HomeVault
Privacy Policy
Last updated: 28 July 2026
In short. HomeVault stores the household records you enter — bills, policies, subscriptions and finance details — on servers we control, so you can reach them from any device. We do not sell your data, we do not run advertising, and we do not use third-party analytics or tracking. Payment card details never reach us.
Contents
1. Who we are
HomeVault is a web application operated by WestieTech ("we", "us"). For the purposes of UK data protection law we are the data controller for the personal data described in this policy.
| Service | HomeVault — homevault.uk |
|---|---|
| Operator | WestieTech |
| Registered address | [REGISTERED ADDRESS — to complete] |
| Company number | [COMPANY NUMBER — to complete, if registered] |
| Privacy contact | support@homevault.uk |
2. What we collect
Information you give us
| Category | Details |
|---|---|
| Account | Email address, password (stored only as a cryptographic hash — see §7), and optionally your name, telephone number and profile picture. |
| Address & household | Address lines, town, county, postcode, property type and number of occupants. |
| Homes | Property name, address, type, occupants, and any contact details you add. |
| Utilities | Provider, account number, billing cycle, monthly cost, notes. |
| Insurance | Policy type, provider, policy number, coverage amount, renewal date, annual cost. |
| Subscriptions | Service name, provider, cost, billing cycle, renewal date. |
| Finance | Account type, provider, account number, balance, credit limit, monthly payment, interest rate, start and end dates. |
| Documents | Files you upload or email to us — typically bills, policy schedules and renewal letters — together with filename, type and size. |
Please note. Some of this is financial information about you. Only enter what you actually need in order to keep track of an account. We would encourage you not to store full card numbers, PINs, passwords or online banking credentials in the notes fields — HomeVault is not designed as a credential store.
Information we generate
- Email records — the type, recipient and subject of service emails we send you (welcome, password reset, renewal reminders). We keep these to avoid sending duplicates and to help diagnose delivery problems.
- Payment records — where you subscribe, we record the amount, currency, status and the Stripe reference for each charge.
- Session tokens — a signed token identifying you while you are logged in, valid for 24 hours.
Information we do not collect
- We do not collect payment card details. These go directly to Stripe (see §5).
- We do not use Google Analytics or any comparable third-party analytics or advertising product.
- We do not build advertising or marketing profiles, and we do not sell or rent your data.
- We do not connect to your bank or utility providers, and we do not import data on your behalf.
3. Why we use it, and our legal basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Creating and running your account; storing the records you enter | Contract — necessary to provide the service you signed up for |
| Sending renewal and due-date reminder emails | Contract — a core feature of the service |
| Sending password reset and security notification emails | Contract, and legitimate interests in account security |
| Taking subscription payments and keeping payment records | Contract, and legal obligation for accounting records |
| Protecting the service against unauthorised access and abuse | Legitimate interests — keeping the service and its users secure |
We do not currently send marketing email. If that changes we will ask for your consent first, and you will be able to withdraw it at any time.
4. Where your data is stored
HomeVault runs entirely on Cloudflare infrastructure. Your records are held in a Cloudflare D1 database provisioned in the Western Europe region, and uploaded documents are held in Cloudflare R2 object storage.
Cloudflare operates a global network, so data may be processed at edge locations outside the UK in the course of serving requests. Cloudflare provides contractual safeguards for international transfers, including Standard Contractual Clauses. Stripe likewise transfers data internationally under its own safeguards.
5. Who we share it with
We share personal data only with the processors below, and only so far as necessary to run the service. We do not sell, rent or trade personal data with anyone.
| Provider | Role | What they receive |
|---|---|---|
| Cloudflare | Hosting, database, file storage, email delivery and routing | All data you store in HomeVault; your IP address as part of normal request handling |
| Stripe | Payment processing | Your email address and payment details. Card numbers go directly to Stripe and are never received or stored by us |
| jsDelivr | Content delivery for a charting library used on the Analytics screen | Your IP address and browser user-agent, as an unavoidable consequence of your browser requesting the file |
We may also disclose personal data where we are legally required to do so, or to establish, exercise or defend legal claims.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and household records | Until you ask us to delete your account |
| Uploaded documents | Until you delete them, or until your account is deleted |
| Password reset tokens | 1 hour, then automatically removed |
| Email send records | Retained while your account is active |
| Payment records | Up to 7 years after the transaction, to meet UK accounting and tax obligations |
Deleting a home, bill, policy or subscription also deletes any documents attached to it, from both our database and our file storage.
Account deletion. There is currently no self-service delete button in the app. Email support@homevault.uk from your registered address and we will erase your account and all associated records within 30 days, other than payment records we are legally required to retain. We are working on making this available directly in the app.
7. How we protect it
- Passwords are never stored in readable form. We hash them using PBKDF2-HMAC-SHA256 with 100,000 iterations and a unique random salt per user. We cannot recover your password, only reset it.
- Sessions use cryptographically signed tokens (HMAC-SHA256) that expire after 24 hours. A token that has been altered in any way is rejected.
- Access control. Every read and write is scoped to the account that owns the record, checked in the database query itself.
- Encryption in transit. All traffic is served over HTTPS/TLS.
- Documents are stored under unguessable keys and require an authenticated request to retrieve.
No system can be guaranteed completely secure. If a breach occurs affecting your rights and freedoms we will notify the Information Commissioner's Office within 72 hours where required, and will tell you directly where the risk to you is high.
8. Your rights
Under UK GDPR you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct anything inaccurate (most fields you can edit yourself in the app)
- Erasure — ask us to delete your data, subject to legal retention obligations
- Portability — receive your data in a structured, machine-readable format
- Restriction — ask us to limit how we use your data
- Objection — object to processing based on legitimate interests
To exercise any of these, email support@homevault.uk. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office — ico.org.uk, helpline 0303 123 1113. We would appreciate the chance to resolve it with you first.
9. Cookies and local storage
HomeVault does not use cookies, and there is no cookie banner because there is nothing to consent to.
We do use your browser's localStorage to hold your session token and basic account
details, so you stay logged in between visits. This is strictly necessary for the service to
function. Signing out clears it, as does clearing your browser data.
10. Children
HomeVault is intended for adults managing a household. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will remove it.
11. Changes to this policy
We may update this policy as the service develops. The "last updated" date at the top will always reflect the current version. Where changes materially affect how we use your personal data, we will email registered users before they take effect.
12. Contact us
Questions about this policy, or about your data: support@homevault.uk