Privacy policy

SpotIt helps you understand problems you've spotted in your home. To do that we need some information about you and photos of the problem. This page explains, in plain English, what we collect, why, who we share it with, how long we keep it, and the rights you have. It covers the SpotIt website (spot-it.uk), the web app (app.spot-it.uk) and the SpotIt iPhone app.

Who we are

SpotIt is run by Richard Andrews, a sole trader based in the UK. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), I am the controller of your personal data. If you have any questions about this policy or your data, email support@spot-it.uk.

What we collect

When you create an account:

• your name (and title, if you give one) and email address
• a password, which is stored only as a secure one-way hash, never in plain text
• whether you're a homeowner or a renter
• the address of your property and which UK nation it's in, so we can apply the right legal framework
• if you rent, optionally your landlord's name, address and email, used only to fill in complaint letters for you

When you use SpotIt:

• the photos you take or upload of the problem, and any notes you add
• the assessment we give you, any complaint letter we draft, and the follow-up questions you ask and the answers
• basic technical details about the device you used for each analysis (for example "iPhone, iOS 26" or "Chrome on Windows"), taken from your browser or app, so we can make sure SpotIt works well on the devices people use

Please only photograph the problem itself, and avoid including people, documents or anything else personal in the frame. The iPhone app removes location and other hidden information from photos before they're uploaded.

What we don't collect: we don't use advertising, we don't track you across other apps or websites, and we don't use third-party analytics.

How we use it, and our lawful basis

• To provide the service you've signed up for: analysing your photos, showing your results and history, answering follow-up questions and drafting complaint letters. Lawful basis: performance of our contract with you.
• To run your account: verifying your email, signing you in and sending account emails such as your verification code. Lawful basis: contract.
• To keep SpotIt working and improve it: fixing errors, checking how well the analysis performs, and understanding which devices people use. Lawful basis: our legitimate interest in running a reliable service. We only look at individual analyses where we need to, for example to investigate a fault.

We don't sell your data, and we don't use it for marketing without asking you first.

Who we share it with

We use a small number of trusted providers to run SpotIt. They act on our instructions and can't use your data for their own purposes.

• Microsoft Azure hosts the app and stores your account data and photos, in data centres in the UK.
• Anthropic provides the AI (Claude) that analyses your photos. Your photos, notes and questions, and your property's nation and whether you rent, are sent to Anthropic to produce your assessment and chat answers. If you rent and get a complaint letter, your name, property address and any landlord details you've given are also sent, so the letter can be filled in for you. Anthropic is based in the United States, so this is an international transfer; it's protected by Anthropic's data processing terms, which include safeguards approved for transfers from the UK. Anthropic does not use this data to train its models.
• Microsoft Azure Communication Services sends our emails, such as your verification code.

We may also disclose information if the law requires it. If SpotIt were ever sold or transferred, your data would go with it under the same protections, and we'd tell you first.

Cookies and storage on your device

SpotIt doesn't use advertising or analytics cookies. The web app keeps your sign-in token in your browser's local storage so you stay signed in, and the iPhone app keeps it in the iPhone's secure Keychain. Our pages load the Nunito font from Google Fonts, so your browser connects to Google to fetch it, and the website footer shows badges from a few launch directories, which are loaded from their own sites.

How long we keep it

We keep your account, photos and analyses for as long as you have an account, so your history is there when you need it. When you delete your account, everything is deleted straight away, including your photos. Copies in our providers' backups expire on their normal backup cycle, which is a matter of weeks.

Deleting your account

You can delete your account at any time: in the web app go to Account settings and choose Delete my account; in the iPhone app go to Account and choose Delete account. This permanently removes your account and all your analyses, photos, chat history and complaint letters. You can also ask us to do it by emailing support@spot-it.uk.

Your rights

Under UK data protection law you have the right to:

• get a copy of the personal data we hold about you
• have inaccurate data corrected (you can update most of it yourself in your account settings)
• have your data deleted
• restrict or object to how we use it
• receive your data in a portable format

To use any of these rights, email support@spot-it.uk. We'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to put things right first.

Keeping your data safe

Everything is sent over encrypted connections (HTTPS). Photos are stored privately and are only shown through short-lived links, to you, or to us when we need to look into a problem. Passwords are hashed, and access to our systems is limited to what's needed to run SpotIt.

Children

SpotIt is intended for adults (18 and over) and isn't designed for children.

Changes to this policy

If we change how we use your data, we'll update this page and the date at the top. If a change is significant, we'll let you know by email or in the app.