Privacy Policy

Last updated: [PLACEHOLDER: date]

Who we are

[PLACEHOLDER: legal entity name, e.g. "Sludge Ltd"], a company registered in England and Wales under company number [PLACEHOLDER], registered office [PLACEHOLDER: address]. We are the "data controller" for the personal data described below. [PLACEHOLDER: state whether a Data Protection Officer has been appointed — likely not required at this scale, but say so explicitly rather than leaving it silent.]

Contact us about privacy: [PLACEHOLDER: email address, e.g. privacy@sludge.co]

What we collect

If you book a tank emptying

• Name, email address, phone number
• Property address, postcode, and the exact tank/access location (a map pin and, optionally, a what3words address)
• Access notes you provide (gate codes, pets, etc.)
• Tank type and estimated/actual volume
• Booking and payment status, job history, and any communications between us about a job

We never see or store your card details. Card authorisation and payment are handled entirely by Stripe, our payment processor; we only receive confirmation that a payment was authorised or captured, and a Stripe reference for it.

If you're a provider (operator)

• Business name, registration details, and regulatory information (drawn in part from the public Environment Agency / SEPA waste carrier registers)
• Contact details for your business and, if you register for an account, for the individuals who use it
• Your pricing structure and the jobs you handle
• Payout details and history [PLACEHOLDER: confirm exact fields once real bank-detail collection is built — not yet built as of this policy]

Why we use it, and our legal basis

• Performing your booking (contract) — we need your details to arrange, schedule, and bill for the job.
• Passing your details to the provider doing the work (contract / legitimate interest) — the provider needs your address, access details, and contact number to actually attend and empty the tank.
• Payment processing (contract) — via Stripe.
• Service emails — booking confirmations, schedule updates, receipts (contract; these are not marketing and you can't opt out of them while you have an active booking).
• [PLACEHOLDER] Marketing communications — if we ever email you about future services (e.g. an annual reminder to rebook), that will be based on consent or legitimate interest as appropriate, with a clear opt-out, in line with PECR. Not yet built as of this policy — this section should be revisited when it is.
• Fraud prevention and legal compliance (legal obligation / legitimate interest).

Who we share it with

• The provider assigned to your job — your name, address, contact number, access notes, and job details.
• Stripe (payment processing).
• Resend (sends emails on our behalf).
• postcodes.io, OS Places API / getAddress.io, what3words — receive a postcode or map coordinates to resolve an address or location; see our Cookie Policy for detail.
• We do not sell personal data, and do not share it with third parties for their own marketing.

[PLACEHOLDER: confirm whether any of the above process data outside the UK/EEA (Stripe and Resend are US companies — check their UK/EU data-transfer mechanisms, e.g. Standard Contractual Clauses, and name them here).]

How long we keep it

We keep your booking and job records, including any photos, for 7 years from when they were created, then delete them. We use one retention period for everything rather than different clocks for different kinds of record — chosen because it comfortably covers the separate legal minimums that apply to parts of what we hold (2 years for waste transfer note records, 6 years for financial/tax records). [PLACEHOLDER: confirm this figure and approach with whoever reviews this policy before launch — it is our own decision, not a specific legal requirement to keep everything for exactly 7 years, and a shorter period for some record types would also be defensible.]

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Ask us to delete your data (with some exceptions, e.g. records we must keep for tax purposes)
• Object to or restrict certain processing
• Receive your data in a portable format
• Withdraw consent, where consent is the basis for processing

To exercise any of these, contact [PLACEHOLDER: email]. [PLACEHOLDER — genuine gap: there is currently no built-in tool for a customer to self-serve an access/export/deletion request; requests would need to be handled manually by looking up records in the database directly.]

You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk — but please contact us first so we can try to put things right.

Children

This service is aimed at adults arranging tank emptying for a property and is not directed at children.

Changes to this policy

We may update this policy from time to time; the "last updated" date at the top will change when we do.