This policy explains what personal data we collect when you use Buildsheet Pro, how we use it, and the rights you have over it. This includes the information needed to deliver your report and the optional measurement described below.
SAAS 21 Limited, trading as Buildsheet Pro, is the data controller for personal data processed through this site. We are registered in England and Wales under company number 17436331, with contact address at Unit 12, Gerards Park, College Street, St Helens, WA10 1FZ. You can reach us at support@buildsheetpro.io.
Order and report data — your email address, the registration number or VIN you submit, vehicle and report data returned for that lookup, order status and report history.
Payment data — Stripe handles checkout and payment, with Onelink acting as Merchant of Record. We receive transaction identifiers, payment status, currency, amount and other order information needed to fulfil and support your purchase. We do not receive or store your card number or other full payment credentials.
Account data — if you create an optional passwordless account, we use your email address and authentication events. Authentication is provided by Supabase; Buildsheet Pro does not store an account password.
Technical and consent data — security and service logs such as IP address, browser type and request time, plus your privacy choices. Our hosting provider uses the approximate country of a request to select the regional analytics setting. Buildsheet Pro receives only that setting and does not add the country to its consent counts. Where analytics is enabled, recognised campaign parameters on a public landing page may be sent to Google so a visit or purchase can be attributed to our advertising; private order, customer and vehicle identifiers are excluded. Analytics data is collected with consent where prior consent is required, or elsewhere until you opt out.
Marketing subscription data — if you choose to join our email list, we record your email address, where and when you subscribed, the consent wording shown to you and your current subscription status in our private newsletter database, hosted by Supabase. Resend delivers the emails; it is not the source of newsletter membership.
Optional Meta marketing measurement — where this feature is available and you choose Accept all or Save choices with Advertising (Meta) selected, we record that choice and use the Meta Pixel on supported public information pages to share page views, product views and public page addresses. It can set first-party browser and ad click cookies. We remove query strings and fragments from the public address before loading the Pixel, and retain a valid Meta ad click separately only after the advertising choice is saved. Connecting to Meta also shares your IP address and browser or device information, and may send existing Meta cookies according to your browser settings. Meta may associate these details with your Meta account or ad interactions. Our server can link an active saved advertising choice and a permitted browser or click identifier to a new checkout, then share checkout-start and verified paid-purchase events with the identifier, browser type, value, currency, time and a random event identifier. An eligible purchase can be measured without a return from Stripe or a captured Meta ad click, where a permitted browser identifier is available. These events help measure and improve our Facebook and Instagram ads; server events exclude your IP address and private page address.
The Pixel does not load on vehicle lookup, checkout, order, account, login, purchased-report, staff or calculator pages, and is skipped when a page address or referrer cannot be handled safely. Automatic event collection and advanced matching are disabled. We do not send submitted contact details, registration, VIN, report contents, order references or payment-session identifiers as Meta measurement fields. Purchase and checkout-start events are sent only by our server, not the browser Pixel.
We use personal data to confirm vehicle coverage, produce and deliver reports, operate optional accounts, support orders, prevent abuse, maintain the service, understand site use and measure the effectiveness of our advertising under the regional analytics setting described in our Cookie Policy, and meet legal obligations such as tax and accounting records. We do not sell personal data or send marketing email unless you opt in.
We process order, report and account data where needed to perform our contract with you; security, support and limited operational data under our legitimate interests in running a safe and reliable service; and records where required by law. For limited site analytics and campaign measurement, we rely on consent where prior consent is required and on our legitimate interests in improving the service and understanding our own advertising elsewhere, always subject to your right to opt out or object. Marketing email remains based on consent, which you can withdraw at any time.
When you have no saved Advertising (Meta) choice, it starts selected in Settings. Meta tracking remains off until you choose Accept all or Save choices with Advertising (Meta) selected and our server confirms the saved choice. The selection alone does not activate tracking. Closing Settings keeps your unsaved ticks if you reopen it on the same page, but does not save them or activate tracking. Saved choices, including refusals, remain respected. An analytics-only choice, a regional analytics default, an email subscription or a purchase does not enable Meta tracking. Earlier marketing grants do not enable the added matching cookies and checkout measurement; we ask you to review and save the updated choice. You can withdraw it through Cookie settings without affecting checkout, report delivery, analytics or your email subscription.
Onelink acts as Merchant of Record through Stripe and is an independent controller for checkout, payment, tax, invoicing and transaction support. We also use specialist vehicle-data services for VIN and registration lookup, factory specification and service records; Supabase for database, storage and passwordless authentication; Resend for email delivery; Inngest for report-processing workflows; Vercel for hosting; and Google Analytics where enabled under the regional setting or your saved choice, including Google Ads campaign measurement. Google advertising storage, advertising user data and ad personalisation remain disabled. These providers receive only the data needed for their role. Where a provider processes data on our behalf, it does so under contractual safeguards. A registration number, VIN or other data may be processed outside the UK; where required, appropriate international-transfer safeguards apply.
When you choose Accept all or save Advertising (Meta) as selected, Meta receives the measurement and browser-connection details listed above and processes them under its Business Tools Terms and privacy policy. This sharing can involve processing outside the UK. We do not sell browsing data or create remarketing audiences through this feature.
Order and delivered-report records are retained for up to 6 years to meet tax, accounting, support and legal obligations. Lookup data for vehicles confirmed as unsupported is deleted within 30 days. Optional account data is kept until you delete the account or it is no longer needed. Marketing subscription records are kept while you are subscribed and, after you unsubscribe, only as needed to honour that choice and demonstrate compliance. Security, workflow, email and hosting logs follow the relevant provider’s documented retention schedule and are kept no longer than needed for their purpose.
We remember saved analytics and Meta choices for up to 180 days. The corresponding Meta choice record follows the same limit, with a secure first-party cookie holding its reference. Browser and click identifiers are used for no more than 90 days from their recorded creation time. An unfinished checkout reservation is removed by the next scheduled cleanup after 24 hours; a completed checkout link is retained for up to 30 days and cleared of matching details once a purchase is queued. Queued event matching details and browser type are cleared after delivery, withdrawal or abandonment. Minimal event records remain for up to 30 days to prevent duplicates. Withdrawal disables future Pixel events, removes accessible Meta measurement cookies on our domain and cancels unsent events. It does not undo data already received by Meta or remove cookies on Meta's own domains. Meta's retention follows its own privacy policy.
Under UK GDPR you can ask for access to, correction or deletion of your personal data; object to or restrict processing; and request portability where applicable. You can withdraw marketing consent at any time using the unsubscribe link in any marketing email, and manage analytics and campaign measurement through Cookie settings. Email us and we will respond within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk.
See our Cookie Policy for details of the cookies we use and how to manage them.