Privacy Policy
This Privacy Policy explains how StoveApp collects, uses and protects personal information through the StoveApp website, application and related services.
1. Who we are
StoveApp is operated by Cain Peacock, trading as StoveApp (“StoveApp”, “we”, “us” or “our”).
Business address: King Street, Pembroke Dock, SA72 6JT
Privacy email: cain@stoveapp.co.uk
For personal information relating to StoveApp accounts, enquiries, subscriptions and marketing, StoveApp is the data controller.
When a stove installation business uses StoveApp to store information about its own customers, that installation business is normally the data controller and StoveApp acts as its data processor.
2. Who this policy applies to
This policy applies to:
- Visitors to the StoveApp website.
- People who join our mailing list or founding-installer list.
- Businesses that subscribe to or trial StoveApp.
- Owners, administrators, office workers and installers who are given access to a StoveApp account.
- People who contact us for support or information.
- Homeowners and other customers whose information is entered into StoveApp by an installation business.
When your information has been entered by an installation business, you should also read that business's own privacy notice. The installation business decides why your information is used and how long it should be kept. StoveApp processes it on that business's instructions.
3. Information we collect
Website visitors and prospective customers. We may collect:
- Your name and contact details.
- Your business name and role.
- Information you submit through an enquiry, demonstration or waiting-list form.
- Your communication and marketing preferences.
- Correspondence you send to us.
StoveApp account holders and team members. We may collect:
- Your name, email address and telephone number.
- Your business or trading name.
- Your business address.
- Your company number and VAT number, where applicable.
- Your role and permissions within the account.
- Authentication and account-security information.
- Subscription, billing and transaction records.
- Support enquiries and correspondence.
- Information about how and when the account is accessed.
Where business bank details are added so that they can appear on invoices, we process the account name, sort code and account number provided by the account administrator.
Payment-card information is handled by our payment provider and is not stored directly by StoveApp. We may receive limited information about a payment, such as its status, amount, date and transaction reference.
Information processed for installation businesses. An installation business may use StoveApp to store:
- Customer names, addresses, email addresses and telephone numbers.
- Property addresses and map or location information.
- Enquiries, appointments and job information.
- Survey answers, measurements and site notes.
- Photographs and documents.
- Stove, fireplace and installation preferences.
- Parts lists, estimates, quotations and invoices.
- Payment amounts, statuses and references.
- Installation and commissioning records.
- Customer approvals, acceptances and signatures.
- Service and maintenance reminders.
- Any other information entered into free-text fields by an authorised user.
Installation businesses should not use free-text fields to record unnecessary sensitive information.
Technical and security information. We may collect:
- IP addresses.
- Device, browser and operating-system information.
- Login records.
- Security and audit logs.
- Error reports and diagnostic information.
- Records of important account or permission changes.
4. How we use personal information
We use information to:
- Create and administer StoveApp accounts.
- Provide the application and its features.
- Authenticate users and apply account permissions.
- Process subscriptions and payments.
- Provide customer service and technical support.
- Send operational messages about an account or the service.
- Protect StoveApp, its users and customer information.
- Detect or investigate misuse, security incidents and technical problems.
- Maintain records required for accounting, tax and legal purposes.
- Improve the reliability and usability of the service.
- Respond to enquiries and demonstration requests.
- Send product news and launch information where a person has requested it.
- Process installation-business customer data on the documented instructions of that business.
We do not sell personal information.
5. Our lawful bases
Depending on the circumstances, we rely on the following lawful bases:
Contract. We process information when it is necessary to provide a trial, subscription or other service requested from us. This includes administering accounts, providing features, processing subscriptions and supplying support.
Legal obligation. We may keep or use information when required to comply with tax, accounting, regulatory or other legal obligations.
Legitimate interests. We may process information where it is necessary for our legitimate business interests, provided those interests are not overridden by a person's rights. These interests include:
- Protecting accounts and customer information.
- Preventing fraud and misuse.
- Maintaining security and audit records.
- Diagnosing technical problems.
- Managing customer relationships and support.
- Improving the performance and reliability of StoveApp.
- Establishing, exercising or defending legal claims.
Consent. We rely on consent when somebody voluntarily joins a marketing or launch mailing list. Consent can be withdrawn at any time by unsubscribing or contacting us.
Processing on behalf of installation businesses. For information controlled by an installation business, we process the information under our contract with that business and on its documented instructions.
6. Role-based access
Each subscribing business has its own StoveApp workspace.
Account administrators control which team members can access the workspace and which permissions they receive. Different roles may be permitted to access different features and information.
For example, an installer may be limited to customers and jobs allocated to them, while an office user may be able to manage enquiries and scheduling without being permitted to complete field surveys. Administrators may have wider access to users, customers, financial information and account settings.
Businesses using StoveApp are responsible for assigning suitable access permissions and removing access when a person no longer requires it.
7. Suppliers and other recipients
We use service providers to operate StoveApp. Subject to confirmation before publication, these may include:
- Render for application hosting.
- MongoDB Atlas for database services.
- Cloudflare R2 for storing photographs, documents and generated files.
- Resend for transactional emails.
- Mailchimp for founding-installer and marketing emails.
- postcodes.io and/or APITier for postcode, address or location lookups.
- Google Maps when a user chooses to open an address for navigation.
- Stripe for subscription payments.
These providers may process only the information reasonably required to deliver their services to us.
We may also disclose information:
- To professional advisers such as accountants, insurers, solicitors and security consultants.
- During a sale, restructuring or transfer of all or part of the business.
- When required by law, a court, regulator or law-enforcement authority.
- When reasonably necessary to protect StoveApp, our users or another person.
Where an installation business activates an integration with an external accounting or business platform, information will be shared with that platform at the business's request. The external platform's own privacy terms will also apply.
8. International transfers
Some service providers may access or process information outside the United Kingdom.
Where personal information is transferred internationally, we use an applicable legal mechanism. This may include:
- A UK adequacy regulation.
- The UK International Data Transfer Agreement.
- The UK Addendum to approved EU Standard Contractual Clauses.
- Another safeguard permitted by UK data-protection law.
Where required, we also assess the risks associated with the transfer.
You may contact cain@stoveapp.co.uk for further information about the safeguards used for a particular provider.
9. How long we keep information
We keep information only for as long as reasonably necessary for the purpose for which it was collected.
Generally:
- Mailing-list information is kept until you unsubscribe, withdraw consent or the mailing list is discontinued.
- Account and team-member information is kept while the account is active and for a reasonable period afterwards to manage closure, support, disputes and legal obligations.
- Financial and transaction records may generally be retained for up to six years where required for tax, accounting or legal purposes.
- Security and audit information is kept for a period proportionate to the security and investigation purpose.
- Support correspondence is kept for as long as reasonably needed to resolve the matter and maintain an appropriate business record.
- Information controlled by an installation business is kept according to that business's instructions and retention responsibilities.
- Following account closure, customer information will be deleted or returned in accordance with our agreement with the installation business, except where continued retention is legally required.
- Residual copies may remain temporarily in protected backups until those backups are overwritten through the normal backup cycle.
Account administrators may be able to export or delete customer information using tools provided within StoveApp.
10. Security
We use appropriate technical and organisational measures intended to protect personal information.
Depending on the feature and account configuration, these measures may include:
- Encrypted HTTPS connections.
- Authentication controls.
- Secure password handling.
- Optional multi-factor authentication.
- Role-based permissions.
- Separation of data belonging to different business workspaces.
- Access-controlled file storage.
- Security and audit logging.
- Restricted administrative access.
- Backups and service-recovery procedures.
No online service can guarantee complete security. Users must keep login details confidential, use appropriate passwords and notify us promptly if they believe an account has been compromised.
11. Your data-protection rights
Depending on the circumstances, you may have the right to:
- Ask for access to your personal information.
- Ask for inaccurate information to be corrected.
- Ask for information to be deleted.
- Ask us to restrict how information is used.
- Object to certain processing.
- Receive information in a portable format.
- Withdraw consent where processing is based on consent.
- Complain to the Information Commissioner's Office.
These rights are not absolute and may depend on the lawful basis and circumstances of the processing.
To exercise a right relating to information StoveApp controls, email cain@stoveapp.co.uk.
When you are a homeowner or customer of an installation business, you should normally contact that installation business first. We will assist the installation business in responding where required.
You can complain to the Information Commissioner's Office through its website at ico.org.uk. We would appreciate the opportunity to address your concern before you contact the ICO.
12. Automated features and calculations
StoveApp may automate calculations, recommendations, workflow movements, reminders, parts lists and other administrative actions.
These features are intended to assist installation businesses. They do not replace professional judgement, and authorised users remain responsible for checking calculations, quotations, records and installation requirements.
StoveApp does not use personal information to make solely automated decisions that produce legal or similarly significant effects on individuals.
13. Cookies and similar technologies
StoveApp uses essential technologies needed to provide account access, maintain sessions and protect the service.
On our public website we use privacy-friendly, cookieless analytics (Cloudflare Web Analytics) to understand overall traffic — for example the number of visits, which pages are viewed, and which websites and countries visitors come from. This tool does not use cookies, does not store or access information on your device, and does not track individuals or follow them across other websites. Because it collects only aggregated information and stores nothing on your device, it does not require a cookie-consent banner.
We do not use advertising cookies or cross-site tracking on the public website.
If we introduce any technology that stores or accesses information on your device, or that tracks individuals, we will update this policy and request consent where required.
14. Children
StoveApp is a business service and is not intended for use by children.
Installation businesses should not knowingly enter information about children unless it is genuinely necessary and lawful for the installation work being undertaken.
15. Changes to this policy
We may update this policy to reflect changes to StoveApp, our suppliers or applicable law.
The latest version will be published on our website with its updated date. We will provide additional notice where a material change requires it.
16. Contact us
For questions, requests or concerns concerning personal information, contact:
Cain Peacock, trading as StoveApp
Address: King Street, Pembroke Dock, SA72 6JT
Email: cain@stoveapp.co.uk