Privacy Policy

Who we are

Bootstrapper is the data controller for personal data processed through the Bootstrapper service. For project information that builders enter about their own customers, the builder is also responsible for that data and we process it on their behalf.

To contact Bootstrapper about privacy, email support@bootstrappersitebook.com.

What we collect and why

• Account and company information: name, email, login credentials, company name, logo, country, VAT number, invoice and payment instructions. Used to create and run your account (contract).
• Customer and project information: customer names, emails, phone numbers, site addresses, job descriptions, estimates, extras, snags, notes, invoices and payment records. Used to provide the Service (contract and legitimate interests).
• Uploaded plans, photos and documents: drawings, job photos, receipts and attachments. Photo location data is removed before upload. Plans you choose to scan are sent to an AI service to suggest materials.
• Technical data: IP address, browser and device information, and logs. Used for security, fraud prevention and fixing problems (legitimate interests).
• Messages you send us, to help you (legitimate interests).

We do not sell personal data.

Who we share it with

• Hosting and database: Lovable (application hosting and backend), Supabase (database, file storage and sign-in) and Cloudflare (web hosting network).
• AI plan scanning: the Lovable AI Gateway and its model providers, only for plans you choose to scan.
• Paddle.com: our Merchant of Record, for the sale of subscriptions, subscription management, payments, tax compliance and invoicing. Paddle receives your billing details directly.
• Professional advisers, such as lawyers and accountants.
• Authorities, where the law requires it.

Customers invited to a project can see that project's shared records, but never a builder's private costs, receipts or margins.

Storage, retention and security

Data is stored with the providers listed above. We keep it while your account is active and for as long as needed to meet legal, tax and accounting obligations. After that, it is deleted or anonymised. We protect data with encryption in transit, access controls and permission checks on every record.

International transfers

Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum to standard contractual clauses.

Cookies and analytics

We use only essential browser storage to keep you signed in. We do not use advertising or analytics cookies. Paddle's checkout may set its own cookies when you pay.

Your rights

Under UK GDPR you can ask to access, correct, delete, restrict or move your data, object to processing, and withdraw consent at any time. Contact us and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.