Privacy policy

This policy explains how RoughFigure (“we”), a sole trader business based in Egypt, uses personal data. Our address is [postal address]. Contact us about privacy at [privacy email].

Two roles

Our customers’ accounts: for the people who sign up to RoughFigure (trade businesses, agencies and their teams) we are the controller.
Homeowners’ enquiries: when a homeowner uses a business’s estimator, that business is the controller and we process the data for them as a processor, under our data processing agreement. Questions about an enquiry should go to the business first.

What we collect

Account data: name, email, password (stored only as a secure hash), business details, team members, billing details handled by Paddle, and settings.

Enquiry data (for businesses): the homeowner’s answers, name, email, phone, postcode, photos they choose to upload, the estimate shown, consent wording and time, and the page they came from.

Support chats: what you write to our support team and the files you send. If you’re signed in, we also store your name, your business, and a snapshot taken when the chat starts: your plan, the page you were on, your device and the app version. If you use the chat on our website without an account, we store the name and email you give us and the page you started on. Your browser keeps a secret code so you can come back to the chat.

Push notifications: if you turn them on, the address your browser gives us for sending them.

Technical data: IP addresses, used to stop abuse and stored only as a salted, one-way hash with enquiries; browser type; error reports.

Website analytics: cookie-free and aggregated. We don’t use advertising or tracking cookies. See our cookie policy.

Why we use it, and our lawful basis

To provide the service you signed up for (contract).
To keep it secure and stop spam and fraud (legitimate interests).
To answer your support chats, including by email, and to measure how well we do (contract, and legitimate interests for website visitors without an account).
To send service emails such as receipts, trial reminders and security alerts (contract and legitimate interests).
To send product news, only if you agree (consent). You can unsubscribe at any time.
To meet legal and tax obligations (legal obligation).

Only the suppliers we need to run the service, listed on our sub-processors page, and authorities where the law requires it. We never sell personal data.

Where it’s stored

In the UK and the European Economic Area. Where a supplier is outside these areas, we use an adequacy decision or the UK International Data Transfer Agreement or Addendum.

How long we keep it

Account data: while your account is open, then deleted within 30 days of closing it, except what we must keep for tax (usually 6 years).
Enquiries: until the business deletes them, or automatically after the business’s retention period (24 months unless they choose otherwise).
Support chats: while the account or business is open, or [support chat retention period] after a chat is resolved if that’s sooner. Chats from website visitors are deleted on request. If you close your account, chats you started stay with your business, without your name or the device snapshot, until the business is deleted.
Backups: overwritten within [backup retention period].

Your rights

You can ask to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent. Contact [privacy email]. We’ll reply within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Changes

We’ll update the date above when this policy changes, and tell account holders about significant changes by email.