Privacy Policy

Last updated 16 September 2026

This policy explains how Broc Intelligence Ltd collects, uses and protects your personal data when you use our website trybroc.io and our product at app.trybroc.io (together, the “Service”). We are committed to handling your data lawfully, fairly and transparently under the UK GDPR and the Data Protection Act 2018.

1. Who we are

The data controller is Broc Intelligence Ltd (company number [COMPANY NUMBER]), a company incorporated in England and Wales, with its registered office at [REGISTERED OFFICE ADDRESS], London, United Kingdom. You can contact us about privacy at support@trybroc.io.

2. The personal data we collect

Information you give us

• Account details — your email address (and authentication tokens) when you sign in. Sign-in is handled through our authentication provider, Supabase.
• Property and buyer inputs — the property addresses you search for and details you enter about your buying position to generate your analysis.
• Communications — the content of any messages you send us (e.g. support emails).

Payment information

When you buy a report, your payment is processed by Stripe. We do not receive or store your full card number; Stripe handles your card data as an independent controller/ processor under its own terms and privacy policy. We receive limited transaction details (such as the fact and amount of payment and a payment reference) to fulfil your order and meet our accounting obligations.

In the other direction, we send Stripe what its payment page needs in order to charge you and what we need in order to match the payment back to your order: the amount and currency, an identifier for your Broc account, the email address on your account if you have one (so the payment page does not ask you to type it again), and the reference number and address of the property the report is for — so that the payment page names the home you are buying the report about instead of a generic product, and so that we can identify the purchase if you contact us about it. We do not send Stripe your report, your answers about the property or the seller, your buyer profile, or any analysis we have produced.

Information collected automatically

• Anonymous service statistics before you choose — on our website, and on the anonymous parts of our product (the address search, the onboarding questions and the report checkout — including when you buy without an account, where we create an unnamed anonymous account for the checkout and you have not signed in), we may measure limited usage before you make an analytics choice solely to produce aggregate service-improvement statistics. We use a constrained PostHog mode (hosted in the EU) to count things such as pages or funnel steps viewed, the site or campaign that referred you, and coarse browser/device information. The analytics identity is kept only in your browser tab’s session storage and is discarded when you close the tab — it is never written to a cookie and cannot follow you across visits — session replay is off, URL query strings and advertising click identifiers are removed before analytics are sent, and the product app filters out buyer/profile submissions and other non-approved custom events. This mode never calls our account-identification function and its temporary random identifier is not carried into the consented/account profile. A small preference record may be written if you object or change your analytics choice so we can honour it. We rely on the PECR statistical- purposes exception for the limited device access involved, and on our legitimate interests under UK GDPR for any personal data processed in providing these aggregate-oriented statistics. If you choose Reject/No thanks or Turn off, this measurement stops too — it is the measurement that runs in your browser. Some counting happens on our own servers instead and does not depend on that choice; the next two bullets describe it, because a choice that stops one and not the other is only meaningful if you can see which is which.
• Advertising cookies, only if you allow them — with your consent, and only with it, we load Google’s advertising tag so Google Ads can show you our ads again on other sites after you leave (remarketing). This is a separate choice from the analytics one: allowing analytics does not allow advertising, and either can be withdrawn without the other. Until you allow it, nothing is requested from Google at all — no script is downloaded and no cookie is set; leaving the question unanswered has the same effect as declining.
  
  What is sent. From our website: the page address without its query string (so campaign tags and Google’s gclid click identifier are removed), the page title, and the site you came from. From our product app we deliberately send less — only that a visit happened, and which of four points in the purchase journey you reached (a free estimate was shown, the price page was reached, a checkout was started, a purchase completed). The web address, the page title and the property you are analysing are not sent from the product at all, and none of the four carries the property, the price, your answers or anything you typed.
  
  What is never sent. Your name, your email address, the property or its address, your answers, and the contents of any report. We do not use Google’s enhanced conversions and we do not upload customer lists to Google. Google acts as an independent controller for this advertising data; you can also control ad personalisation directly in Google My Ad Center. Withdraw at any time using the controls on our Cookie Policy, which also switch it off in the product app.
• Counting we do on our own servers — some steps are recorded by our servers as they answer a request, rather than by anything running in your browser. Nothing is read from or written to your device to do it, which is why the analytics choice above does not control it: that choice governs storage and access on your device, and this involves neither. It is not optional in the way the browser measurement is, so we keep it deliberately narrow.
  
  What it records. That an address was searched or a teaser shown, the property identifier, our own estimated value for that property and how it was worked out — and, at the onboarding step that asks you about a listing, the answers you give there: the asking price as advertised by the seller’s agent, the condition you select from the options offered, the how-long-on-the-market band you select, and the number of price reductions you tell us about. Once you have answered the questions about yourself, our servers also count that you did, and whether we then managed to save those answers and take you on to the price — but never what those answers were, because they are about you rather than about the property.
  
  What it never records. Anything that identifies you. No name, email or account reference; no free text (the estate agent you may name in that same form is deliberately refused by the receiving endpoint, not merely left out). The listing answers and the property identifier are facts about a home — a property others can look up too — not about the person looking at it; the step counts say only that a step happened and whether it worked, never who you are or what you answered.
  
  Your browser and your connection. Each of these records carries the description your browser sends with every request it makes (its make and version, and the kind of device it is running on) and the internet address your request arrived from. We send both to our analytics provider for two narrow purposes and keep neither ourselves. The browser description is what separates a real visit from an automated one: without it every one of these records is classified as a robot, and the counts are useless. The internet address is used only to look up the country the visit came from and is then discarded — our provider is configured to anonymise it rather than store it, so no record retains the address itself.
  
  It is not a profile of you. Each record is filed under a fresh random identifier generated for that single event and then discarded. The identifier is never derived from your internet address, your browser or anything else about you, so none of them is joined to a Broc account and no record builds up a history of you over time. Be aware, though, of what the paragraph above means: two records made from the same connection within a short period could in principle be recognised as coming from the same visit, even though nothing on our side links them. We rely on our legitimate interest in understanding how visitors find and use the Service, and you can object at any time using the contact details in section 9.
• Checkout records we keep on our servers — our servers record that we showed you the paid-report checkout, and whether you chose to continue, so we can tell whether the product’s price is working. These records are filed under your account identifier. This includes visitors who never signed in: finishing the property questions creates an account for you (it simply has no email or password attached yet), whether or not you go on to buy, and these records are filed under it in the same way. That account, and the answers you gave, are deleted after 30 days if you never buy anything — unless you asked us to email you the analysis. Leaving us an address is the one thing that keeps the account: we hold it, and the record of your consent to use it, until you unsubscribe or ask us to erase it (see sections 6 and 9), because deleting the account would destroy the record of why we were allowed to write to you while your address stayed on our mailing list. They are not the anonymous counts in the previous bullet, and they are not the enhanced analytics profile that is labelled only after you consent.
  
  If a checkout you started is never paid for, we record that too — not when you leave, but when the payment page lapses, which is up to a day later. That record says which plan and price you had reached and whether we hold an email address for you, so that we can judge whether following up on unfinished checkouts would reach anyone at all. It never contains the address itself.
  
  If you arrived from an advertisement, these records also carry the campaign you came from and the click identifier the ad platform itself attached to your visit’s URL. We keep that identifier in two places, and they are different: on our record of a payment, if you start a checkout; and once against your account, from the first advertisement you arrived from, whether or not you ever buy anything. The second exists because people commonly click an advertisement one day and come back another day by typing our address directly — without remembering the first visit we cannot tell that the advertising worked. It is written once and never overwritten, and it is deleted with the account — which means different things for the two kinds of account we may hold for you. If we created one for you automatically when you answered the property questions, and you never buy, it is deleted with that account after 30 days as described above. If you signed up, it lasts as long as your account does, because we do not delete the accounts of people who chose to create one; you can ask us to erase it at any time using section 9. It is a code in a link, not anything you told us; what may be shared with Google Ads, and what is not, is set out in the advertising row of section 3 and in section 5.
  
  Nothing is read from or written to your device to do this, which is why the analytics choice above does not control it: that choice governs storage and access on your device (and the optional labelling of a browser analytics profile), and this uses neither. You can object at any time using the contact details in section 9.
• Buying a report without creating an account — you can pay without signing up. When you do, we ask Stripe for an email address so we can send you the report, and we use it for three things and no others: to send you a personal link to what you bought, to identify the purchase if you contact us about it, and — if you later choose to turn that address into a sign-in — to become the email on your account. It is not added to any marketing list.
  
  That email contains a link that opens your report without a password, so treat it like one and avoid forwarding it. Opening it sets the broc_report_access cookie described in our Cookie Policy; that cookie is strictly necessary to deliver what you paid for, which is why the analytics choice does not govern it. Adding an email or Google sign-in to the account retires both the link and the cookie.
  
  Our servers also record that the report was delivered, that the link was opened, and whether an account identity was later attached, under your account identifier. These are records of the purchase, not analytics, and the analytics choice does not control them — nothing is read from or written to your device to produce them. You can object at any time using the contact details in section 9.
• Enhanced analytics cookies and session replay (with your consent) — if you consent, PostHog may use cookies/local storage to recognise return visits, link product activity to your Broc account after sign-in, and record session replay. Once you have signed in, your analytics profile is labelled with your account identifier and your email address — and with your name, where your sign-in provider supplied one — so that we can tell whose activity we are looking at when we investigate a problem or answer a support question. That labelling applies only after you consent; it is never added to the anonymous measurement described above, and if you withdraw consent we stop it. Replay masks what you type; in the signed-in product it also masks on-screen text, so the prices and figures, anything you type and your account details stay hidden. A recording does show the fixed wording of the interface — menus, buttons, questions and the answer options offered — and so it shows which option you picked; and it shows the address of the property you are analysing, which the page's own web address already contains. Enhanced analytics run only with your consent: on our website via the analytics choice, and in the product via the one-time post-sign-in prompt or Settings → Privacy & analytics. See our Cookie Policy for details and how to change your choice.
• Marketing-email engagement (with your consent) — if you opt in to marketing emails (for example the “email me Broc's guides and product updates” checkbox, subscribing to our guides, or asking us to email you the analysis of a property you were looking at), our email provider records whether those emails are delivered and opened (via a tracking pixel in the email), and we record whether the personal links inside them are followed, against your account or subscription. That engagement measurement covers the marketing emails you chose to receive (the guides list, and product updates after you opt in), and every one of them carries an unsubscribe link that stops them — and this tracking — immediately.
  
  We also record whether our service emails ARRIVED.For the two messages we have to send you — the link to a report you bought without an account, and your order confirmation — our email provider tells us whether the message was delivered, bounced, was refused, or was opened, and we record that against your account. This is not marketing measurement and no unsubscribe link governs it, because these are not messages you can unsubscribe from. We keep it for one narrow reason: if you bought a report without creating an account, that emailed link IS your way back in, and a bounce we never saw is a paying customer locked out with nothing on our side saying so. The one-off email we send when you create an account is a service message, not marketing: its unsubscribe link opts you out of future marketing mail without deleting your account, and it does not stop transactional mail we have to send you.
• Technical and log data — such as IP address, device and browser type, and pages viewed, generated when you use the Service and necessary to operate and secure it.

Property and market data

To produce your analysis, we obtain property, address and area data from public registers and licensed third-party data providers. This data relates to properties and areas rather than to you personally, but may be combined with the address you search.

3. EPC lookups (our free EPC checker)

Our EPC checker looks up the public register of Energy Performance Certificates for England and Wales, operated by the Ministry of Housing, Communities and Local Government, and shows you what a property’s certificate means. The register’s own guidance is that this data contains personal data, so when we display a certificate we act as a controller for that processing. This section explains it.

• What we look up, and when — only the single address a visitor has specifically searched for, at the moment they search for it. We do not bulk-download the register, and we do not generate pages for addresses nobody has asked about.
• Why — to answer that lookup: to explain what the certificate says about running costs, condition and regulation for someone buying, letting or selling the property.
• Our lawful basis — legitimate interests: our interest in providing the service, and the visitor’s interest in understanding the energy performance of a property they are considering. We have carried out a legitimate interests assessment and keep it on file; email us for a summary.
• How long we keep it — a certificate we fetch is cached for up to 90 days so that repeat lookups do not call the register again, and expires after that. We do not keep a record of which visitor looked up which address, and our analytics never receives the address, postcode, UPRN or certificate number searched.
• If you type an asking price — the checker can offer to put a property’s energy band into pounds against its asking price. That figure is optional, is asked for only after the result, and is worked out in your browser: the price you type is never sent to us or stored. Our analytics records only that the feature was used and a coarse band (for example “£400k–£600k”) — never the figure itself, because an exact asking price and a timestamp together would point back at a specific property.
• If you email the breakdown to yourself — submitting the form sends a summary of that certificate to the address you typed (the send is the thing you asked for) and adds you to Broc’s guides mailing list, the same list the newsletter uses, on the same consent: agreeing to this policy by sending the form. You can unsubscribe from any email. We still do not build marketing lists from lookups themselves.
• What we never do — we do not build marketing lists from lookups, and we never contact a property’s owners or occupants because their certificate was viewed. Any email address we hold is one a visitor gave us themselves.

If a certificate is about your property. The register is the source, and changes to a certificate’s contents or its presence on the register are for the Ministry of Housing, Communities and Local Government, not for us. We can remove our cached copy at any time and stop the property being returned by our checker — email support@trybroc.io with the address or certificate number and we will action it, alongside the rights described in section 9.

Licensing. Certificate data is Crown copyright, published under the Open Government Licence v3.0. Address data is not covered by that licence — it derives from Ordnance Survey AddressBase Premium incorporating Royal Mail PAF data, and we use it for the permitted purpose of understanding building energy efficiency in the property market. Every result carries the register’s copyright and database-right notice, its licensing attribution, the certificate number and a link to the certificate on the register.

4. How and why we use your data (legal bases)

5. Who we share your data with

We do not sell your personal data. We share it only with the recipients below and where the law requires. Most are service providers who process it on our behalf under contract; the one exception is Google Ads, which receives conversion confirmations and — where you have allowed advertising cookies — remarketing signals, as its own controller in both cases (see the table in section 4). These include:

• Stripe — payment processing. Receives the amount, an identifier for your account, your account email address if you have one, and the reference number and address of the property a report is being bought for, as described under “Payment information” in section 2.
• Google Ads — two separate things, under two separate lawful bases, and it is worth keeping them apart.
  
  Conversion measurement (no consent needed, and it happens on our servers): the click identifier Google itself attached to your visit’s URL and the time an account was created, a checkout was started or a report was purchased, to confirm that an ad click led to that sign-up, checkout or sale; and, where a purchase is refunded, a matching instruction to take that confirmation back, carrying nothing beyond that same click identifier and the reference of the purchase being cancelled. No name, email, address, payment detail or account data is shared, and this happens only for visits that arrived from a Google ad. We do not use Google’s enhanced conversions: no hashed email address or phone number is ever sent.
  
  Remarketing (only if you allow advertising cookies): Google’s tag runs in your browser so Google can show you our ads again elsewhere. It receives the page address without its query string on our website, and from our product app only that a visit happened plus which of four points in the purchase journey it reached. Never your name, email, the property, its address, your answers or any report content. See the advertising bullet in section 2 and the Cookie Policy for the full list and how to withdraw.
• Supabase — authentication, database and hosting.
• Vercel — website and application hosting/deployment.
• PostHog (EU Cloud) — product analytics, session replay, and technical error and server-log monitoring.
• Email and support providers — to communicate with you.
• Licensed property-data providers — as data sources for your analysis.
• Professional advisers and authorities — e.g. our accountants or lawyers, or regulators and law-enforcement where we are legally required to disclose.

6. International transfers

Some of our providers and recipients process data outside the UK. Where they do, we rely on an appropriate safeguard recognised under UK data-protection law — such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses — so your data receives an equivalent level of protection. Our product-analytics and session-replay provider, PostHog, hosts our data on EU infrastructure. Google, which receives the conversion and (with your consent) remarketing data described in sections 4 and 5, is a US-headquartered recipient and is certified under the UK Extension to the EU–US Data Privacy Framework.

7. How long we keep your data

We keep your personal data only for as long as necessary for the purposes above. Account and analysis data is retained while your account is active and for a reasonable period afterwards; transaction and accounting records are kept for the period required by law (generally six years). EPC records fetched by our checker are cached for up to 90 days (section 3). When data is no longer needed, we delete or anonymise it.

8. How we protect your data

We use appropriate technical and organisational measures — including encryption in transit, access controls and reputable infrastructure providers — to protect your data against unauthorised access, loss or misuse. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the regulator of any breach where required.

9. Your rights

Under UK data-protection law you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time (without affecting prior processing).

To exercise any of these, email support@trybroc.io. We will respond within the statutory timeframe. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to resolve your concern first.

10. Cookies and similar technologies

We use cookies, scripts and similar technologies as described in our Cookie Policy. Enhanced analytics cookies and session replay are only enabled with your consent, and advertising cookies are a separate consent again — allowing one does not allow the other, and either can be withdrawn on its own. Before you choose, the limited anonymous statistics described in section 2 may run on the website and on the anonymous parts of the product — including a guest checkout, where you have not signed in — under the PECR statistical- purposes exception: the analytics identity lives only in your browser tab’s session storage and is discarded when the tab closes, no analytics cookie is set, replay is off, product custom events are tightly filtered, URL query strings and advertising click identifiers are removed, the part of a web address that names the specific property is replaced with [redacted] before anything is sent, and the activity is not linked to your account. The marketing controls and the anonymous-statistics notice in the product provide a simple way to object; choosing Reject/No thanks or Turn off stops that measurement too. Nothing at all is requested from Google’s advertising tag until you allow advertising cookies, and the same controls withdraw that permission for both trybroc.io and app.trybroc.io — the product app never asks the advertising question itself, it only honours the answer you gave here. It does not stop the server-side counting described in section 2 (the anonymous counts, and the checkout records filed under your account), which uses no cookie and no device storage — that is why it sits outside this section and has its own objection route.

11. Children

The Service is intended for adults (18+) and is not directed at children. We do not knowingly collect personal data from anyone under 18.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the “last updated” date above; where changes are significant we will take reasonable steps to bring them to your attention.