Privacy Policy

What we collect

• Name and email address, for both landlords/agents and engineers
• Property addresses and postcodes you add
• Gas safety certificates you upload, and the details read from them
• For network engineers: your claimed Gas Safe registration number, and a photo of your Gas Safe ID card
• Payment is handled entirely by Stripe — we never see or store your card details
• Mobile number, if you choose to give one — entirely optional

Why we collect it, and our lawful basis

UK GDPR requires us to have a specific lawful basis for each thing we do with your data, and to tell you what it is:

• Performing our contract with you — running the booking, passing access details to the attending engineer, generating and emailing your certificate, and taking payment
• Legal obligation — keeping VAT invoices and payment records for the period HMRC requires
• Legitimate interests— checking a network engineer's claimed Gas Safe registration before they can accept paid jobs, and keeping enough of a record to defend a claim about a job. Our interest here is the safety of the people in these properties, which we think you would expect us to act on
• Consent — text message alerts, only if you choose to give us a mobile number. You can withdraw this at any time in Account settings, and nothing else stops working if you do

Text messages

If you give us a mobile number, we'll only ever text you an urgent, service-related alert — for example, a landlord whose CP12 flags an immediately dangerous fault, or an engineer whose coverage area has a new job posted. We never send marketing texts, and giving a number is entirely optional — everything still works by email alone if you'd rather not. You can add, change, or remove your number at any time from Account settings.

Who else sees it

Your data is processed by a small number of services that run GasRelay, none of whom use it for their own purposes:

• Supabase — database and file storage
• Stripe — payment processing and, for engineers, identity/bank verification for payouts
• Resend — sending emails (certificates, invoices, account emails)
• Twilio — sending text message alerts, only if you've given us a mobile number
• Anthropic — reads the text on uploaded certificates and ID cards to save you typing it in; it does not retain the images after processing

How long we keep it

• Gas safety certificates and the property record they attach to: kept 6 years from the date of the certificate. Landlords have their own duty to retain gas safety records, and a claim about a job can be brought for up to 6 years under the Limitation Act 1980, so this is the point at which the record stops being the evidence either of us would need
• Tenant name, phone and access notes: replaced whenever you update them, and deleted with the property record above. We only pass them to the engineer attending that specific job
• Gas Safe ID card and insurance certificate photos: deleted 6 years after a network engineer's account is closed — long enough to cover a realistic legal claim relating to a job, without keeping an identity document indefinitely
• Invoices and payment records: kept 6 years, as required for VAT records by HMRC
• Account details: deleted when you close your account, except where they are attached to records above that we still have to keep

Cookies

We only ever use cookies that are strictly necessary to run GasRelay — there's no advertising, analytics, or tracking of any kind. Because they're strictly necessary, UK law doesn't require us to ask your permission to use them, but we still want to be clear about what they are:

• Keeping you signed in between visits
• Automatically signing you out after 7 days of inactivity, or 30 days regardless of activity, for security
• Stripe may set its own cookies during payment to help prevent fraud

None of these are used to track you across other websites, build an advertising profile, or shared with anyone for marketing purposes.

Your rights

Under UK GDPR you can ask to see the data we hold about you, ask us to correct it, or ask us to delete it (subject to what we're legally required to keep, such as VAT invoices). Contact info@gasrelay.com for any of these. You can also object to processing we do on the legitimate-interests basis above, ask us to restrict it, or ask for a copy of your data in a portable format.

If you think we have handled your data badly, please tell us first so we can put it right — but you have the right to complain to the Information Commissioner's Office at any time, and you do not have to come to us first.

Contact

Questions about this policy: info@gasrelay.com.