Privacy & Cookie Policy

1. Who we are (Data Controller)

Blue Shuck Consulting LTD, 29 Glanville Drive, Houghton Le Spring, DH4 6NZ. Companies House number: 17308746. For any privacy questions or to exercise your rights, contact us at support@blueshuckconsulting.com.

2. The data we collect

• Account data: your name, email address, company name, and a securely hashed password (we never store your password in plain text).
• Subscription data: your plan tier, subscription status, renewal dates, and Stripe customer/subscription identifiers. Card details are entered directly with Stripe — we never see or store them.
• Project & content data: project names, client names and site addresses you enter, blueprint files (PDFs/images) you upload, scale calibrations, takeoff measurements and counts, estimate line items, and progress billing records and notes.
• Client contact data you provide: email addresses you enter to send an Application for Payment to your own clients.
• Technical data: log data such as timestamps and error records generated to operate and secure the Service.

3. How and why we use your data

• To provide and operate the Service, including authenticating you and storing your projects — lawful basis: performance of a contract.
• To process subscriptions and payments via Stripe — contract.
• To send transactional emails (welcome, password reset, and the Applications for Payment you choose to send) via our email provider — contract / legitimate interests.
• To keep the Service secure and prevent fraud or misuse — legitimate interests.
• To comply with our legal and regulatory obligations — legal obligation.

4. Sharing & sub-processors

We do not sell your data. We share it only with trusted providers who process it on our behalf under appropriate data-processing terms:

• Stripe — subscription billing and card payments.
• Zoho — delivery of transactional emails.
• Cloud hosting, database and object storage providers — to host the application and store your projects and uploaded files.

5. International transfers

Where any provider processes data outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or Standard Contractual Clauses to protect your data.

6. Data retention

We keep your data for as long as your account is active. On termination or account closure you have a 30-day window to export your project histories and estimate/billing registers (CSV/PDF), after which we may permanently purge the records from our storage. Password reset tokens expire within 1 hour. Residual copies in routine backups are deleted on our normal backup cycle.

7. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent where processing relies on it. To exercise any right, email support@blueshuckconsulting.com. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Security

We apply commercially reasonable technical and organisational safeguards, including encryption in transit (HTTPS), hashed passwords, access controls, and single-use, time-limited password reset links.

9. Cookies & tracking technologies

We keep cookies to a minimum and ask for your consent before setting any non-essential (analytics) cookies. When you first visit our website you are shown a cookie notice where you can accept or decline analytics.

• Strictly necessary storage: within the Trade Off application we store a secure sign-in token in your browser's local storage to keep you logged in, and a small preference recording your cookie choice. These are essential and cannot be switched off.
• Analytics (consent-based): on our website we use Google Analytics (GA4) to understand how visitors use the site. These cookies are only set if you click 'Accept' on the cookie notice, and IP addresses are anonymised. If you decline, no analytics cookies are set and no analytics data is collected.
• Third-party checkout: when you pay, Stripe's hosted checkout pages may set their own strictly necessary cookies to process the payment securely. These are governed by Stripe's own privacy and cookie policies.

You can change your mind at any time by clearing your browser storage for this site, which will bring the cookie notice back on your next visit.

10. Children

The Service is intended for business use by professionals and is not directed at anyone under 18.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected here with a revised "last updated" date.