Last updated: 21 September 2026 · Version 1.1

Privacy Policy

Heatflow is operated by Rapid Heat Response Ltd (trading as HeatFlow), registered in England and Wales, company number 17146141, registered office 19 Haywood Close, Weston-super-Mare, BS24 9NX.

1. Who we are

Heatflow is a mobile application for UK Gas Safe registered engineers, operated by Rapid Heat Response Ltd (trading as HeatFlow), registered in England and Wales, company number 17146141, registered office 19 Haywood Close, Weston-super-Mare, BS24 9NX. Data controller contact: privacy@heatflow.app

We are the data controller for engineer account data. Engineers are data controllers in their own right for the customer data they enter into the app.

2. What data we collect and why

2.1 Account and profile data

Name, email, password (hashed), Gas Safe registration number, company name, phone number, and ACS certificate expiry date — collected to create your account, populate certificates, and send renewal reminders.

2.2 Job and certificate data

Job records, CP12/CP6 certificate data, job photos, and unsafe situation records — collected to run the workflow engine and generate legally required Gas Safety Records.

2.3 Customer data entered by you

When you enter customer names, addresses, and contact details, you are doing so as a data controller in your own right. We store this data on your behalf and do not use it for any purpose other than providing the service to you.

2.4 Billing data

We use Stripe to process payments. We do not store card numbers. We store your Stripe customer ID, subscription status, and subscription period dates.

2.5 Location (company engineers only, and only if switched on)

If you work for a company that uses HeatFlow, you can choose to share your location with your office from Settings → Share my location with my company. It is off unless you switch it on, and nobody else can switch it on for you. While it is on and the app is open, your current position is updated about every two minutes so your office can see who is nearest to a job. We keep only your latest position and the time it was taken — no history or trail. It is cleared as soon as you switch sharing off or sign out. Solo engineers are never asked for their location.

Your company decides to use the live map and is responsible for how it uses it; we process your position on its behalf. The lawful basis is normally your company's legitimate interest in sending work to the right engineer safely. You can switch sharing off at any time.

2.6 Diagnostics and support

When something goes wrong in the app or on our servers we record the error, the time, your device platform and your account ID, so we can fix it. HeatFlow staff can see these error reports and your account and billing status to help you. Staff do not look at your customers' records unless you ask us to.

2.7 Data we do NOT collect

Location history, contacts from your phone, camera or microphone access beyond what you explicitly initiate, or advertising identifiers.

2.8 Our lawful basis

• Contract — your account, jobs, certificates, invoices and billing, to provide the service you signed up for
• Legal obligation — keeping billing records, and keeping gas safety records for the period the law requires
• Legitimate interests — security, preventing abuse, error reports, and (for company engineers who switch it on) live location

3. How long we keep your data

• While you subscribe — your account, job, certificate and customer data is kept for as long as you have an account.
• If your subscription ends — we keep your data for 90 days so you can come back without losing anything, and you can download a copy at any time in that window. After 90 days your account is deleted.
• If you delete your account — it is deleted straight away.
• Gas safety records — kept for 2 years after issue with your and your customers' personal details removed, because landlords' records must be available for that period.
• Billing records — kept for 7 years for tax purposes.
• Error reports — deleted after 90 days.

4. Who we share your data with

We do not sell your data. We share it only with the providers needed to run Heatflow:

• Supabase — Database and authentication (EU, Frankfurt)
• Stripe — Payment processing (USA, with SCCs)
• Resend — Transactional email (USA, with SCCs)
• Anthropic — AI fault diagnosis (USA, with SCCs)
• Expo — Push notifications (USA, with SCCs)
• Cloudflare — Photo storage (EU)
• Xero — Only if your company connects its Xero account: invoices and customer names are sent to it (UK/USA, with SCCs)
• OpenStreetMap Foundation — Map images on the office dashboard; it sees the viewer's IP address and the area being viewed, not engineer positions (UK)

Where providers are based outside the UK/EEA, transfers are protected by Standard Contractual Clauses (SCCs) approved by the ICO.

5. Your rights under UK GDPR

• Right of access — request a copy of all data we hold about you
• Right to portability — download your data (Settings → Download my data)
• Right to erasure — delete your account and all data (Settings → Delete my account)
• Right to rectification — correct inaccurate data via the app
• Right to restrict processing — ask us to pause processing in certain circumstances
• Right to object — object to processing based on legitimate interests

To exercise any right not available in the app, email privacy@heatflow.app. We will respond within 30 days.

6. Security

• All data in transit encrypted with TLS 1.2+
• All data at rest encrypted (AES-256)
• Row Level Security — engineers can only access their own data
• Passwords stored as salted hashes — never in plain text

7. Cookies

The Heatflow mobile app does not use cookies. This website uses only technically necessary session cookies. We do not use advertising or tracking cookies.

8. Changes to this policy

We will notify you of material changes via in-app notification and by updating the "last updated" date above.

9. Complaints

If you are unhappy with how we handle your data, you have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113. We would appreciate the chance to help first — email privacy@heatflow.app.