Terms and privacy

1. Who we are

Apres runs aftercare for new-build homes in the UK. When something goes wrong with a new home during its warranty, the owner reports it to us, we look at it, a trade puts it right, and the housebuilder who built the home can follow it from start to finish. This notice explains what we hold about you to do that, why, who sees it, how long we keep it, and what you can ask us to do with it.

Apres is [TO CONFIRM: legal entity name], a company registered in [TO CONFIRM: England and Wales] under company number [TO CONFIRM: company number]. Our registered office is [TO CONFIRM: registered address]. We are registered with the Information Commissioner's Office under number [TO CONFIRM: ICO registration number].

For the personal data in the service, Apres acts as [TO CONFIRM: controller, joint controller with the housebuilder, or processor on the housebuilder's behalf. This decides who answers your requests, and must match the agreement between Apres and each housebuilder].

For anything in this notice, email [TO CONFIRM: email address for data requests].

2. Who this notice is for

Everybody with an account, in the Apres app or on the web:

• homeowners, including the people named for a company that owns a home;
• trades: the firms who carry out repairs, and the people at those firms;
• housebuilders: the people at the company that built the home;
• the Apres team.

It also covers people we hold details about who have no account, such as the owner of a home who has not signed in yet, or a contact at a firm.

3. Signing in

Nobody has a password. You type your email address and we email you a six-digit code, which works once and for ten minutes. Nobody can create their own account: Apres, a housebuilder or a trade firm sets it up for you, so if we do not know your address, no code is sent.

To do this we hold your email address and the time you first signed in. Our sign-in provider keeps a technical record of each sign-in, which includes your IP address and the browser or device you used [TO CONFIRM: how long the provider keeps it]. A small number of shared demonstration accounts use a fixed code instead, and we count wrong codes against them to stop guessing.

Once you are in, you stay signed in on that device until you sign out, and the session renews itself while you use it.

4. What we hold about everybody with an account

• Your name, email address, and phone number if you gave one.
• Each seat you hold: whether you are a homeowner, a trade, a housebuilder or Apres; which home, firm or housebuilder it is for; when it was given, by whom, and when it ended. A seat is ended, never deleted.
• If you were invited: who invited you, when, and when you first signed in.
• The emails and phone notifications we have sent you: which message, when, and whether it was delivered or why not. A notification never contains the words anybody wrote; it tells you something happened and where to look.
• If you use the app on a phone and allow notifications: a token that lets us send them to that phone, which kind of phone it is, and whether you have turned them off in the app.
• Everything you do in the service, in the record described below.

5. If you own a home

• Your home: its address, plot number, development, house type, bedrooms and tenure, and the housebuilder who built it.
• Its handover dates: when it was built, snagged, legally completed (which starts the warranty), sold, when the handover pack was issued, and when you signed off its condition.
• Who owns it: the owner's name (a person or a company), a named contact for a company, email address, phone number, and the dates of ownership.
• Access notes: anything a trade needs to know before visiting, such as a dog in the house or somebody who is hard of hearing. These are kept apart from everything else about your home (see who sees what, below).
• Each problem you report: the room, what is wrong in your own words, kept exactly as you wrote them, the kind of trade you thought it needed, your photos, and when you reported it.
• What happens to each report: the trade we decide it needs, its priority and status, why it is on hold or not covered, the cause the trade gives once it is fixed, and our comment on that cause.
• Messages between you and Apres about a report, and when you last read them.
• Visits: the half-days you offer (morning, afternoon or all day, never a clock time), the one the trade books, and whether the visit happened.
• Your handover pack and meters: the documents the housebuilder files for your home, your electricity, gas and water supply numbers and meter serials, the opening readings, and photographs of the meters.

6. If you are a trade

• Your firm: its name, a contact name, email address and phone number, the trades it covers, and which housebuilders it works for.
• The people at your firm who have accounts.
• What Apres pays your firm. Only Apres sees this.
• Each job: whether you accepted or declined it and why, the visit you booked and whether it happened, the photographs you file as evidence of the work, the cause you give, and your messages with Apres about it.

7. If you work for a housebuilder or for Apres

Your name, email address, phone number and seat, and your company's contact details. Everything you do in the service is recorded against you: reports you assess, messages you write, sales and handovers you record, documents and meter readings you file. When somebody at Apres looks at the service as a housebuilder sees it, what they do is still recorded against them, not the housebuilder.

8. The record of what happened

Every change in the service is written to a log that cannot be edited afterwards: what changed, when, and which account did it, acting in which seat. Where the change was a message, the log keeps its words, and only the people who can read that message can read them in the log.

This record is the point of the service. It is how a housebuilder shows that a warranty was honoured, and how a disagreement about a repair is settled.

9. Why we use it

• To run the aftercare service: take your report, decide what it needs, send it to the right trade, arrange the visit, and see it through to the end.
• To sign you in, and to keep each account to what it is allowed to see.
• To tell you, by email and on your phone, when something needs you or has changed.
• To keep the record of what happened, for as long as a warranty or a claim about the work could need it.
• To understand how the service performs, using figures that are anonymised and added together across homes and housebuilders, such as how quickly problems are fixed. Nobody can be identified from them.

Our lawful basis is [TO CONFIRM: for example, legitimate interests (running the warranty service the housebuilder has arranged, and keeping its record), and contract where you are a party to one with Apres]. Access notes can reveal something about somebody's health, such as being hard of hearing, and we rely on [TO CONFIRM: the condition for using health information, such as explicit consent] for those.

We do not sell your data, we do not use it for advertising, and no decision about you is made by a computer alone. Where the service suggests a trade for a job, a person decides.

10. Who sees what

• You see your own account, and what belongs to your seat.
• A homeowner sees their home or homes, the reports on them, their messages with Apres, the visits, the handover pack and meters, and the name and contact details of the trade firm given each job.
• The housebuilder that built your home sees a report once Apres has assessed it, never before; a report Apres turns down at that first look never reaches them. From then on they see the report, its photos, its visits, its record, and the messages you write to Apres about it. They also see the details of the homes they built and their owners, the handover packs and the meters. A housebuilder never sees another housebuilder's homes.
• A housebuilder can download its own records: its homes, their owners, and each report with the record of what happened on it.
• A trade sees only the jobs given to its firm, and everybody at the firm sees all of them. While a job is open the trade also sees the home's address, the owner's name and contact details, the access notes, and its own messages with Apres. It never sees your messages with Apres, and once the job is finished it no longer sees your home.
• Access notes are seen by Apres and by a trade with an open job at the home, and by nobody else, not the housebuilder.
• People at the same firm or the same housebuilder see each other's names and contact details.
• Apres sees everything, because running the service needs it. Notes Apres writes to itself stay with Apres.

Photos and documents are stored privately. Each time one is shown, the service makes a link to it that stops working after ten minutes.

11. Who handles it for us

We use these companies to run the service. Each handles your data only to do that job for us:

• Supabase, for the database, file storage and signing in. Your data is stored in [TO CONFIRM: the Supabase project's region].
• Vercel, which hosts the website. It runs in Dublin, Ireland.
• Resend, which sends our emails, including your sign-in codes.
• Expo, Apple and Google, which deliver notifications to phones. They receive the phone's notification token and the short notification itself.

Where any of them handles data outside the UK, the transfer is protected by [TO CONFIRM: the safeguard for each provider, for example UK adequacy regulations, the UK International Data Transfer Addendum, or the UK Extension to the EU-US Data Privacy Framework].

We will also share data if the law requires it, or to establish or defend a legal claim.

12. How long we keep it

What the service does today:

• Nothing is deleted automatically. When your access ends, your seat is closed and the record of it stays.
• Reports, photos, messages and the record of what happened stay with the home, because the warranty belongs to the home. When a home is sold, the previous owner's access ends on the day of the sale, and the reports they made stay with the home.
• When a housebuilder stops using Apres, its records are kept, because the warranties on its homes carry on.
• An email we could not send within two days is marked as not sent and is never sent late.
• A phone's notification token is forgotten when the phone stops accepting notifications, or when somebody else signs in on it.

Our policy: [TO CONFIRM: how long Apres keeps records after a warranty ends and after a housebuilder leaves, for example six years for claims about the work, and what is then deleted or anonymised].

13. Your rights

Under UK data protection law you can ask us:

• for a copy of the data we hold about you;
• to correct anything that is wrong or incomplete;
• to delete it, or to stop using it while a question is settled;
• to stop using it where we rely on our legitimate interests;
• for data you gave us, in a form you can take elsewhere;
• to withdraw your consent, where we rely on it.

Email [TO CONFIRM: email address for data requests] from the address on your account, so we know the request is yours. We will answer within one month. Some things we may need to keep even when asked, such as the record of a repair while a warranty or a claim could depend on it; if so we will tell you what and why.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

14. Cookies and your device

The website uses a cookie to keep you signed in. When somebody at Apres looks at the service as a housebuilder sees it, another cookie remembers that. These are needed for the service to work. There are no analytics, advertising or tracking cookies, so there is nothing to accept.

Photos you add are kept on your device until they have been sent, so a weak signal never loses one: in the app's own storage on a phone, and in the browser's storage on the web. The app keeps you signed in using your phone's secure storage.

Phones can store details of where a photo was taken inside the photo itself. [TO CONFIRM: whether Apres removes location details from photos before they are stored.]

15. Children

Apres is not meant for anybody under 18, and accounts are only given to adults. If you think we hold details about a child, for example in a photo, tell us and we will deal with it.

16. Keeping it safe

Data travels encrypted. Nobody has a password that can be guessed or leaked. What each account can see is decided in one place, inside the database, for every request, so a mistake on one screen cannot show somebody another person's home. Files are private and are only ever reached through short-lived links.

17. Changes to this notice

When we change this notice we will change the date at the top. If the change matters to what we do with your data, we will email you before it takes effect.