Your information
Privacy Notice
This notice explains what personal information HomeRoots uses, why we use it, who it may be shared with and the choices available to you.
Last updated: 25 August 2026
1. Who we are
HomeRoots is operated by Lee Thompson, a sole trader, and is the controller responsible for your personal information. HomeRoots can be contacted at support@home-roots.co.uk or Unit 157953, PO Box 7169, Poole, BH15 9EL.
2. Information we collect
- Account information: your name, email address, encrypted authentication credentials, account dates and preferences.
- Home information: property names and addresses, rooms, appliances, decoration records, model and serial numbers, purchase details, warranties, maintenance, timeline entries and insurance information.
- Files you choose to upload: photographs, receipts, manuals, certificates and other documents. These may contain personal information, so you should only upload material you are entitled to store.
- Household and sharing information: invited email addresses, household roles, invitation status and buyer-passport sharing settings.
- Subscription information: plan, subscription status, billing dates and Stripe customer or subscription identifiers. HomeRoots does not receive or store your full card number.
- Technical and security information: IP address, device, browser, request and error logs, security-check results and anonymised site usage information.
- Communications: messages and support requests you send to us.
3. Why we use your information
| Purpose | UK GDPR basis |
|---|---|
| Create and secure your account; provide homes, records, sharing, export and deletion features. | Performance of our contract with you. |
| Process Premium subscriptions and maintain billing status. | Performance of our contract and compliance with legal obligations. |
| Send account, security, invitation, warranty and insurance reminder emails. Reminder emails can be switched off in Account settings. | Performance of our contract and our legitimate interest in delivering requested product features. |
| Prevent abuse, protect accounts, investigate errors and maintain service reliability. | Our legitimate interests in operating a secure and reliable service. |
| Understand anonymised website usage and improve HomeRoots. | Our legitimate interest in understanding and improving the service. |
| Keep records required for accounting, tax, disputes or law-enforcement requests. | Compliance with legal obligations and, where relevant, our legitimate interests. |
We do not sell personal information and do not use it for automated decisions that produce legal or similarly significant effects.
4. Who processes information for us
We use carefully selected providers to operate HomeRoots:
- Supabase for authentication, database services and private file storage.
- Stripe for subscription checkout, payment processing and billing management.
- Vercel for website and application hosting, operational logs and cookie-free, anonymised web analytics.
- Resend for account-related and Premium reminder email delivery.
- Cloudflare Turnstile for fraud and automated-abuse protection.
- Google Workspace for business email and support communications.
We may also disclose information where required by law, to establish or defend legal rights, or in connection with a genuine sale or reorganisation of the business. Providers process information under their own security and contractual commitments.
5. Sharing features
Homeowners control household invitations and buyer-passport links. Invited household members may see or edit home information according to their assigned role. A buyer-passport link can be opened by anyone who obtains the link until it expires or is disabled, so owners must share it carefully. The buyer view intentionally excludes private documents, photos, insurance details, warranty documents and account information.
6. International transfers
Some providers may process information outside the UK. Where required, we rely on UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard. You can contact us for further information about the safeguards relevant to your data.
7. How long we keep information
Account and home information is generally kept while your account remains open. If you permanently delete your account, HomeRoots removes the associated homes, records and stored files and cancels the connected Stripe customer where applicable. Limited information may remain temporarily in secure provider backups or logs until their normal retention cycles complete.
Payment, accounting, fraud-prevention, support or dispute records may be retained for up to six years, or longer where the law requires. Expired invitations, security logs and reminder-delivery records are kept only as long as reasonably needed for security, service operation and troubleshooting.
8. Your rights
Depending on the circumstances, UK data-protection law gives you rights to access, correct, erase or restrict your information, object to certain uses and receive portable information. You can download an account-data export or request permanent deletion from Account settings. You can also contact us. We may need to verify your identity before completing a request.
If you are unhappy with our response, you may complain to the Information Commissioner’s Office.
9. Security
HomeRoots uses access controls, private storage, row-level database security, encrypted connections, signed file links, rate limits and security checks. No online service can guarantee absolute security. Use a unique password, protect sharing links and contact us promptly if you suspect unauthorised access.
10. Age and changes
HomeRoots is intended only for people aged 18 or over. We may update this notice when the service, providers or law changes. Material changes will be highlighted through the service or by email where appropriate.