PRIVACY POLICY

Last updated: January 18, 2025

1. Who We Are

Costly DIY is the data controller of your personal data collected through our DIY project cost estimation platform.

Contact: costlydiy@gmail.com

2. What Personal Data We Collect

Account Information: • Name and email address • Password (stored as encrypted hash) • Account preferences and settings

Project & Usage Data: • DIY project details (names, descriptions, dimensions) • Material selections and quantities • Cost estimates and calculations • Project photos (if uploaded) • Usage analytics and activity logs

Payment Information: • Processed securely by Stripe (we do not store full payment card details) • Billing address and transaction records • Subscription status and billing history

Technical Data: • IP address and device information • Browser type and version • Cookie identifiers (see Cookie Policy) • Error reports and diagnostic data

3. How We Use Your Personal Data

Legal Basis and Purposes:

To Provide the Service (Performance of Contract): • Create and manage your account • Store and calculate your project data • Generate cost estimates and reports • Process material database queries • Provide customer support

To Process Payments (Legal Obligation/Contract): • Handle subscription billing • Process refunds • Maintain financial records

To Improve the Service (Legitimate Interests): • Analyze usage patterns to enhance features • Improve cost estimation accuracy • Develop new materials database entries • Conduct security monitoring

For Marketing (Consent Only): • Send service updates and feature announcements • Provide tips and DIY project guidance • You may opt out at any time

Legal Compliance (Legal Obligation): • Comply with tax and accounting requirements • Respond to legal requests • Maintain audit trails

4. Data Sharing and Disclosure

We share personal data only in these limited circumstances:

Service Providers (Data Processors): • Stripe: Payment processing • Cloud Hosting: Secure data storage and service delivery • Email Services: Account communications • Analytics: Aggregated usage insights

All processors operate under strict data processing agreements and security requirements.

Legal Requirements: • Law enforcement requests (where legally required) • Court orders or regulatory demands • Protection of our rights and property

We never sell your personal data to third parties.

5. International Data Transfers

Some of our service providers are located outside the UK/EEA. We ensure adequate protection through: • EU/UK Adequacy Decisions • Standard Contractual Clauses (SCCs) • Other approved transfer mechanisms

Contact us for specific details about data locations.

6. Data Retention

We retain your data as follows:

Active Accounts: • Account data: While your account exists • Project data: While your account exists (you can delete projects anytime) • Usage logs: 2 years maximum

After Account Closure: • Account data: 30 days (then deleted) • Financial records: 7 years (legal requirement) • Anonymized analytics: May be retained indefinitely

You can request earlier deletion subject to legal obligations.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Access: Request a copy of personal data we hold about you

Rectification: Correct inaccurate or incomplete data

Erasure: Request deletion of your data (subject to legal obligations)

Restriction: Limit how we process your data

Data Portability: Receive your data in a portable format

Object: Object to processing based on legitimate interests

Withdraw Consent: For marketing or other consent-based processing

To exercise these rights: Email costlydiy@gmail.com with your request.

Right to Complain: You may lodge a complaint with the Information Commissioner's Office (ICO) if you believe we've mishandled your data.

8. Data Security

We implement comprehensive security measures including:

Technical Safeguards: • Encryption in transit and at rest • Secure authentication systems • Regular security updates and patches • Access controls and monitoring

Organizational Measures: • Staff training on data protection • Regular security assessments • Data breach response procedures • Privacy by design principles

Breach Notification: We will notify relevant authorities and affected individuals of data breaches in accordance with UK GDPR timelines (within 72 hours to authorities where required, without undue delay to individuals where high risk).

9. Children's Privacy

The Service is not intended for children under 16 years old. We do not knowingly collect personal data from children under 16. If we become aware we have collected such data, we will delete it promptly.

Parents who believe their child has provided personal data should contact us immediately.

10. Cookies and Tracking

We use cookies and similar technologies as detailed in our [Cookie Policy](/cookies). This includes:

• Essential cookies: Required for service functionality • Analytics cookies: Help us improve the service (with consent) • Preference cookies: Remember your settings

You can manage cookie preferences through your browser settings or our cookie banner.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via: • Email notification to account holders • Prominent notice in the application • Updated "last modified" date

Continued use of the Service after changes indicates acceptance.

12. Contact Information

Data Protection Inquiries: costlydiy@gmail.com General Support: costlydiy@gmail.com

For data protection rights, account deletion, or privacy concerns, please email us with "Privacy Request" in the subject line.

---

Additional Resources: • [Cookie Policy](/cookies) • [Terms of Service](/terms) • Information Commissioner's Office (ICO): ico.org.uk

This Privacy Policy is designed to meet UK GDPR and Data Protection Act 2018 requirements. For legal advice on data protection matters, consult a qualified data protection solicitor.