Privacy Policy

Last updated: 14 March 2026

🔗

External links notice: This page contains links to third-party websites (e.g. Stripe, Base44, OpenAI, Google, ICO). These links are provided for reference only. CrashProof has no control over, and accepts no responsibility for, the content, privacy practices, or accuracy of any third-party site. Visiting an external link is entirely at your own risk and subject to that site's own terms and privacy policy.

1. Introduction

CrashProof is a trading name operated as a sole trader ("we", "our", "us") and is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our UK Property Crash Survival Toolkit platform.

We are the data controller responsible for your personal data. By using CrashProof, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Data You Provide

Account information (name, email address)
Payment information (processed securely through third-party payment providers)
Property data you input into calculators (property values, mortgage details, rental income)
Communications with our support team
Subscription preferences and plan selection

2.2 Automatically Collected Data

Usage data (pages visited, features used, time spent on platform)
Device information (browser type, operating system, IP address)
Cookies and similar tracking technologies (see Cookie Policy)
Log data (access times, error logs)

3. How We Use Your Information

We use your personal data for the following purposes:

Service Provision: To provide access to calculators, tools, and AI advisor features
Account Management: To create and manage your account, process payments, and handle subscriptions
Personalization: To save your calculations and provide personalized recommendations
Communication: To send service updates, security alerts, and respond to inquiries
Analytics: To understand usage patterns and improve our platform
Legal Compliance: To comply with legal obligations and enforce our terms
Security: To detect fraud, prevent abuse, and maintain platform security

4. Legal Basis for Processing (UK GDPR)

We process your personal data under the following lawful bases as defined under UK GDPR Article 6:

Primary basis: Contract Performance (Article 6(1)(b))

The majority of data processing on this platform — including account creation, access to calculators and tools, processing payments, and saving your calculations — is carried out because it is necessary to perform the contract between you and CrashProof (i.e. delivering the service you have paid for). Accepting our Terms of Service at signup forms this contract. This is not consent-based processing; it is processing required to fulfil our contractual obligations to you.

Contract Performance (Art. 6(1)(b)): Providing platform access, processing payments, managing your subscription, and saving your data
Legitimate Interests (Art. 6(1)(f)): Platform security, fraud prevention, product analytics, and service improvement — where these do not override your rights
Legal Obligation (Art. 6(1)(c)): Retaining transaction records to comply with HMRC and financial regulations (up to 7 years)
Consent (Art. 6(1)(a)): Marketing emails only — recorded explicitly at signup and withdrawable at any time by emailing privacy@crashproof.uk

Note: Accepting our Terms of Service establishes the contractual relationship that underpins our primary lawful basis. It is not treated as consent for data processing under Article 6(1)(a).

5. Data Processors & Third-Party Sharing

We do not sell your personal data. As a data controller, we engage the following data processors who act on our instructions under UK GDPR-compliant Data Processing Agreements (DPAs):

Stripe, Inc.

Payment processing. Stripe receives your payment details and billing information to process one-time subscription purchases. Stripe is PCI DSS Level 1 certified. Card data is never transmitted to or stored by CrashProof.

stripe.com/gb/privacy

Base44 (Platform Provider)

Application hosting, database storage, and authentication services. Base44 hosts the CrashProof platform and stores your account data, saved calculations, and property inputs on our behalf.

Article 28 UK GDPR disclosure: CrashProof has not entered into a separately negotiated Data Processing Agreement (DPA) with Base44. Our processing relationship is governed by Base44's standard platform Terms of Service. This is a known limitation: UK GDPR Article 28 requires that processing by a processor is governed by a binding contract setting out the subject-matter, duration, nature, and purpose of processing. We are actively seeking to formalise this arrangement. In the meantime, we mitigate risk by: (a) minimising the personal data stored on the platform; (b) not storing sensitive financial data beyond what you actively input; and (c) not sharing data with Base44 beyond what is technically necessary to operate the service. If you have concerns about this, you may exercise your right to erasure at any time by emailing privacy@crashproof.uk.

AI Language Model Providers (OpenAI / Google)

When you use the Ask AI feature, your questions and any property context you include are transmitted to third-party AI providers for processing. Do not include sensitive personal or financial data in AI queries. AI providers may use submitted data in accordance with their own policies.

OpenAI Privacy Policy Google Privacy Policy

We may also disclose data to legal authorities when required by law, and to successor entities in the event of a business transfer (with prior notice to you).

6. Data Retention

We retain your personal data for as long as necessary to:

Provide our services to you
Comply with legal, tax, and accounting obligations (typically 7 years for financial records)
Resolve disputes and enforce agreements

After account deletion, we will delete or anonymize your data within 90 days, except where retention is required by law.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right to Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure: Request deletion of your data ("right to be forgotten")
Right to Restrict Processing: Limit how we use your data
Right to Data Portability: Receive your data in a structured, machine-readable format
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent for marketing at any time

To exercise these rights, contact us at privacy@crashproof.uk

8. Data Security

We implement industry-standard security measures including:

Encryption of data in transit (TLS/SSL) and at rest
Regular security audits and penetration testing
Access controls and authentication mechanisms
Secure payment processing (PCI DSS compliant providers)
Regular backups and disaster recovery procedures

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. International Data Transfers

Your data may be transferred to and processed in countries outside the UK. When we do so, we ensure:

Transfers comply with UK GDPR requirements
Adequate safeguards are in place (e.g., Standard Contractual Clauses)
Data is only transferred to countries with adequate data protection laws

10. Children's Privacy

CrashProof is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

11. Data Breach Notification

In the event of a personal data breach, CrashProof will follow the process below in compliance with UK GDPR Article 33 (controller obligations) and Article 34 (communication to data subjects).

Step 1 — Internal Detection & Containment

Any suspected breach must be reported immediately to dpo@crashproof.uk. Our DPO will assess severity, contain the incident, and begin logging details within 24 hours of discovery.

Step 2 — ICO Notification (within 72 hours)

If the breach is likely to result in a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, via the ICO's self-reporting portal at ico.org.uk/for-organisations/report-a-breach. Where notification is delayed beyond 72 hours, a reasoned justification will be provided.

Step 3 — Notifying Affected Users

Where a breach is likely to result in a high risk to affected individuals, we will notify those individuals directly — without undue delay — by email to their registered address. The notification will describe the nature of the breach, data affected, likely consequences, and steps taken to mitigate harm.

Step 4 — Record-Keeping

All breaches — whether notifiable or not — will be recorded in our internal breach log, including facts, effects, and remedial actions taken, as required by UK GDPR Article 33(5).

To report a suspected breach involving your data, contact us immediately at dpo@crashproof.uk with the subject line “Data Breach Report”.

12. Right to Erasure — Delete My Data

Under UK GDPR Article 17, you have the right to request deletion of your personal data at any time. To submit a deletion request:

Email us at privacy@crashproof.uk with the subject line "Data Deletion Request"
Include the email address associated with your account
We will confirm receipt within 72 hours and complete deletion within 30 days

Upon deletion we will permanently remove your account, saved calculations, and property data. Note: we may retain minimal transaction records for up to 7 years to comply with UK tax/financial regulations.

Request Data Deletion

13. Contact Us

For any privacy-related questions or to exercise your rights:

Email: privacy@crashproof.uk

Data Protection Officer: dpo@crashproof.uk

Address: 16 Claragh Road, Clough, Downpatrick

ICO Registration: 00013756607

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk

We Value Your Privacy

We use cookies to enhance your experience, remember your preferences, and analyze usage. By clicking "Accept All", you consent to our use of cookies. See our Cookie Policy and Privacy Policy.