Privacy & Cookie Policy

Effective: 1 April 2026 · Data Controller: VentCalc Ltd · ICO Reg: pending registration

This policy explains how VentCalc Ltd (“VentCalc”, “we”, “us”) collects, uses, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

1. Data Controller

VentCalc Ltd is registered in England and Wales (Company No. 17123275). Our ICO registration number is pending registration.

For all data-protection enquiries contact us at legal@ventcalc.ai or for general enquiries at info@ventcalc.co.uk.

2. Data We Collect & Why

Category	Examples	Legal Basis	Purpose
ANALYTICS	Pages visited, session duration, device type, country	Consent (Art. 6(1)(a) UK GDPR)	Understand usage, improve the service
PAYMENT	Transaction reference, plan type	Contract (Art. 6(1)(b))	Fulfil your purchase; fraud prevention
ACCOUNT	Email address (if you create an account)	Contract (Art. 6(1)(b))	Deliver the service, send essential communications
TECHNICAL	IP address, browser type (Vercel edge logs)	Legitimate interests (Art. 6(1)(f))	Security, abuse prevention, uptime monitoring

Payment data: We never store, process, or see payment card numbers, CVVs, or bank details. All transactions are handled directly by Stripe, Inc. under their own PCI-DSS-compliant infrastructure. We retain only a Stripe transaction reference and the plan purchased.

3. Third-Party Data Processors

Processor	Role	Location	Safeguard
Vercel Inc.	Web hosting & edge network	USA / EU PoPs	Standard Contractual Clauses (SCCs)
Google LLC	Analytics (GA4) & Tag Manager	USA	SCCs + UK adequacy addendum; only loaded with consent
Stripe, Inc.	Payment processing	USA / EU	SCCs; PCI-DSS Level 1; Stripe Privacy Policy applies

We have reviewed each processor under the UK Transfer Risk Assessment (TRA) framework and have executed Data Processing Agreements (DPAs) as required by Art. 28 UK GDPR.

4. AI Processing & Your Data

VentCalc uses AI models to assist with floor-plan analysis and ventilation calculations. Building data you upload is processed in-memory only for the duration of your session and is not retained on our servers after your session ends.

We have configured our LLM API provider(s) with opt-out of training on user data to protect your intellectual property and confidential building information.

5. Cookie Policy

We use the following cookies and similar technologies:

Cookie / Storage Key	Type	Purpose	Duration
`vc_consent`	Essential	Remembers your cookie choice (accept / reject)	1 year
`_ga, _ga_*`	Analytics (consent required)	Google Analytics 4 — distinguishes unique visitors	2 years
`_gtm_*`	Analytics (consent required)	Google Tag Manager container	Session

Google Consent Mode v2

We implement Google Consent Mode v2. If you click Reject all, Google Tag Manager is not loaded at all — no scripts, pixels, or identifiers are set. If you click Accept all, Google Analytics and Tag Manager are activated and the consent state is updated to “granted” for all storage types.

You can change your preference at any time by clearing your browser's local storage (key: vc_consent). The banner will re-appear on your next visit.

6. Your Rights Under UK GDPR

Access (Art. 15): Request a copy of personal data we hold about you.
Rectification (Art. 16): Ask us to correct inaccurate data.
Erasure (Art. 17): “Right to be forgotten” — request deletion of your data.
Restriction (Art. 18): Ask us to pause processing in certain circumstances.
Portability (Art. 20): Receive your data in a structured, machine-readable format.
Object (Art. 21): Object to processing based on legitimate interests.
Withdraw consent (Art. 7(3)): Where processing is consent-based, withdraw at any time without affecting prior lawful processing.

To exercise any right, email legal@ventcalc.ai. We will respond within one calendar month (UK GDPR Art. 12).

7. Data Retention

Analytics data: retained for 14 months in Google Analytics (default GA4 setting), then automatically deleted.
Account data: retained for the lifetime of your account plus 30 days after deletion request.
Transaction records: retained for 7 years to comply with UK HMRC requirements.
Building / calculation data: processed in-memory only; not persisted after session.

8. Security Measures

All data in transit is encrypted via TLS 1.2+.
Hosting on Vercel with automatic HTTPS and DDoS protection at the edge.
No raw payment data ever reaches our servers (Stripe tokenisation).
In-memory AI processing — calculation inputs are not written to disk.
Access to any persisted data is restricted to authorised personnel only.

9. Children's Privacy

VentCalc is a professional B2B tool intended for engineers and construction professionals aged 18 and over. We do not knowingly collect data from anyone under the age of 18. If you believe a minor has submitted data to us, contact legal@ventcalc.ai and we will delete it promptly.

10. Right to Complain

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have mishandled your personal data:

Website: ico.org.uk
Helpline: 0303 123 1113

We would always prefer to resolve concerns directly — please contact us first at legal@ventcalc.ai.

11. Changes to This Policy

We may update this policy to reflect changes in law or our practices. Material changes will be communicated via a banner on the website and/or email to registered users. The “Effective” date at the top of this page indicates when the current version was last revised.

Questions about this policy? legal@ventcalc.ai — or return to home.