Privacy Policy

1. Who we are

Brimley (brimley.uk) is a website-as-a-service for UK tradespeople. For the purposes of data protection law, Brimley is the data controller for the personal data we collect through our platform.

2. What data we collect

We collect the following categories of personal data:

• Account information: email address, name, phone number (optional), trade type, business name
• Business information: services offered, service areas (postcodes), bio, specialisations, Gas Safe number (if applicable)
• Photos: profile photo, logo, photos of completed work (before/after), receipt photos
• Client data: name, email, phone number, and address of your clients, entered by you through quotes, invoices, and projects
• Usage data: pages visited, features used, browser type, device information

3. Why we collect it

We process your personal data for the following purposes:

• To provide the service: your professional website, quoting, invoicing, portfolio, and AI-generated case studies
• To send transactional emails (quote and invoice delivery, account notifications)
• To display your public profile and portfolio for SEO and client discovery
• To improve the platform through anonymised usage analytics

4. Legal basis

We process your data under the following legal bases under UK GDPR:

• Contract performance (Art 6(1)(b)): processing necessary to provide you with the Brimley service you signed up for
• Legitimate interest (Art 6(1)(f)): anonymised analytics to improve the platform

5. Where your data is stored

Your data is stored on Supabase servers in the EU Frankfurt region (Germany). Your data stays within the European Union.

6. Third-party services

We share data with the following third-party services, solely to operate the platform:

• Supabase — database, authentication, and file storage (EU Frankfurt)
• Vercel — website hosting and delivery
• Resend — transactional email delivery (quotes, invoices, notifications)
• Google — OAuth sign-in (if you choose to sign in with Google)
• Anthropic (Claude) — AI-powered case study generation from your project data. Your data is processed to generate content but is not stored by Anthropic

We do not sell your personal data to any third party.

7. Client data

When you use Brimley to manage your clients (sending quotes, invoices, or collecting reviews), you enter your clients' personal data into the platform. In this context:

• You(the tradesperson) are the data controller for your clients' data
• Brimley is the data processor, acting on your instructions

We do not share your clients' data with anyone other than you. Client data is only used to deliver the specific service you requested (e.g. sending a quote or invoice to that client).

8. Cookies

We use only essential cookies required for authentication and session management. We do not use tracking cookies or advertising cookies. We may use Google Analytics with anonymised IP addresses for aggregate usage statistics.

9. Your rights

Under UK GDPR, you have the following rights regarding your personal data:

• Access (Art 15) — request a copy of the data we hold about you
• Rectification (Art 16) — correct inaccurate data
• Erasure (Art 17) — request deletion of your data
• Portability (Art 20) — receive your data in a portable format
• Objection (Art 21) — object to processing based on legitimate interest

To exercise any of these rights, contact us at privacy@brimley.uk. We will respond within 30 days.

10. Data retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days. Anonymised analytics data may be retained indefinitely.

11. Age restriction

Brimley is a business service intended for users aged 18 and over. We do not knowingly collect data from anyone under 18.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by email. Continued use of the service after changes constitutes acceptance.

13. Contact

If you have any questions about this Privacy Policy or our data practices, contact us at privacy@brimley.uk.