Privacy

Who we are

TurboClad is made and sold by STX Insulation Ltd, a company registered in Scotland under company number SC895063, whose registered office is 71 Castlegate, Berwick-upon-Tweed, TD15 1LF, United Kingdom. We are the data controller for everything described here. The way to reach us about any of it is support@turboclad.co.uk.

The app itself

• No accounts and no sign-in. You never tell the app who you are.
• No analytics, no advertising, no tracking pixels and no crash reporting. We do not know how many bends you drew this week or where you were standing when you drew them.
• One third-party component, and only in the Google Play version: RevenueCat’s purchase SDK, which is what lets you buy Pro inside the app. It is dormant until you open the Go Pro card. The web app and the installed web app carry nothing of the kind.
• Everything you enter (pipe sizes, saved jobs, your company name and settings) is stored in the app’s own storage on your device. It is not sent to us and we cannot read it.
• Your licence code is checked on the device first, by arithmetic built into the app, so Pro keeps working with no signal. If you have entered a Pro code, the app also asks our server about once a day when it has a connection whether that code is still active, so a subscription renews without you typing anything and a cancelled one stops. For a Pro code, the code is the only thing sent (no name, no email, no device identifier), and the answer is a yes or no with a date. Our host’s server logs see that request the way they see any page load.
• Workshop and Enterprise licences are limited to a number of devices, so for those codes (and only those) the app also sends a random number it made up the first time it was installed. It is not built from anything about you or the device, and it is not used for anything but counting the devices on that licence. We store a one-way hash of it with the code and the dates it was first and last seen, never the number itself. A device that has not checked in for 30 days stops counting, and we delete the records for a code when you ask or when the licence ends.
• TurboClad is a web app, so when you open it with a connection it fetches its own files from our host to stay current. That is an ordinary web request: the host sees what any web server sees, such as an IP address and a browser type, in short-lived server logs. We build nothing from that.
• Delete the app, or clear its storage, and everything it held is gone. Export a backup from Settings first if you want to keep your jobs.

Buying a licence

This is the only part of TurboClad where we hold anything about you.

• Payment. Checkout runs on Stripe’s own pages. Your card number, expiry and security code go straight to Stripe, and card details never touch our servers and we never see them. Stripe tells us the email address you paid with, the amount, and a reference for the payment.
• What we store. One row per order: the date, the Stripe reference, your email address, which plan it was (Pro monthly, annual or lifetime, Workshop monthly or yearly, or Enterprise), the amount in pence, the licence code we issued, and a note if the order needed a human to look at it. For an Enterprise licence we also keep the company name and contract reference you give us.
• What we do with it. Email you your code, send it again if you lose it, keep your code running each time a subscription renews, answer your questions, and keep the books straight. Buying does not put you on any list. We will not email you anything except your code and replies to your own messages, unless you signed up for the email list separately (below).
• Buying Pro inside the Google Play app. That purchase is Google’s, not ours. Google takes the payment and tells RevenueCat, who keep the app’s record of whether Pro is on. To do that they hold an anonymous identifier for your install, your purchase history for this app, and your device and country. They do not get your name or your email address, and we never see your card details. We do not receive an email address from a Play purchase at all, so there is no order row on our side and nothing to email you. Cancel or ask for a refund through Google Play.

The email list

If you type your address into the “fitter’s pack” box on this site, we store that address, the date, and which page the box was on. We send you the pack, and after that an email when there is something worth hearing, such as an offer or a new fitting. One or two a month at most. Every one of those emails carries a one-tap unsubscribe link; tapping it takes you off the list at once, and we keep only the fact that you left so a later mistake cannot put you back on. No name is asked for, nothing is bought or sold, and the list is never shared or rented. The app never needs your email and works the same whether or not you are on the list. Resend sends the emails for us (see below).

Emailing us

If you email support, or use the contact form on this site, we get your name, your email address and whatever you write. The form does nothing clever: it sends us the message so we can reply. We keep the correspondence so we can pick the thread back up later.

Cookies

This website sets no cookies unless you tell it to. If we are running advertising you will see a small banner asking whether Google Analytics and Meta may measure which pages and adverts bring people here; tap Essential only and nothing is stored on your device, tap Accept and those two set their usual cookies, under their own privacy policies, until you clear them or change your mind (your choice is remembered on your device for a year, not in a cookie). Without that banner, and always for anyone who declines, page views are counted two ways, neither of which identifies anyone. First, by this site’s own server: each page view adds one to a daily counter for the page, the referring website and the visitor’s country. It stores whole numbers per day, with no IP address, no device details and no visitor identifier stored, and browsers that send a Do Not Track or Global Privacy Control signal are not counted at all. Second, by the hosting provider’s cookieless measurement (Vercel Web Analytics and Speed Insights): a script served from this site’s own domain reports the page visited, the referring page, approximate location derived from the request, the device, operating system and browser type, and how fast the page loaded. No cookie or identifier is stored on your device; the provider tells visits apart with a hash of the incoming request that it discards within 24 hours. What we see is aggregate counts, never an individual’s browsing history. The site’s smooth scrolling and the film on the home page use two pieces of open software bundled with the site and served from this domain, which load nothing from anyone else and store nothing; their licences are in the third-party notices. When you go to pay you leave for Stripe’s checkout, which uses its own cookies to run the payment and spot fraud. That is covered by Stripe’s privacy policy.

Who else sees it

We use a handful of suppliers to run the business. They get only what they need:

• Stripe takes the payment and holds the payment record.
• Google Play and RevenueCat only if you buy Pro inside the Android app: Google takes that payment, and RevenueCat keeps the record of whether your Pro is on. Neither gets your name or your email address from us.
• Resend sends your licence email, so it handles your email address and your code.
• Supabase hosts the database the order row sits in.
• Vercel hosts this website and the code behind it, and counts its page views the cookieless way described under Cookies.
• Google Analytics and Meta see your visit only if you tapped Accept on the cookie banner, and only while we are advertising: which pages and adverts brought you here, so we can tell which adverts are worth running. Nothing about the app, nothing you type.
• Telegram: a sale sends a one-line alert to the owner’s phone, so a licence email that fails to send gets spotted the same day. That line includes the plan, the amount and your email address.

That is the whole list. We do not sell your data, share it for advertising, or pass it to anyone else, unless we are legally required to, for example by a court or a tax authority. Some of those suppliers are US companies and may process data outside the UK; they do so under the data protection terms set out in their own agreements.

Why we are allowed to hold it

• To perform our contract with you: issuing, re-sending and renewing your licence code.
• Legal obligation: keeping sales records for company and tax purposes.
• Our legitimate interests: answering support emails, spotting a payment that has gone wrong, and dealing with codes that have obviously been shared at scale.

How long we keep it

• Order records: six years from the end of the accounting year they fall in, because UK company and tax rules require it. After that they go.
• Support emails: for as long as they are useful, normally a couple of years, then deleted.
• Stripe’s own payment records: kept by Stripe under their retention rules, not ours.

Your rights

Under UK GDPR you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything wrong, such as a mistyped email address;
• delete what we hold, though we have to keep the bare sales record for the six years above;
• hand your data over in a portable form, or restrict or object to what we do with it.

Email support@turboclad.co.uk and say what you want. It helps if you write from the address you paid with, or quote your licence code, so we can find you without asking for anything extra. We reply within one month, and there is no charge.

Complaints

If you think we have got this wrong, tell us first. It is one bloke and an inbox, and most things are sorted the same day. If you are still not happy you can complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk.

Changes

If we change what TurboClad does with data, this page changes in the same breath and the date at the top moves. If the change is a significant one for people who have already bought, we will email them.