DRAFT — best-practice working copy. Must be reviewed by a solicitor and have all [highlighted] fields completed before publishing.

Privacy Policy

Last updated: [date] · Version [1.0]

This policy explains how [Future Apps LTD] ("moversapp", "we", "us") handles personal data when you visit our website, use our app, or when we process data on behalf of a removals firm that uses moversapp. We are committed to handling personal data in line with the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

1. Who we are

moversapp is a product of [Future Apps LTD], a company registered in England and Wales (company number [number]), registered office [registered address]. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO reg number].

For any privacy question, contact us at [privacy@moversapp.app]. Our appointed point of contact for data protection is our [Senior Responsible Individual / Data Protection lead].

2. Our two roles

Depending on the data involved, we act in one of two capacities under data protection law:

When we are the "controller"

For data about our own users and website visitors — the removals firms who subscribe, their staff who log in, billing contacts, and people who visit moversapp.app — we decide how and why that data is used, so we are the controller. This policy governs that data.

When we are the "processor"

When a removals firm uses moversapp to handle its customers' enquiries (names, addresses, move details, messages), that firm is the controller of its customers' data and we act only as its processor — we handle that data on the firm's instructions to provide the service. If you are a customer of a removals firm, that firm's own privacy policy governs your data; please contact them to exercise your rights, and they may pass your request to us. Our processing on behalf of firms is governed by a Data Processing Agreement (see [link to DPA]).

3. Data we collect as controller

  • Account data — name, business name, email, phone, password (stored hashed), role.
  • Billing data — subscription plan, billing contact and payment status. Card details are handled by our payment provider; we do not store full card numbers.
  • Usage data — how you use the app, feature activity, and technical logs (device, browser, IP, timestamps) used to run, secure and improve the service.
  • Support & communications — messages you send us and our replies.
  • Website data — cookies and similar technologies (see section 11).

4. Data we process for removals firms

When a firm uses the app, we process the personal data contained in the enquiries and jobs they handle through moversapp on their behalf. This can include the firm's customers' names, contact details, addresses, move dates and the contents of their messages. We process this only to provide the service — reading and classifying enquiries, drafting replies, producing quotes, and managing jobs — and never for our own purposes.

5. Why we use data & our lawful bases

PurposeLawful basis (as controller)
Providing and running the app for subscribersPerformance of a contract
Billing, fraud prevention, keeping recordsContract; legal obligation
Securing, maintaining and improving the serviceLegitimate interests
Support and service communicationsContract; legitimate interests
Marketing emails to business contactsLegitimate interests / consent (you can opt out any time)
Non-essential cookies & analyticsConsent

Where we rely on legitimate interests, we have balanced those against your rights and can share our assessment on request.

6. AI processing of enquiries

A core part of moversapp uses artificial intelligence to read enquiries and draft replies. To do this, the text of an enquiry (which may contain personal data) is sent to our AI provider, which processes it to generate a suggested response and returns it to the app. This provider acts as our sub-processor.

We instruct our AI provider not to use data sent through the app to train their models, and we rely on their zero-/limited-retention settings where available. [Confirm the exact retention and training position with your provider's DPA before publishing — this sentence must match your actual configuration.]

AI-generated drafts are suggestions. A person at the firm reviews and approves messages before they are sent, except where the firm has switched on automatic sending for trusted replies, which is the firm's own choice and responsibility.

7. Who we share data with

We do not sell personal data. We share it only with service providers ("sub-processors") who help us run moversapp, each under a contract that requires them to protect it and use it only on our instructions:

ProviderPurposeLocation
[OpenAI]AI reading & reply draftingUSA
[Supabase]Database, authentication & hosting[region]
[Resend]Sending emailUSA
[Stripe]Payments & subscriptionsUSA / EU
[Google]Sign-in & distance calculationUSA
[Vercel / hosting]Application hosting[region]

We keep this list current and will tell subscribers before adding a sub-processor that materially affects them, giving a chance to object. We may also disclose data where required by law.

8. International transfers

Some of our providers are based outside the UK, including in the United States. Where personal data is transferred abroad, we protect it using safeguards approved under UK law — the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK Addendum, and additional measures where appropriate. You can ask us for details of the safeguards in place.

9. How long we keep data

We keep personal data only as long as needed for the purposes above, then delete or anonymise it. As a guide: account and job data for as long as the subscription is active and for [X months] after it ends; billing records for [6 years] to meet tax law; support messages for [X months]. When we act as processor for a firm, we delete or return that firm's data on request or on the end of their subscription, subject to the DPA.

10. Your rights

Under UK data protection law you have the right to: be informed; access your data; have inaccurate data corrected; have data erased; restrict or object to processing; data portability; and rights relating to automated decision-making. To exercise any right for data we control, contact [privacy@moversapp.app]. If your data is held by a firm using moversapp, contact that firm; we will support them in responding. We will respond within one month.

11. Cookies

We use cookies that are strictly necessary to run the site and app. We use non-essential cookies (such as analytics) only with your consent, which you can give or withdraw through our cookie banner. See our [Cookie Policy] for the full list. This is governed by the Privacy and Electronic Communications Regulations (PECR) as well as the UK GDPR.

12. Complaints

If you are unhappy with how we have handled your data, please tell us first at [privacy@moversapp.app] so we can put it right. In line with the Data (Use and Access) Act 2025, we will acknowledge your complaint and respond within the timescales required by law. If you remain dissatisfied, you can complain to the ICO at ico.org.uk or 0303 123 1113. You do not have to complain to us first, but it often resolves things faster.

13. Security

We take appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, and separation of each firm's data. [State encryption-at-rest and any certifications only if actually implemented.] No system is perfectly secure, but we work to protect your data and will notify you and the ICO of a serious breach as the law requires.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here with an updated date and, for significant changes, tell subscribers directly before they take effect.

15. Contact

[Future Apps LTD]
[registered address]
Email: [privacy@moversapp.app]