Privacy Policy

Hopo ("we", "us", "our") operates the hopo.io website and mobile application (the "Service"). This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller

Buckden Ventures Ltd is the data controller for your personal data.

• Email:privacy@buckden.io
• Address: Buckden Ventures Ltd, United Kingdom

What Data We Collect

Account Data

When you create an account, we collect:

• Email address
• Name (given name and family name)
• Authentication credentials (managed by our identity provider)

Inventory Data

When you use the Service, you provide:

• Property details (names, addresses, types)
• Room information
• Item details (names, descriptions, categories, valuations)
• Photographs of items
• Annual item records (insurance, subscriptions, MOTs)

Technical Data

We automatically collect:

• IP address
• Browser type and version
• Device information
• Pages visited and features used
• Cookies and similar technologies

Payment Data

If you subscribe to Hopo Pro, payment processing is handled by Stripe. We do not store card details. We store your subscription status and tier.

How We Use Your Data

Data Storage and Security

• All data is stored in AWS data centres in the EU (eu-west-2, London).
• Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Access to production data is restricted to authorised personnel only.
• We perform regular security assessments.

Data Sharing

We share your data only with:

• AWS — cloud infrastructure provider (data processing)
• Stripe — payment processing (Pro subscribers only)
• Google Analytics — anonymised usage analytics (with consent)
• Microsoft Clarity — session recording (with consent)

We do not sell your personal data to third parties.

Data Retention

• Account data: Retained while your account is active, deleted within 30 days of account deletion.
• Inventory data: Retained while your account is active, deleted within 30 days of account deletion.
• Photographs: Stored in AWS S3, deleted within 30 days of account deletion.
• Analytics data: Retained for 14 months (Google Analytics default).
• Payment records: Retained for 7 years (legal requirement).

Your Rights

Under UK GDPR, you have the right to:

• Access — Request a copy of your personal data
• Rectification — Correct inaccurate personal data
• Erasure — Request deletion of your personal data ("right to be forgotten")
• Portability — Receive your data in a machine-readable format (CSV export available to Pro users)
• Restriction — Restrict processing of your personal data
• Object — Object to processing based on legitimate interest
• Withdraw consent — Withdraw consent for analytics cookies at any time via the cookie banner

To exercise any of these rights, contact us at privacy@buckden.io.

Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect data from children under 16. If you believe we have collected data from a child, contact us immediately.

International Transfers

Your data is processed within the UK and EU. We do not transfer data outside of these jurisdictions except where necessary for third-party services (e.g., Stripe), which operate under appropriate safeguards (Standard Contractual Clauses).

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notification. The "Last updated" date at the top indicates when the policy was last revised.

Contact and Complaints

If you have questions or complaints about our data practices:

• Email:privacy@buckden.io
• ICO: You have the right to lodge a complaint with the Information Commissioner's Office if you believe your rights have been infringed.