Privacy Policy
Last updated 13 June 2026
This policy explains how Broc Ltd collects, uses and protects your personal data when you use our website trybroc.io and our product at app.trybroc.io (together, the “Service”). We are committed to handling your data lawfully, fairly and transparently under the UK GDPR and the Data Protection Act 2018.
1. Who we are
The data controller is Broc Ltd (company number [COMPANY NUMBER]), a company incorporated in England and Wales, with its registered office at [REGISTERED OFFICE ADDRESS], London, United Kingdom. You can contact us about privacy at support@trybroc.io.
2. The personal data we collect
Information you give us
- Account details — your email address (and authentication tokens) when you sign in. Sign-in is handled through our authentication provider, Supabase.
- Property and buyer inputs — the property addresses you search for and details you enter about your buying position to generate your analysis.
- Communications — the content of any messages you send us (e.g. support emails).
Payment information
When you buy a report, your payment is processed by Stripe. We do not receive or store your full card number; Stripe handles your card data as an independent controller/ processor under its own terms and privacy policy. We receive limited transaction details (such as the fact and amount of payment and a payment reference) to fulfil your order and meet our accounting obligations.
Information collected automatically
- Analytics and session replay — we use PostHog (hosted in the EU) for product analytics and session replay (masked recordings of page interactions that mask form inputs and on-screen text), and may use privacy-friendly, cookie-less web analytics. On our website this runs only with your consent; in the signed-in product it runs for logged-in users as part of your account. See our Cookie Policy for details and how to change your choice.
- Technical and log data — such as IP address, device and browser type, and pages viewed, generated when you use the Service and necessary to operate and secure it.
Property and market data
To produce your analysis, we obtain property, address and area data from public registers and licensed third-party data providers. This data relates to properties and areas rather than to you personally, but may be combined with the address you search.
3. How and why we use your data (legal bases)
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Create and manage your account; provide your analysis and report; take payment | Performance of a contract with you |
| Operate, secure, debug and improve the Service; prevent fraud and misuse | Our legitimate interests in running a safe, reliable service |
| Analytics cookies and any marketing communications | Your consent (which you can withdraw at any time) |
| Keep accounting, tax and other legally required records | Compliance with a legal obligation |
4. Who we share your data with
We do not sell your personal data. We share it only with service providers who process it on our behalf under contract, and where the law requires. These include:
- Stripe — payment processing.
- Supabase — authentication, database and hosting.
- Vercel — website hosting and privacy-friendly web analytics.
- PostHog (EU Cloud) — product analytics and session replay.
- Email and support providers — to communicate with you.
- Licensed property-data providers — as data sources for your analysis.
- Professional advisers and authorities — e.g. our accountants or lawyers, or regulators and law-enforcement where we are legally required to disclose.
5. International transfers
Some of our providers process data outside the UK. Where they do, we rely on an appropriate safeguard recognised under UK data-protection law — such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses — so your data receives an equivalent level of protection. Our product-analytics and session-replay provider, PostHog, hosts our data on EU infrastructure.
6. How long we keep your data
We keep your personal data only for as long as necessary for the purposes above. Account and analysis data is retained while your account is active and for a reasonable period afterwards; transaction and accounting records are kept for the period required by law (generally six years). When data is no longer needed, we delete or anonymise it.
7. How we protect your data
We use appropriate technical and organisational measures — including encryption in transit, access controls and reputable infrastructure providers — to protect your data against unauthorised access, loss or misuse. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the regulator of any breach where required.
8. Your rights
Under UK data-protection law you have the right to:
- access a copy of your personal data;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict or object to certain processing;
- data portability;
- withdraw consent at any time (without affecting prior processing).
To exercise any of these, email support@trybroc.io. We will respond within the statutory timeframe. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to resolve your concern first.
9. Cookies
We use cookies and similar technologies as described in our Cookie Policy. Non-essential analytics cookies are only set with your consent.
10. Children
The Service is intended for adults (18+) and is not directed at children. We do not knowingly collect personal data from anyone under 18.
11. Changes to this policy
We may update this policy from time to time. We will post the updated version here and revise the “last updated” date above; where changes are significant we will take reasonable steps to bring them to your attention.