Privacy Policy
Last updated: 5 August 2026
1. Who is responsible for your data
ClickDesign (Peter House, Oxford Street, Manchester M1 5AN) is the data controller for the ClickCompliance service. Contact: mahmood@clickdesign.uk.
2. What we collect and why
| Data | Why (lawful basis) |
|---|---|
| Account details — email, name, hashed password | To provide your account and send service emails (contract) |
| Property addresses and energy certificate data (from the official register or entered by you) | To track compliance for properties you manage (contract / legitimate interest). Address-level energy data is personal data under UK GDPR |
| Documents you upload (gas certificates, EICRs, invoices, evidence) | To provide the compliance vault and expiry reminders (contract) |
| Legionella assessment answers and reports | To generate and store your risk-assessment records (contract) |
| AI assistant questions | To generate answers (see section 4) (legitimate interest) |
| Contact form messages | To respond to your enquiry (legitimate interest) |
We do not sell your data, and we do not use it for advertising.
3. Where your data lives
Account, property and assessment data is stored in our databases; uploaded documents are stored in our secure file storage. Passwords are stored only as strong one-way hashes. Access is restricted to your own account — other users can never see your properties or documents.
4. Processors we use
- The official energy certificate register (Department for Levelling Up / MHCLG) — we retrieve certificate data for postcodes and properties you request.
- Anthropic — questions you type to the AI assistant (together with a summary of your portfolio needed to answer) are processed by Anthropic's Claude API to generate the response. They are not used to train models.
- Email provider (Google Workspace) — for service and reminder emails.
- Paddle (Paddle.com Market Ltd) — our merchant of record for subscription payments. Paddle processes your name, email, billing address and payment details when you subscribe; card details never touch our servers. See Paddle's privacy policy.
- Cloud storage (Microsoft Azure) — for document files, when configured.
5. Cookies
We use one essential cookie (mees_auth) to keep you signed in. No advertising
or third-party tracking cookies.
6. How long we keep data
For as long as your account is active. If you close your account, or remove a property, the associated data and documents are deleted within 30 days, except where we must retain records to meet legal obligations. Register-derived certificate data is refreshed from the official source and not kept longer than needed.
7. Your rights
Under UK GDPR you can ask us to access, correct, export, or delete your personal data, or object to processing — email mahmood@clickdesign.uk and we will respond within one month. You can complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with our handling of your data.
8. Data sources and licensing
Energy certificate data is reproduced under the Open Government Licence v3.0. Address data is © Crown copyright and database rights, Ordnance Survey and Royal Mail, used within the licence's permitted purposes (property management for energy efficiency in the rental market).
9. Changes
We will post any changes to this policy here and, for material changes, notify you in the portal or by email.
See also our Terms & Conditions.