Legal
Privacy policy
This policy explains how Pocketa collects, uses, shares, retains and erases personal data across the public website, signed-in workspace and supported supplier routes. It applies from the date shown below and should be read with the Cookie policy.
Last updated: August 2026
1. Controller and scope
Pocketa is the trading name of Pocketa Limited, a private limited company registered in England and Wales (company number 17397332). Pocketa Limited trading as Pocketa is the controller of the personal data described in this policy. The controller can be contacted at hello@pocketa.co.uk or at the business address published on Legal and business information. Pocketa provides public renovation-planning information, a signed-in homeowner workspace and limited routes through which homeowners can contact or continue with suppliers.
The current formal privacy-rights contact route is also Contact. Choose Data privacy and statutory rights. Pocketa has not appointed a data protection officer.
2. Personal data we process
- Website and device data: IP address, browser and device type, network-derived region, referrer, requested pages, cookie choices and necessary security or performance signals.
- Account and authentication data: email address, account identifiers, profile details, access and security records. The authentication provider handles password credentials; Pocketa does not store readable passwords.
- Workspace data: project setup, estimator imports, checklist content, planning notes, planned costs, recorded purchases, saved products, outside-purchase records and sourcing intentions.
- Forms and communications: name, email, phone number, company details, message text and the other fields you choose to submit through contact, feedback, updates or supplier forms.
- Supplier-route data: contact, postcode, project, requirement, answer and limited file information submitted through a supported quote, consultation, sample or related route.
- Commercial and audit data: quote, consultation, supplier-website continuation, sample, purchase, settlement, email-delivery, consent-confirmation, dispute and security records.
3. Purposes and lawful bases
UK data protection law requires a lawful basis for each processing purpose. The basis depends on the context rather than the data field alone. The table below describes the main processing activities.
| Activity | Personal data | Main lawful basis |
|---|---|---|
| Account registration and workspace operation | Account identifiers, authentication records and the project content you ask us to save | Performance of our contract with you, or steps you ask us to take before providing the service |
| Security, abuse prevention and service reliability | IP address, device and browser signals, security events and limited operational logs | Our legitimate interests in protecting users and operating a reliable service; legal obligation where one applies |
| Contact, feedback and support | The contact details, message and context you submit | Our legitimate interests in responding and maintaining service context; contractual steps where the message concerns your account or a requested service |
| Quote, consultation, sample and related supplier routes | The contact, project, requirement and limited file information shown in the route | Performance of a requested service or steps at your request before a contract; consent where a particular route expressly relies on it |
| Supplier interest and applications | Applicant identity, registered address, business type, trading history, company or VAT details, product categories, commercial proposals, fulfilment, returns, warranty and compliance information, plus review, domain-match and duplicate signals | Steps requested before a possible commercial relationship and our legitimate interests in assessing and administering applications |
| Non-essential analytics | Cookie identifiers, website usage data, and advertising conversion measurement such as account sign-ups, where the configured tools collect them | Consent where required by UK rules. Necessary aggregate operational analysis may rely on legitimate interests where it does not require consent |
| Commercial, tax, dispute and legal records | Minimised transaction, quote, supplier-route, audit and correspondence evidence | Legal obligations and our legitimate interests in accounting, resolving disputes and establishing or defending legal claims |
Where we rely on legitimate interests, we consider the necessity of the processing and its effect on individual rights. Where we rely on consent, you can withdraw it, but another lawful basis may still apply to records we must keep.
4. Service providers and other recipients
Pocketa uses service providers to operate the product. They process relevant data under their applicable service terms, data-protection terms and our instructions where they act as processors. A provider may act as an independent controller for limited processing it determines itself, such as meeting its own legal duties.
| Provider category | Operational role |
|---|---|
| Hosting and deployment providers | Serve the website, run application code and produce necessary infrastructure and security logs. |
| Supabase | Provides authentication, database and private file-storage infrastructure for relevant product records. |
| Resend | Sends account, form and operational email where a product journey requires it. |
| Cloudflare Turnstile | Processes technical browser and interaction signals on protected forms to reduce automated abuse. |
| Analytics providers, including Google Analytics and, where linked, Google Ads conversion measurement | Measure website use and advertising conversions such as account sign-ups, only under the cookie and consent controls that apply to the visit. |
We may also disclose personal data where reasonably necessary to comply with law, regulation or a valid legal request, or to protect users, the service and legal rights. We do not sell personal information as a business model.
5. Supplier-route sharing
Browsing a product or supplier page, saving an available product inside Pocketa, or recording an outside purchase does not by itself send your workspace content to that supplier. Following a normal link to an external website means that website receives the technical information ordinarily sent by your browser and then applies its own privacy policy.
A supported quote, consultation, sample or related route can share data with the supplier only after you take the explicit submission step and confirm that you understand the route-specific sharing. The submitted payload may include contact details, postcode, project requirements, selected answers and limited files shown in that journey. It does not grant the supplier standing access to the rest of your workspace.
We share the fields collected for that route. Different routes ask for different information, so read the submission summary and confirmation before sending.
6. Retention, project erasure and account closure
Pocketa does not use a single retention period for every record. Project erasure removes operational workspace content but preserves and minimises evidence that must remain for disputes, accounting, security or legal claims. Account closure is a separate, multi-project process.
| Data class | Trigger | Retention period | Outcome |
|---|---|---|---|
| Unsigned estimator drafts | You use the public estimator without importing it into a project | Answer drafts and handoff snapshots are held in your browser with a seven-day expiry. They may disappear sooner if you clear browser storage. | Expired browser records are rejected and removed when Pocketa next reads them. Normal hosting, security or consented analytics logs are separate. |
| Active workspace content | You save or import project information into a signed-in workspace | Held while needed to provide the active workspace. Pocketa has not implemented a 12-month inactivity purge. | Checklist, setup, spending, saved product, planning and similar records enter the project-erasure process when a verified erase completes. |
| Project-linked files | A supported quote or consultation route accepts a project file | Held while the route and project require it, subject to dispute or legal review. | Verified project erasure removes and checks both the private storage object and its metadata. Pocketa is not a general homeowner document vault. |
| Commercial evidence | A quote, consultation, sample, supplier route, purchase or settlement record exists | Generally six years from project erasure or the last commercial event, whichever is later. An open dispute can extend the hold. | Direct contact details, free text and linked files are minimised at erasure where the retention system permits. The evidence shell is then due for periodic retention review after the retention period. No automatic live cleanup schedule is currently enabled; until automation is available, eligible records are handled through that reviewed process rather than an unattended purge clock. |
| Operational email records | An operational message is queued or sent | Unsent rows are cancelled or redacted during project erasure. Sent-row personal content becomes eligible for redaction after 90 days. | A limited delivery or commercial evidence shell may remain for its applicable retention window. No automatic live cleanup schedule is currently enabled. |
| Account closure records | You request closure of the whole account | Where the reviewed account-closure workflow is enabled, a recorded request starts a 30-day cool-off. That optional cool-off does not delay assessment or response to a statutory UK data-protection rights request. Otherwise Contact submits a manual request for review. | In the reviewed workflow, the profile is anonymised only after access and project processing complete. A Contact submission does not itself start or record that workflow. |
| Contact, application, security and audit records | You contact Pocketa, apply as a supplier or create an operational or security record | Kept only as long as needed for the relevant conversation, application, security, audit, dispute or legal purpose. Some stores require manual privacy review. | Deleted, redacted or minimised when no longer needed. Provider-side records can follow the provider's applicable settings and safeguards. |
Project erasure is subject to ownership verification, open dispute holds and separate deletion and verification of private files. Where the self-service path is not enabled, use Contact. Pocketa does not promise a maximum 30-day project wipe.
Where the reviewed account-closure workflow is enabled, a recorded request starts a 30-day cool-off, then blocks access and processes every project before profile anonymisation. That optional cool-off does not delay assessment or response to a statutory UK data-protection rights request. If the reviewed workflow is unavailable, Contact creates a manual message and does not itself start the cool-off. A completed reviewed closure retains the limited blocked identity records described above.
7. Your data-protection rights
Depending on the processing and the statutory conditions, UK data protection law may give you the following rights:
- Access: Ask whether we process your personal data and request a copy of personal data we hold.
- Rectification: Ask us to correct inaccurate personal data or complete information that is incomplete.
- Erasure: Ask us to erase personal data. This right is not absolute, and lawful retention, disputes, security needs or legal claims can limit what is removed.
- Restriction: Ask us to restrict processing in circumstances provided by data protection law.
- Objection: Object to processing based on legitimate interests and to direct marketing. We do not override an objection unless a lawful reason permits us to continue.
- Portability: Request eligible personal data in a structured, commonly used and machine-readable format where the statutory conditions apply.
- Withdraw consent: Withdraw consent at any time for processing that relies on consent. Withdrawal does not make earlier lawful processing unlawful.
We may ask for information needed to verify your identity and locate the relevant records. Exercising a right is normally free, but the law permits limits or a reasonable fee in some circumstances. We will respond within the period required by applicable law and explain any lawful limitation.
8. Cookies, analytics and security tools
Strictly necessary storage and security processing support authentication, service operation, consent choices and abuse prevention. Cloudflare Turnstile may process IP address, browser and interaction signals on protected forms.
Non-essential analytics, including Google Analytics where enabled through Google Tag Manager, operate only after you accept the current analytics purpose version on the cookie banner. The production container loads on public marketing pages only, not on sign-in pages or the signed-in workspace, and not on preview or non-production deployments. After acceptance, those marketing surfaces can measure website use and advertising conversions such as account sign-ups when Google Ads is linked to that Analytics property. Application code does not install a separate Google Ads tag. Leaving the banner without choosing does not count as consent. You can review or change those choices through Cookie settings and the Cookie policy.
9. International processing and security
Some service providers may process data outside the UK. Provider regions, data-protection terms and any restricted-transfer safeguards still require a documented provider-by-provider review. This policy does not claim that an unverified transfer mechanism is already in place.
Pocketa applies technical and organisational controls intended to protect personal data, including authenticated access, private storage for supported files, row-level database controls, restricted service credentials and reviewed erasure workflows. No internet service can promise absolute security.
10. Policy updates
We update this policy when processing, providers or legal requirements materially change. The last-updated date identifies the published version. Where a change materially affects an active account, we may also provide an appropriate in-product or email notice.
11. Contact and complaints
To ask a privacy question or exercise a right, use Contact and state that your message concerns privacy. Include enough context to identify the account, project or submission, but do not send passwords or unnecessary sensitive information.
You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection. Visit www.ico.org.uk for current complaint routes and contact details. You may contact the ICO at any time, although giving Pocketa an opportunity to resolve the concern first may lead to a faster practical answer.
Plain-English overview: Personal data safety. See also Cookie policy, Terms of use, and Supplier application terms.