Privacy Policy

1. Who we are

South Facing Garden is a trading name of Gulliver Consultations Ltd, a company registered in England and Wales (company number 16674246). We are the data controller for the personal information described in this policy.

• Email, including all data protection questions: hello@southfacinggarden.co.uk
• Post: Gulliver Consultations Ltd, 5 Lilly Lane, Chickerell, Weymouth, England, DT3 4FU
• We are registered with the Information Commissioner's Office (ICO). Registration number: ZC273431.

We are not required to appoint a Data Protection Officer and have not appointed one. Questions about your information go to our nominated data protection contact at the email address above.

This policy covers our website (southfacinggarden.co.uk), our web app (app.southfacinggarden.co.uk) and our mobile apps.

2. The short version

• You can use the free postcode preview and the free sample report without giving us your name or email address.
• If you buy a single report or a report pack we need your email address, so your credits can be kept for you and restored on another device.
• We do not receive or store your card details. Payment is handled by Stripe.
• Addresses you search are sent to our data suppliers so we can build the report.
• Analytics and session recording are optional and switched off unless you turn them on.
• We do not sell your personal information.

3. What we collect and why

We do not ask for your name unless you submit a referral form or write to us. We do not ask for, and do not want, sensitive information about you such as health information.

Where we rely on legitimate interests, you can ask us for more information about how we balanced them against your rights, and you can object (section 12).

4. Buying, and restoring your access

Payments on our website and web app are taken by Stripe on its own checkout page. Stripe receives your email address, your payment details, our device identifier for your browser, and the record of what you confirmed at checkout. We receive confirmation of payment and Stripe's reference numbers, not your card number. Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal obligations, under its own privacy policy.

Purchase confirmation. When your credits are added we email you a confirmation of your purchase and the terms that apply. The email is sent for us by Resend. We keep a record that it was sent.

Restoring access. When you choose "Restore access" we email a 6-digit code to the address you enter. The code is kept for 10 minutes and then deleted. The email is sent for us by Resend.

Our mobile apps. Nothing can currently be bought inside our iOS and Android apps. If you bought a subscription in an app before subscriptions were withdrawn, the payment was handled by Apple or Google. The apps use RevenueCat to check whether such a subscription is still active; RevenueCat receives an app user identifier and the status of the purchase. If you chose to add your email address in the app, it is linked to that subscription so you can restore access.

5. Where your information is stored

On our servers (Cloudflare): your email address with your credits, unlocked property references and purchase records; the free-report record for your device; short-lived security records; shared report links; and temporary copies of supplier data.

In your own browser or app: the items listed in section 6. Saved properties are kept only on your device and are not sent to our servers. Clearing your browser data removes them; your credits remain safe on our servers and can be restored with your email address.

6. Cookies, analytics and similar technologies

We store some information on your device. Some of it is essential. Analytics and session recording are optional.

6.1 Essential storage (always on)

These are needed for the service you have asked for, or to remember your privacy choice. They are not used for advertising.

6.2 Optional tools (off unless you turn them on)

We use two optional tools on our website and in our web app. Each is a separate choice. Inside our iOS and Android apps we offer only Google Analytics: Microsoft Clarity is not used there. Neither is loaded, and neither sets cookies, unless you have accepted it.

• Google Analytics measures visits and how pages and features are used, so we can improve them. It sets cookies with names beginning _ga, which last up to two years. Google provides this to us as our processor. We use it for measurement only: our settings tell Google not to use the information for advertising or for personalising adverts.
• Microsoft Clarity shows us how pages are used during a visit, including recordings of clicks, scrolling, mouse movement and what is shown on screen. It sets cookies named _clck and _clsk, and Microsoft may set its own cookies from its own domains (such as CLID and MUID). We cannot guarantee a recording will never capture something you type or a property you look at, so please bear that in mind when deciding. Microsoft is a separate controller of this information. It may use it for its own purposes, including advertising, as described in the Microsoft Privacy Statement.

Our lawful basis for both tools is your consent.

6.3 Your choice

• The first time you visit, we ask. You can accept both, reject both, or choose each one separately.
• You can change or withdraw your choice at any time using Cookie settings at the bottom of every page of the website and app. Withdrawing is as easy as accepting.
• When you withdraw consent for a tool, we stop using it and delete the cookies it set for our website. Cookies that Microsoft has set from its own domains can be removed in your browser settings.
• Rejecting or withdrawing does not affect how the service works.
• We ask again after about six months, or sooner if we add a tool or change what one is used for.

6.4 Content from other providers

Some features load content directly from another provider. When that happens your browser contacts the provider, which receives your IP address and technical details of your browser.

7. Who we share information with

We share only what each organisation needs.

Organisations that provide services to us

Microsoft. If you accept Microsoft Clarity, Microsoft receives device, usage and session-recording information and is a separate controller of it (section 6.2).

Data suppliers. To build a report we send the property's address, postcode, property reference number or coordinates to the supplier of each dataset. We send our main property data supplier, Chimnie, a monthly count of reports, and, if it asks to audit us, a copy of our report audit records (section 3). Those records identify customers only by a coded reference. They do not receive your email address. Suppliers include Chimnie, Ordnance Survey, Geoapify, Ofcom, Police.uk, the Environment Agency, Historic England, NBN Atlas, PlanIt, Mapbox, ShadeMap and postcodes.io. The current list is in the app under "Data sources & licences".

Partners you ask us to contact. If you submit a referral form, we send the details you entered to the partner named on that form: The Mortgage Broker for mortgages, e.surv for surveys, or Please Connect Me for home services. They will use your details under their own privacy policies. We do not send your details to a partner unless you submit its form.

Others. We may disclose information where the law requires it, or to professional advisers, or to a buyer of our business, in which case this policy continues to apply.

We do not sell personal information and we do not share it for other companies' advertising, except that Microsoft may use Clarity information for its own purposes if you have accepted Clarity (section 6.2).

8. Transfers outside the UK

Some of the organisations above are based outside the United Kingdom, or process information outside it. The table shows where, and the safeguard that applies under each provider's published terms.

You can ask us for more information about these safeguards using the contact details in section 1.

9. How long we keep information

There are two different things to understand here: what our systems delete by themselves, and what stays until someone acts.

9.1 Deleted automatically

9.2 No automatic expiry

These records are not deleted by the system on any timer. That is deliberate for the first two, because purchased credits never expire.

9.3 Our retention policy for records with no automatic expiry

"No automatic expiry" does not mean we keep information for ever regardless.

• On request. If you ask us to delete your account information we will do so, unless the law requires us to keep it. Deleting your account removes any unused credits and your unlocked reports, and they cannot be restored.
• Records we must keep. We keep purchase and refund records for as long as accounting and tax law requires, even if you ask us to delete your account. For a company this is normally six years from the end of the financial year the record relates to.
• Review. We review the records we hold from time to time and delete those we no longer need.

9.4 Other records

10. Shared report links

When you create a link to share a report, we store a copy of that report's summary: the address, postcode, property reference, coordinates, scores and summary text. It does not contain your email address or anything that identifies you.

• Anyone who has the link can open it. There is no password. Share it only with people you trust.
• The link stops working no later than 90 days after the report was generated.
• We ask search engines not to index shared reports, but we cannot control what a recipient does with a link.
• You cannot delete a link yourself at present. Email us and we will remove it.

11. Security

We use encrypted connections (HTTPS), signed sign-in tokens and access controls, and we never receive your card details. No online service can be guaranteed completely secure. If a breach affecting your information occurred and the law required it, we would tell you and the Information Commissioner's Office.

12. Your rights

You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct it;
• ask us to delete it;
• ask us to restrict how we use it, or object to our using it where we rely on legitimate interests;
• receive information you gave us in a portable format; and
• withdraw consent at any time where we rely on consent. For analytics and session recording, use "Cookie settings".

To use any of these rights, email hello@southfacinggarden.co.uk. We will reply without undue delay and within one month. We may need to check your identity, usually by confirming you control the email address on the account. Some rights do not apply in every case; for example we may need to keep purchase records to meet legal obligations.

We do not make decisions about you by automated means that have a legal or similarly significant effect.

13. Children

The service is not aimed at children, and we do not knowingly collect children's personal information.

14. Complaints

If you are unhappy with how we have used your information, please email hello@southfacinggarden.co.uk so we can try to put things right. We will acknowledge a data protection complaint within 30 days and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

15. Changes to this policy

We will post any changes here and update the version number and date at the top. If a change materially affects how we use information we already hold about you, we will tell you by email where we hold your address or by a notice in the service.

16. Contact

Gulliver Consultations Ltd, trading as South Facing Garden
Registered in England and Wales, company number 16674246
Registered office: 5 Lilly Lane, Chickerell, Weymouth, England, DT3 4FU
ICO registration number: ZC273431
hello@southfacinggarden.co.uk