Privacy Policy
MaintainA · Last updated: June 2026
1. Data Controller
Andrew Blewett
101 High Trees Close, Redditch, Worcestershire, B98 7XL, United Kingdom
Email: andyblewett991@gmail.com
Governed by the UK GDPR and the Data Protection Act 2018 (DPA 2018).
2. Important — Third-Party Data (Your Clients)
MaintainA is a business management tool. When you add client contact information, project details, or invoices to the platform, you become a Data Controller for that third-party data under UK GDPR. You are responsible for ensuring you have a lawful basis to store your clients' personal data in MaintainA and for informing them accordingly. MaintainA acts as your Data Processor for that data.
3. Personal Data We Collect About You
| Category | Examples | Purpose | Lawful Basis |
|---|---|---|---|
| Account data | Name, email address, hashed password | Account creation and authentication | Contract (Art. 6(1)(b)) |
| Business data you enter | Client names/contacts, project details, time logs, service rates, quotes, invoices | Providing the platform functionality | Contract (Art. 6(1)(b)) |
| Usage data | Session duration, features used | Platform improvement | Legitimate interests (Art. 6(1)(f)) |
| Technical data | Device type, OS version, crash logs | Stability and support | Legitimate interests (Art. 6(1)(f)) |
4. Data Retention
| Data type | Retention period |
|---|---|
| Account and business data | Until account deletion; deleted within 30 days of request |
| Invoices and quotes (your data) | Retained for as long as your account is active; you may export before deletion |
| Usage data | Anonymised after 90 days |
| Support correspondence | 3 years from last contact |
Note: If you are subject to statutory record-keeping obligations (e.g., HMRC self-assessment), you are responsible for retaining your own copies of invoices and financial records before deleting your account.
5. Third-Party Services
| Processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Supabase | Account and business data storage | European Union | EU-hosted; DPA in place |
| Resend / Email provider | Invoice and quote email delivery (if enabled) | USA/EU | Standard Contractual Clauses |
| Apple / Google | App distribution | USA | Apple/Google's own privacy policies |
We do not sell data or use advertising networks.
6. Your Rights Under UK GDPR
- •Right of access – request a copy of all personal data we hold
- •Right to rectification – correct inaccurate or incomplete data
- •Right to erasure – delete your account and all data
- •Right to restriction of processing – limit how your data is used
- •Right to data portability – export your data before account deletion
- •Right to object – object to processing based on legitimate interests
- •Rights related to automated decision-making – we do not make automated decisions with significant effects
Email andyblewett991@gmail.com. Response within one calendar month.
7. Right to Lodge a Complaint
Information Commissioner's Office (ICO)
ico.org.uk · 0303 123 1113
8. Data Security
- •All data in transit encrypted with TLS 1.2+
- •Passwords hashed using bcrypt
- •Supabase row-level security restricts access to account owners
- •PDF generation occurs server-side and files are not retained after delivery
9. Changes to This Policy
Material changes communicated via email or in-app notification at least 14 days before taking effect.