Privacy Policy ← Back

Last updated: 5 May 2026

This Privacy Policy explains how PropCraft collects, uses, stores, and shares your personal data. It is provided in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read it carefully before using PropCraft.

1. Who We Are

PropCraft is a document preparation, guidance, and document generation tool for UK tradespeople and landlords. It is operated by PROPCRAFT TECHNOLOGY LTD, a private limited company registered in England and Wales.

Company name: PROPCRAFT TECHNOLOGY LTD
Company number: 17197416
Registered office: Suite RA01, 195–197 Wood Street, London, E17 3NU
Trading as: PropCraft
Data controller: PROPCRAFT TECHNOLOGY LTD, trading as PropCraft
Director / data contact: Mark Sepple
ICO registration number: ZC123572
Contact: hello@propcraft.co.uk
Website: propcraft.co.uk

PropCraft is not required to appoint a Data Protection Officer under Article 37 UK GDPR. The responsible individual for all data protection matters is Mark Sepple, who can be contacted at hello@propcraft.co.uk.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at hello@propcraft.co.uk. We will respond within one month of receiving your request.

2. What Personal Data We Collect and Why

2.1 Account Information

When you register for PropCraft, we collect:

Your first name and email address, required to create and manage your account.
A hashed password, generated from the password you set and stored securely using bcrypt. We never store your password in plain text and cannot recover it.
The following additional information, which you provide optionally to personalise and auto-populate documents you generate: your name (as it appears on documents), business name, contact telephone number, bank details, VAT registered status, logo (stored as image data), review link, and your preferred quote and invoice prefix and starting numbers.

We also store the following operational and account management data: your subscription plan, Stripe customer ID, trial start date, account creation date, quote and invoice counters, and temporary security tokens (email verification token and password reset token) where applicable. These are used solely to operate and secure your account.

All account information is used to operate your account, authenticate your identity, maintain your session, and auto-populate documents generated by PropCraft.

Legal basis: Performance of a contract (Article 6(1)(b) UK GDPR) — this processing is necessary to provide the PropCraft service you have subscribed to.

2.2 Authentication and Session Data

PropCraft uses its own server-side authentication system. When you log in, your identity is verified against the hashed password stored for your account, and a JSON Web Token (JWT) is issued to maintain your session. This token is stored in your browser and sent with each request to authenticate you. PropCraft does not use any third-party authentication provider.

Legal basis: Performance of a contract (Article 6(1)(b) UK GDPR).

2.3 Document Generation Data

When you use PropCraft to generate documents, you provide information about your customers, tenants, jobs, or properties — such as names, addresses, job descriptions, tenancy details, and financial amounts.

This information is transmitted to Anthropic PBC (the provider of the Claude AI model) for the sole purpose of generating the document you have requested. PropCraft does not store this data after your document has been generated. Anthropic processes this data as a data processor acting on our instructions under a data processing agreement. Anthropic's own data retention policies apply to data processed through their API; you can review these at anthropic.com/privacy.

Legal basis: Performance of a contract (Article 6(1)(b) UK GDPR).

Important: Documents generated by PropCraft may contain personal data relating to third parties — such as tenants, customers, or other individuals. You are independently responsible, as a data controller in your own right, for that third-party personal data. Before inputting any third-party personal data into PropCraft, you must satisfy yourself that you have a lawful basis to process it under UK GDPR. PropCraft accepts no responsibility for your compliance with your own data protection obligations in respect of third-party data.

2.4 Payment Data

When you subscribe to PropCraft, payment is processed by Stripe, Inc. PropCraft does not receive, store, or process your payment card details at any point — Stripe handles these entirely. We store only your Stripe customer ID (a reference identifier), your subscription plan, and your subscription status. Stripe retains your payment card details and billing history in accordance with their own privacy policy at stripe.com/gb/privacy.

Legal basis: Performance of a contract (Article 6(1)(b) UK GDPR).

2.5 Transactional Email Data

When we send you emails relating to your account — such as subscription confirmations, payment receipts, or policy update notifications — your first name and email address are processed by Resend, Inc., our transactional email provider, acting strictly on our instructions under a data processing agreement. Resend is used solely to deliver email verification messages, welcome emails, and password reset emails.

Legal basis: Performance of a contract (Article 6(1)(b) UK GDPR) for account and subscription emails. Legitimate interests (Article 6(1)(f) UK GDPR) for communications about material changes to the service — specifically, our legitimate interest in keeping subscribers informed of changes that affect their use of PropCraft. We have assessed that this legitimate interest is not overridden by your rights and freedoms, given the directness of the relationship, the relevance of the communications, and your right to object at any time.

2.6 Usage Data

We collect basic, anonymised technical information about how PropCraft is used — such as pages visited, features accessed, and session duration — to understand usage patterns and improve the service. This data is aggregated and cannot be attributed to individual users.

Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR) — specifically, our legitimate interest in maintaining, improving, and developing PropCraft. We have assessed that this interest is not overridden by your rights and freedoms, given that the data is anonymised, aggregated, and incapable of identifying you individually.

2.7 Server Logs

Our hosting provider, Render Inc., automatically records standard server log data, including IP addresses, browser type, operating system, and pages requested. These logs are retained for a limited period and used for security, troubleshooting, and performance monitoring.

Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR) — specifically, our legitimate interest in operating and securing the PropCraft platform. We have assessed that this interest is not overridden by your rights and freedoms, given the routine and limited nature of this processing and the security purpose it serves.

3. International Data Transfers

Several of our third-party processors are based in the United States. The UK has not issued a general adequacy decision in respect of the United States, and we therefore rely on appropriate safeguards to ensure such transfers are lawful and that your data remains protected to the standard required by UK GDPR:

Anthropic PBC (US): Transfers made under the UK International Data Transfer Agreement (IDTA) or equivalent standard contractual clauses adopted for UK purposes.
Stripe, Inc. (US): Transfers made under appropriate IDTA mechanisms or equivalent UK-approved standard contractual clauses.
Render Inc. (US): Transfers made under appropriate IDTA mechanisms or equivalent UK-approved standard contractual clauses.
Resend Inc. (US): Transfers made under appropriate IDTA mechanisms or equivalent UK-approved standard contractual clauses.

You may request further information about the specific transfer mechanisms in place for any processor by contacting us at hello@propcraft.co.uk.

4. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

Account information: Retained for as long as your account is active, and for up to 30 days following account deletion to allow for recovery requests. After this period, account data is permanently and irreversibly deleted.
Authentication tokens: JWTs are session-based and expire automatically. Not stored server-side beyond the active session. Local storage cache (account settings and counters) is cleared on logout or account deletion.
Document generation data: Not retained by PropCraft after your document has been generated. This data exists only in transit to Anthropic's servers for the duration of the generation request. The content of generated documents is not stored by PropCraft. Anthropic's own retention policies apply to data processed through their API.
Payment records: Retained for 7 years as required by HMRC under applicable tax and accounting legislation.
Transactional email logs: First name and email address retained by Resend Inc. in accordance with their standard practices, typically for up to 30 days. Resend does not retain the content of emails beyond standard log retention.
Usage data: Retained in anonymised, aggregated form. Because it cannot be attributed to any individual, it may be retained indefinitely for product improvement purposes.
Server logs: Retained by Render Inc. for a limited period in accordance with their standard practices, typically between 30 and 90 days.

5. Who We Share Your Data With

We share personal data with the following third-party processors only to the extent strictly necessary to provide the PropCraft service. In each case, a data processing agreement is in place:

Anthropic PBC — AI model provider. Receives document generation inputs (such as job descriptions, customer names, addresses, and amounts) on our behalf solely to generate documents you request. Anthropic's own data retention policies apply. Privacy policy: anthropic.com/privacy
Stripe, Inc. — Payment processor. Processes subscription payment data. Privacy policy: stripe.com/gb/privacy
Render Inc. — Web hosting and database provider. Hosts the PropCraft application and stores all account data in a PostgreSQL database (see section 2.1 for the full data inventory). Privacy policy: render.com/privacy
Resend Inc. — Transactional email provider. Receives your first name and email address to deliver email verification, welcome, and password reset emails. Privacy policy: resend.com/legal/privacy-policy

We do not sell your personal data. We do not share your data with advertisers or any third party for marketing purposes. We do not share your data with any other third parties except where required to do so by law, court order, or regulatory authority. Where we are legally permitted to do so, we will notify you of any such disclosure.

6. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights in relation to your personal data:

Right of access: You may request a copy of the personal data we hold about you.
Right to rectification: You may request that we correct inaccurate or incomplete personal data we hold about you.
Right to erasure: You may request that we delete your personal data, subject to certain legal exceptions (for example, where we are required to retain data under applicable tax or accounting legislation).
Right to restriction of processing: You may request that we restrict our processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or object to our processing.
Right to data portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible. This right applies to data processed on the basis of contract or consent.
Right to object: You may object to processing based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights and freedoms.
Rights in relation to automated decision-making: You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. PropCraft does not make automated decisions of this nature.

To exercise any of these rights, please contact us at hello@propcraft.co.uk, marking your email 'Data Subject Request'. We will acknowledge your request promptly and respond within one month. We may need to verify your identity before acting. There is no charge for exercising your rights, except in cases of manifestly unfounded or excessive requests, where we may charge a reasonable administrative fee or decline to act.

If you are not satisfied with how we have handled your personal data or your rights request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

7. Cookies and Local Storage

PropCraft uses essential cookies and browser local storage strictly for authentication and core functionality. Specifically, your JWT authentication token is stored in browser local storage to maintain your login between page loads. PropCraft also uses browser local storage to temporarily cache a local copy of your account settings and quote and invoice counters for performance purposes. This cached data is a copy of information already held on our servers and is not shared with any third party. All such storage is managed by PropCraft's own servers only.

We do not use advertising cookies, tracking cookies, or any cookies that monitor your behaviour across other websites. We do not use any third-party analytics scripts that identify you individually.

Because we use only strictly necessary cookies, we are not required under the Privacy and Electronic Communications Regulations 2003 (PECR) to obtain your consent for their use. If you disable cookies in your browser, PropCraft will not function correctly.

8. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

All data is transmitted over encrypted HTTPS connections.
Passwords are processed using bcrypt, a one-way hashing algorithm. We never store passwords in plain text and cannot recover a lost password.
Session management uses JSON Web Tokens (JWTs) with expiry, reducing the window of exposure from a compromised token.
Access to personal data is restricted to those who require it to provide and maintain the service.
Data processing agreements are in place with all third-party processors.

No method of data transmission over the internet or electronic storage is completely secure. While we apply commercially reasonable security measures, we cannot guarantee the absolute security of your data.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach, as required by Article 33 UK GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay in accordance with Article 34 UK GDPR.

9. Children

PropCraft is not directed at or intended for use by children under the age of 18. We do not knowingly collect personal data from anyone under the age of 18. If you believe that a child has provided personal data to PropCraft, please contact us at hello@propcraft.co.uk and we will promptly delete it.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify subscribers of any material changes by email at least 14 days before they take effect. The date at the top of this policy shows when it was last revised. The current version will always be available at propcraft.co.uk/privacy.

Your continued use of PropCraft after a material change takes effect constitutes your acknowledgement of the updated policy. If you do not agree to a material change, you should cancel your subscription before it takes effect.

11. Governing Law

This Privacy Policy is governed by the laws of England and Wales. Any disputes arising in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of England and Wales.

Company: PROPCRAFT TECHNOLOGY LTD | Company number: 17197416 | Director: Mark Sepple
Registered office: Suite RA01, 195–197 Wood Street, London, E17 3NU
ICO registration: ZC123572 | Contact: hello@propcraft.co.uk
Website: propcraft.co.uk