplier search, from your search term and approximate location (privacy policy)
Weather forecasts and the rain radar are fetched from public forecast services using a location only. Nothing about you or your customers is sent with those requests.
When you use the property lookup to estimate wall and room sizes, the postcode alone is sent to the UK government’s “Get energy performance of buildings data” service, which returns the public Energy Performance Certificate for that address — property type, age, floor area, storey heights and wall perimeters. Your customer’s name, address line, phone number and email are never sent, and the lookup only happens when you ask for it. Searching for a nearby supplier sends your search term and approximate location to Google.
Some of these suppliers operate outside the UK. Where data is transferred abroad it is protected by the safeguards UK data protection law requires, such as the UK International Data Transfer Agreement or an adequacy decision.
6. Where it is kept, and how it is protected
- Encrypted in transit, always (HTTPS/TLS).
- Row-level security on the database: every record is tied to your account, and the database itself refuses to return another account's rows. This is enforced at the data layer, not just hidden in the app.
- Photos are held in private storage, reachable only through your signed-in session.
- A copy of your data is also held on your own device, which is what lets the app work with no signal.
- Backups are taken so that a fault does not lose your work.
Keeping your own login secure is your responsibility. If you think someone else has your password, change it and tell us.
7. How long it is kept
- While your account is open: your business data is kept for as long as you want it. It's your record of your work, and old jobs are often the useful ones.
- If you delete your account: your data is deleted. Backups age out on their own cycle, within 30 days.
- Billing records are kept for as long as tax law requires, which is currently six years. These are records of payments, not your job data.
8. Your rights
Under UK data protection law you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to certain uses, or ask us to restrict what we do with it. Most of it you can simply do yourself, in the app:
- Export everything — Tools → Backup / Export Data writes all your jobs and prices to a file.
- Delete your account and its data — in the app's account settings. This is permanent and cannot be undone, so export first if you want a copy.
- Turn off location — in your device settings.
- Turn off notifications — in the app, or in your device settings.
Anything you can't do yourself, email support@plasterflow.com and we'll deal with it within one month. If you're not happy with how we've handled it you can complain to the Information Commissioner's Office.
9. Children
PlasterFlow is a tool for a business and is not intended for anyone under 18. We do not knowingly collect data from children.
10. Changes to this policy
If this policy changes, the new version is posted here with a new date at the top. If a change materially affects you, we'll tell you by email rather than leave you to notice.