Privacy Policy

The short version

Your records stay on your phone. Customers, addresses, records, invoices, photos and signatures are stored there, not on our servers.
Records and invoices are emailed from your own email account, through your own email provider. They don’t pass through us.
If you have a GasPad account, we hold only what’s needed to run it: your email address, which phone your plan is on, and any bug reports you send us.
We send you tips, news and offers only if you ask for them, and every one has a one-click unsubscribe.
We don’t sell your information, show adverts or track you across other apps and websites. No AI reads or writes your records.

Who we are

GasPad is made by KitCode Studios (“we” or “us”). KitCode Studios Ltd, registered in England and Wales with company number 17517161, is at Office 9944, 321-323 High Road, Chadwell Heath, Essex RM6 6AX.

We’re the “controller” of the personal information about you described here, which means we decide how and why it’s used.

For anything about your personal information, email support@gaspadapp.co.uk.

Your customers’ information

The details you keep about customers, landlords, agents and tenants, and everything in your records, stay on your phone. We never receive them, so we don’t use them for anything and we aren’t a “processor” acting for you.

You decide what you collect about your customers and why, which makes you the controller of that information. In short, that means:

tell your customers how you use their details, for example in your own privacy notice or terms;
keep details only as long as you need them. Landlords must keep gas safety records for two years, so keep your copies at least that long;
delete a customer or address in GasPad if someone asks you to and you no longer need it;
check whether you need to pay the ICO’s data protection fee, using the short self-assessment on the ICO’s website.

The app explains this too, under Settings › Privacy and Security › How Your Data Is Kept.

What we collect

When you use the app

Nothing you enter in GasPad is sent to us. Your business details, signature, email settings, customers, records, invoices, visits and photos are kept on your phone.

If you have a GasPad account

Your email address, which we send six-digit sign-in codes to. There are no passwords.
The phone your plan is on: a random code for the app on that phone, the phone’s name, whether it’s an iPhone, iPad or Android phone, and when it was linked. A plan works on one phone at a time.
The dates your plan moved to a different phone. A plan can move up to three times in 30 days, so one sign-in can’t be shared around a firm.
A membership we’ve switched on for you by hand, if any: when it ends and a short note.
When you signed up and last signed in.
Whether you’ve asked for tips, news and offers by email, where you said so and when, and which of those emails we’ve sent you.
Two facts the app tells us, once each, so those emails suit where you are: that you’ve used your free records, and that a plan from the App Store or Google Play is running on your phone. Nothing from your records goes with them.

When you subscribe on this website

Payments are taken by Stripe. Stripe collects your name, email address, card details and billing address, and keeps them under its own privacy policy. We never see your full card number. Stripe tells us your email address, your plan, whether it’s active and when it renews, which our accounts service uses to switch your plan on in the app. We keep a record of your subscription and payments for our accounts.

Stripe’s checkout asks whether you’d like tips, news and offers from us by email. It’s left blank, and we only send them if you choose Yes.

Offer codes

If we email you a personal offer, we make a single-use code in Stripe and note your account against it, so the code works for you alone and only once.

Referral codes

If you subscribe on this website, we make you a referral code (a short code based on the start of your email address) and email it to you. When someone subscribes with it, Stripe tells us whose code it was, so we can add your credit. We keep which subscriptions used your code, and when your credit was added. We don’t tell the person who used your code anything about you beyond the code itself.

When you subscribe in the app

Plans bought in the app go through the App Store or Google Play. Apple or Google take the payment, and your phone checks with them whether your plan is active. We don’t store those purchases and never see your card details.

When you contact us

Support emails: your email address and whatever you tell us, so we can help.
Bug reports and ideas sent from Settings: your message, your app version, phone model and system version, and your email address so we can reply. If you’re signed in they go to our accounts service; otherwise they open an email to us. Nothing from your records is added.

Crash reports

If you’ve allowed it in your phone’s settings, Apple or Google send us crash reports when the app stops working. They tell us where in the app it went wrong and on what kind of phone. They don’t identify you and contain nothing from your records.

When you set up email

To find your email provider’s server settings, GasPad looks up the part of your email address after the @ (for example sampleheating.co.uk) in Thunderbird’s public directory of email settings, and in the internet’s address book through Cloudflare or Google. Only that domain name is sent, never your full address or password. Your password goes only to your own email provider, when GasPad sends your emails.

How we use it, and why we’re allowed to

UK data protection law says we need a lawful reason (a “lawful basis”) for each way we use your information. These are ours.

What we do	Lawful basis
Sign you in, keep your plan on one phone and switch on memberships	Contract: it’s the service you asked for
Take payment for website subscriptions and switch your plan on	Contract
Make your referral code, and add credit when someone uses it	Contract: it’s the referral offer in our Terms of Use
Send tips, news and offers by email, timed by what the app has told us	Consent: only if you said yes, and you can stop any time
Keep billing records for tax	Legal obligation
Limit how often a plan moves between phones	Legitimate interests: keeping one plan to one person
Answer your emails, and fix the bugs you report	Legitimate interests: helping you and keeping GasPad working
Look at crash reports to fix problems	Legitimate interests: making the app reliable
Keep records the law requires, and answer lawful requests	Legal obligation

We don’t make decisions about you by automated means that have legal or similarly significant effects.

We don’t sell your personal information. We share it only with companies that help us run GasPad, under contracts that stop them using it for anything else:

Supabase: our accounts service, which holds the account information above.
Stripe: taking payment for subscriptions bought on this website, and sending receipts.
Resend: sending your sign-in codes and, if you’ve asked for them, our tips, news and offers.
Apple and Google: the app stores, payments for plans, and crash reports.
Cloudflare: hosting this website.

We may share information if the law requires it, for example when the police make a valid legal request. If GasPad is ever sold or merged, your information would move to the new owner under this policy, and we’d tell you first.

GasPad links to other websites: makers’ manual pages, and Gas Safe Register’s pages. We don’t send them anything about you. If you open one, that website’s own privacy policy applies.

Where it’s stored

Your records are stored on your phone. If your phone backs up to iCloud or Google, your backup is kept by Apple or Google under your agreement with them.

Our accounts service stores its information on Supabase’s servers in Ireland, in the European Union. UK law recognises the EU as protecting personal information to the same standard (an “adequacy” decision), so it can be kept there safely.

Some providers, such as Stripe, Resend, Apple and Google, may also handle information in the United States or elsewhere. For those we rely on the UK’s approved safeguards for international transfers: the UK Extension to the EU–US Data Privacy Framework where the provider has signed up to it, or the UK’s International Data Transfer Addendum.

How long we keep it

Everything on your phone: until you delete it. You can delete a single record, customer or address, or erase everything at once.
Your account and membership: for as long as you have an account. Deleting your account removes them straight away.
Phone moves: 30 days, then deleted.
Bug reports and ideas: 12 months. If you delete your account, ones you’ve sent are no longer linked to it, and we’ll delete them too if you ask.
Support emails: 12 months after we last hear from you.
Your choice about emails, and which ones we’ve sent: for as long as you have an account. If you unsubscribe, we keep a note that you said no, so we don’t email you again by mistake.
Referral codes and credits: for as long as you have an account, and credits as part of your payment records after that.
Website subscriptions and payments: six years after the end of the tax year they belong to, as HMRC requires, even if you delete your account.

See Delete your account for exactly what’s removed.

Your rights

Under UK data protection law you can ask us to:

give you a copy of the personal information we hold about you;
correct anything that’s wrong;
delete your information;
limit how we use it, or object to us using it;
send your information to you or another service in a common format.

Email support@gaspadapp.co.uk, from the address on your account if you have one. We’ll reply within one month, and it’s free.

You can stop our tips, news and offers at any time: use the unsubscribe link at the foot of any of them, or email us. Stopping them doesn’t affect your account or your plan, and we’ll still send the emails your account needs, such as sign-in codes and receipts.

If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Phone permissions

GasPad asks for these only when you use the feature that needs them. Everything they collect stays on your phone.

Permission	What it’s for
Camera	Reading an appliance’s data plate, and taking photos for a record, such as the door on a No Access Record.
Contacts	Choosing a landlord or customer from your contacts, or bringing customers across. Only the people you pick are copied into GasPad.
Location	Only if you switch on Stamp where records are signed: GasPad notes where your phone was when a record was signed and issued, in that record’s history. It’s looked up only while Review and Send is open, and isn’t printed on the PDF.
Face ID or fingerprint	App Lock. Your phone checks it’s you. GasPad never sees your face or fingerprint.
Notifications	Reminders before records run out, and the monthly round-up.

You can change any of these in your phone’s settings. Some features won’t work without them.

Cookies

This website doesn’t use cookies, analytics or tracking of any kind, and it loads nothing from other companies’ servers. The one exception is the unsubscribe page, which tells our accounts service when you press its button. If you open the website with a referral link, the code is added to the subscribe buttons on that page only, and isn’t stored. Our web host, Cloudflare, keeps standard server logs, including internet addresses, for security.

The app keeps its settings on your phone, such as your appearance setting and whether you’ve seen the tour. These never leave your phone and aren’t used to track you.

Children

GasPad is a tool for gas engineers at work, for people aged 18 and over. We don’t knowingly collect information from anyone younger. If you think a child has a GasPad account, email us and we’ll delete it.

Keeping it safe

Records are protected by your phone’s own encryption, and App Lock adds Face ID, fingerprint or passcode on top.
Your email password is kept in your phone’s secure storage (the Keychain on iPhone and iPad, the Keystore on Android) and used only to send your emails.
Everything between the app and our accounts service is encrypted. Database rules mean each person can read only their own information.
Only the people who need to run GasPad can reach the accounts service, using two-step sign-in.
Unsubscribe links are signed, so one person’s link can’t change anyone else’s choice.

Changes and contact

If we change this policy in a way that matters, we’ll tell you in the app before it takes effect. The date at the top shows when it last changed.

Questions: support@gaspadapp.co.uk, or write to KitCode Studios Ltd, Office 9944, 321-323 High Road, Chadwell Heath, Essex RM6 6AX.