Privacy policy
What Anvul collects, why, how long we keep it, and the rights you have over it.
1. Who we are and who is the controller
Anvul Ltd is a company registered in England & Wales, company number 17111703, with its registered office at 16 Radford Road, Stoke-on-Trent ST4 7DA. We build and host websites for trade businesses and run the enquiries, messages and (where switched on) jobs, quotes and invoices behind them, for a one-off build fee and a flat monthly fee.
Who the data controller is depends on how you reached us:
- If you are a business owner — you signed up on anvul.co.uk, used the wizard or the console, messaged our team, or pay us — Anvul Ltd is the data controller for your account, your billing and our messages with you.
- If you are a customer of a business whose site we run — you sent an enquiry, booked or got in touch through that business's website, or the business uses Anvul for your job, quote or invoice — that business is the data controller. It decides how your details are used to serve you. Anvul Ltd acts as its data processor: we handle your details only to run the business's website and app on its instructions, under our written data processing terms. Anvul remains the controller only for the underlying platform security logs and anonymised, aggregated service statistics we need to run the platform itself.
- If you are just visiting anvul.co.uk, Anvul Ltd is the controller for the limited technical data described below.
You can reach our data protection contact at privacy@anvul.co.uk. We are not required to appoint a Data Protection Officer; that address reaches the person responsible for data protection at Anvul.
2. What personal data we collect
We collect only what we need to do the job you asked for.
From business owners (we are the controller)
| What | Examples | When |
|---|---|---|
| Account & sign-in | Your email address, your name, and sign-in records. Sign-in is normally passwordless — a short-lived six-digit code or link we email you. Where an older account has a password, we store it only as a salted hash, never in readable form. | When you sign up or sign in. |
| Your business brief & site content | Business name, trade, services and prices, opening hours, coverage areas, photos, videos, logo and brand notes — everything you give us to build your site, plus your messages with our team. | In the signup wizard, the console, and your message thread. |
| Billing | Records of your Anvul Website payments, if you have one — the £49 build fee, the £49/month subscription, any refund, amounts, dates, invoices/receipts and payment status. The Anvul app itself is free, so a firm without a website has no payment records here at all. Card payments are taken by our payment provider, Stripe; your full card number never touches Anvul's systems. | When you pay or subscribe. |
| Voice notes | If you record a voice note in the app or the console — for example to describe a change you want to your website — we keep the recording with your message so the person working on it can listen to it. The microphone is used only while you are recording, after you tap record and your phone or browser asks your permission. We don’t record at any other time, and we don’t use voice notes for anything else. | Only when you record one. |
| Location | Only if you allow it, and only while the app is open and in use — never in the background. Two features use it: “Start trip”, which counts the miles of a journey you start until you finish it, and photo proof, which checks that a photo was taken at the property so the job can show a “taken on site” badge. We keep the miles and that badge; customers never see your location or any coordinates. If you say no, everything still works — you type the miles yourself and the photo is saved without the badge. You can change your answer at any time in your phone’s Settings. | Only while a trip you started is running, or while you take a job photo. |
| How you use the app | When you are signed in to the app or the console, we record which screens you open and which buttons you use (for example “opened a lead”), linked to your account, so we can see where the app is confusing and fix it. We don’t record what you type into messages, and we never use this for advertising or share it with anyone else. | Automatically, while you use the app or the console. |
| Technical & usage | IP address, browser and device type (used to run and secure the service, not stored with visit counts). We count visits to anvul.co.uk — pages viewed, buttons used, and which video, advert or site sent you — to improve the site and see which of our marketing works. These counts use a random visit number that lasts only until you close the tab, not your name or email, and they are not linked to your account. If you arrived from one of our adverts, we note only that you came from an advert — never the advert platform’s click reference. When you sign up, we keep with your firm’s account how you found us: the campaign’s name if you came from one (for example which video), the website that sent you (its name and page — never the rest of its address), the first page you landed on, whether you came from an advert (yes or no), the country your connection came from (as our network provider reports it), whether you used a phone, tablet or computer, the app or the website, and your language — so we know which of our marketing works and where our new firms come from. We don’t use advertising cookies, advertising pixels or third-party analytics. See our cookie policy for cookies and browser storage. | Automatically, as you use the site. |
From a business's customers (we are the processor)
When you send an enquiry, book or get in touch through a business's website that Anvul runs, we handle — on that business's behalf — what you send: usually your name and contact details (email and/or phone), your address or area, your message, and any photos you add. If the business uses Anvul for its jobs, quotes, invoices or bookings, we also hold those records for it, and the confirmations, reminders and review requests it sends you. If you pay the business by card, the payment is taken by Stripe and goes to the business's own Stripe account — Anvul takes no cut of it and never sees your full card number.
Photos and videos in our own marketing. We sometimes show a business's website and its photos or videos in Anvul’s own marketing, with the business’s permission. Before we do, we blur faces, house numbers and number plates (or crop them out, or don’t use the picture) unless the homeowner has agreed in writing to appear. We never use a customer’s name, address or contact details. If you see yourself or your home in our marketing and want it taken down, email privacy@anvul.co.uk and we will act quickly.
If you run a trade business we may contact, or that contacts us (we are the controller)
We look for trade firms that might want an Anvul website, using information they or others have made public — business directories and registers (such as Companies House), the firm’s own website and its public business pages. We may record the business name, trade, area, public business contact details, and notes of any conversation we have with you, and we may prepare a private example of what your website could look like — it isn’t published or listed in search, and only someone with its private link can see it. Basis: legitimate interest in finding firms our service suits.
We don’t send unsolicited marketing by email, text or social-media direct message to sole traders or partnerships without their consent. If you message us first — for example on TikTok or Instagram, or by email — we use your handle or contact details and what you send us to reply to you; the platform you use is its own controller for its data. If you tell us you don’t want to hear from us, we stop straight away and keep only a short “do not contact” note so we don’t contact you again by mistake. Otherwise we keep a prospect’s details only while we think Anvul may suit the business, and delete them when we stop.
Children
Anvul is for businesses: you must be 18 or over to create an account or buy from us, and we don’t knowingly collect children’s personal data for our own purposes. If you think a child has given us their details, email privacy@anvul.co.uk and we’ll delete them.
We do not deliberately collect special-category data (such as health or ethnicity). Please do not include it in free-text notes.
3. Why we use your data and our lawful basis
Under UK GDPR we must have a lawful basis for each use. Ours are:
- To provide the service you asked for — build and host your website, deliver your enquiries to your account, run the messages and (where switched on) jobs, quotes and invoices, send confirmations, reminders and your review link, and take payment. Basis: performance of a contract, or the steps you asked us to take before one (your brief).
- To handle a customer's enquiry, booking or job for a business — as that business's processor, on its instructions. The business's own lawful basis applies to its use of your data.
- To run, secure and improve the platform — fraud prevention, security logging, and anonymised, aggregated service statistics. Basis: legitimate interest.
- To understand which of our marketing works — visit counts on anvul.co.uk, and how a firm found us when it signed up (the campaign, the site that sent it, its first page, its country and device). Basis: legitimate interest (knowing which of our marketing brings firms to us). You can switch the measurement off at any time — visit anvul.co.uk/?stats=off or turn on your browser’s Global Privacy Control — or object by emailing privacy@anvul.co.uk.
- To tell you about Anvul products — if you’ve signed up or bought from us, we may email you about Anvul products and features like the ones you use. Basis: legitimate interest (UK GDPR Article 6(1)(f) — direct marketing is a recognised legitimate interest under Article 6(11)), and for email the existing-customer rule in PECR (the “soft opt-in”). You can say no when you sign up (“Don’t email me about other Anvul products”) or at checkout, and every such email has an unsubscribe link. Saying no never stops service emails (sign-in codes, receipts, previews, new enquiries). We send any other marketing only if you’ve agreed to it.
- Cookies and browser storage — we set no advertising or tracking cookies on anvul.co.uk or in the Anvul app. The only storage that isn’t strictly necessary is the visit counting above, which stays on anvul.co.uk, is cleared when you close the tab, and is never shared with an advertiser; you can switch it off at any time. If we ever want anything else optional, we will ask for your consent first (PECR).
- To meet legal obligations — for example tax and accounting record-keeping. Basis: legal obligation.
Where we rely on legitimate interest, we have balanced it against your rights; you can object at any time (see "Your rights").
4. Who we share it with
We share the minimum needed, and we never sell personal data — and a business's leads and customer lists are never resold or shared with its rivals. Recipients can include:
- Stripe — our payment provider. It processes the business's Anvul Website payments to Anvul (the £49 build fee and £49 a month), and payments customers make to the business's own Stripe account. Stripe is its own controller for the payment data it needs (see Stripe's privacy policy).
- Resend — our email provider, which delivers sign-in codes, receipts, enquiry alerts, confirmations, reminders and review links on our instructions.
- The providers that run Anvul for us — Fly.io (our servers, London), Neon (our database, London), Cloudflare (website hosting, file storage and inbound email), Sentry (error reports, so we can fix faults — set up to leave out request contents and contact details), Google (Gemini AI that helps us draft website text; Maps for finding an address), Ideal Postcodes (address lookup from a postcode), Modal (processing room photos and scans, only where a business uses those features) and the browser push services (Google, Apple, Mozilla) that deliver app alerts. They act only on our instructions, under written terms. The current list, with where each one processes data, is in our data processing terms.
- The business you contacted — if you are a business's customer, your enquiry, booking or job is delivered to that business; it is their customer relationship.
- A text-message provider — we don’t send text messages yet. We will name the provider here before we do.
- Authorities — where we are required to by law, or to establish, exercise or defend legal claims.
5. How long we keep it
We keep personal data only as long as we need it:
- Business accounts and site content — kept while your firm has an Anvul account and uses it. Cancelling your website subscription doesn’t close your account: your site pauses to a holding page and its pages and content stay in your account (so paying again brings it straight back). If you close your account, we keep its data for 12 months and then delete it; if your account goes unused for 12 months after your website subscription has ended, we delete it too. Either way we email you at least 30 days before, and you can download your data first. We delete sooner if you ask, except what we must keep (below).
- Billing and tax records — kept for six (6) years after the end of the financial year they relate to, as HMRC requires.
- A business's customer data (enquiries, jobs, quotes, invoices) — held on that business's behalf while it uses Anvul, and deleted or returned when it leaves or instructs us to, as our data processing terms set out. Enquiries that never became work are deleted automatically once nobody has touched them for 24 months.
- Signup briefs that never become a build — kept while we follow up and while you might still go ahead, then deleted or anonymised; ask us and we’ll delete yours sooner.
- Visit counts on anvul.co.uk — kept as statistics; they don’t identify you and aren’t linked to your account.
- Prospect details — see “If you run a trade business we may contact” above.
- Error reports — kept by our error-monitoring provider only for its standard retention period, then deleted automatically, unless we need one longer to fix a specific problem.
When we erase a record at your request, we remove the details that identify you; where a residual record must be kept (for example in billing history), it is no longer linked to you by name wherever possible.
6. Where your data is stored
Our servers and database are in London (Fly.io and Neon). Photos and files are stored with Cloudflare. Some of our providers are based in, or reach data from, other countries, mainly the United States: Stripe (payments), Resend (email), Sentry (error reports), Cloudflare (its network), Google (AI drafting help, maps and app alerts), Modal (photo processing, where used) and the browser push services.
When personal data goes outside the UK, we make sure it stays protected in one of the ways UK law allows:
- to the European Economic Area, or another country the UK recognises as giving adequate protection;
- to US companies certified to the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”);
- otherwise, under the UK International Data Transfer Agreement (IDTA), or the European Commission’s Standard Contractual Clauses with the UK Addendum, after a transfer risk assessment.
Our data processing terms list each provider and where it processes data. Email privacy@anvul.co.uk for a copy of the safeguard we rely on for any provider.
7. How we protect it
We use encryption in transit (HTTPS), access controls, and tenant separation that keeps each business's data — and its customers' data — segregated from every other business's. Sign-in codes are short-lived and single-purpose; where any password exists it is stored only as a salted hash; sensitive actions are audit-logged. No system is perfectly secure, but we take technical and organisational measures appropriate to the data we hold.
If something goes wrong. If a personal data breach puts people’s rights at risk, we report it to the UK’s data protection regulator without undue delay and, where feasible, within 72 hours of becoming aware of it, and we tell the people affected without undue delay where the risk to them is high. Where we hold the data for a business (as its processor), we tell that business without undue delay, so it can do the same.
8. Your rights
Under UK GDPR (Articles 15–22) you have the right to:
- Be informed — which is the purpose of this policy.
- Access — get a copy of the data we hold about you (Art 15).
- Rectification — have inaccurate data corrected (Art 16).
- Erasure — ask us to delete your data, subject to the retention duties above (Art 17). You can also delete your account yourself, in the app or the console: business owners under Settings → Delete my account; crew under Me → Delete my account; customers under You → Delete my account. Business owners can download a copy of their data first from Settings → Your data.
- Restriction — ask us to pause processing while a query is resolved (Art 18).
- Portability — receive your data in a machine-readable format (Art 20). A business can export its site, content and leads at any time.
- Object — opt out of legitimate-interest processing (Art 21). If you object to direct marketing, we will always stop.
- Withdraw consent — where we rely on your consent, you can withdraw it at any time; it doesn’t affect anything we did before.
- Not be subject to solely automated decisions with legal or similarly significant effect (Art 22). We make no such decisions about you — sites are built and reviewed by people, and bookings follow the rules the business sets.
We respond within one month as required by UK GDPR. If you are the customer of a business whose site we run, that business is the controller for your enquiry, booking or job data — it may handle your request, and we will help route it and carry out its instructions. The businesses that use Anvul have also asked us to run our self-service tool for them, so you can see, download or erase what you sent them straight away.
9. Cookies
We use a small set of cookies and similar technologies. The full list, what each does, and how to turn the optional ones off, are in our cookie policy.
10. Complaints
If you’re unhappy with how we’ve handled your personal data, tell us: email privacy@anvul.co.uk with “Complaint” in the subject, or write to Anvul Ltd, 16 Radford Road, Stoke-on-Trent ST4 7DA. Say what happened and how to reach you. We’ll confirm we’ve received your complaint within 30 days (usually much sooner), look into it, keep you updated, and tell you the outcome without undue delay.
You can also complain to the UK’s data protection regulator, the Information Commission (which replaced the Information Commissioner’s Office on 30 September 2026): ico.org.uk.
11. Changes to this policy
If we make a material change we will update the effective date above, tell business owners by email, and, where the change requires it, ask again for your consent on cookies or marketing.