Privacy Policy

This notice explains how Bloor Engineering Ltd ("we", "us") handles personal data when you use StreetPulse at streetpulse.uk.

Last updated: 9 May 2026.

1. Who is the data controller?

Bloor Engineering Ltd, registered in England and Wales (company number 14230472). Contact for privacy queries: george@bloorengineering.com.

2. What we collect

• Account data: email address, password hash, plan, sign-in timestamps.
• Usage data: which pages you visit, which features you use, what you submit to our forms.
• Payment data: processed by Stripe — we never see or store full card numbers. We hold your customer ID, last-4, transaction history, and billing email.
• Content data: the prompts and inputs you submit, the AI-generated outputs returned, and any documents you upload. Used to deliver the service and improve quality. We do not sell, share or rent this content.
• Diagnostics: IP address, user-agent, error logs, retained 30–90 days for security and debugging.

3. Why we collect it (lawful basis)

• Performance of a contract: running the service you signed up for.
• Legitimate interest: security, fraud prevention, product improvement, transactional email.
• Consent: for marketing email, where you have explicitly opted in. You can withdraw at any time.
• Legal obligation: retaining transaction records for HMRC under the Finance Act and Companies Act.

4. Who else sees your data

We use these processors and sub-processors to operate the service:

• Stripe (payments) — Stripe Payments Europe Ltd
• Vercel (hosting and analytics) — Vercel Inc., USA, with EU data residency where available
• Google Gemini (AI inference) — outputs are generated through this provider; prompts are sent securely
• Resend or equivalent (transactional email)
• BEAKON (our internal first-party analytics) — runs on Bloor Engineering infrastructure, no third-party tracking
• Google Analytics 4 where enabled — see our cookies notice

We may also disclose data where required by law (a court order, an HMRC notice, an ICO request) or to protect our rights or another user's safety.

5. How long we keep it

• Account records: while your account is active and for 6 years after closure for HMRC compliance.
• Generated documents and uploaded content: while your account is active, plus 30 days after deletion. You can request earlier erasure at any time.
• Anonymised analytics: indefinitely.

6. Where data is stored

Primary storage is in EU regions where our hosting provider supports it. Some processors (Stripe, Vercel, Google) are US companies that operate under standard contractual clauses approved by the UK ICO.

7. Your rights

Under UK GDPR and the Data Protection Act 2018 you can ask us to:

• Confirm what data we hold about you (subject access).
• Correct anything that's wrong.
• Delete your data (the right to erasure), subject to legal retention obligations.
• Restrict or object to processing.
• Receive a copy of your data in a portable format.
• Withdraw consent for any purpose where consent was the lawful basis.

To exercise any of these, email george@bloorengineering.com. We aim to respond within 30 days.

8. Complaints

If you think we have handled your data badly, you can complain to the UK Information Commissioner\'s Office at ico.org.uk/concerns — but we\'d much rather hear from you first so we can fix it.

9. Cookies

See our separate Cookies notice for the cookies and similar technologies we use.

10. Changes to this notice

We may update this notice from time to time. Material changes will be highlighted on the site. The "last updated" date at the top reflects the current version.