Privacy Policy

1. Who we are

RepairKeeper is operated by DannStarr Electronics Limited, a company registered in England and Wales (company number 12724832), with its registered office at 61 Rotten Row, Pinchbeck, Spalding, PE11 3RQ.

Throughout this policy, "we", "us", and "our" refer to DannStarr Electronics Limited. "You" refers to the individual using RepairKeeper (typically a repair shop owner, manager, or team member).

Our data protection contact is [email protected]. We are registered with the UK Information Commissioner's Office (registration number [ICO_REGISTRATION_NUMBER]).

2. The two roles we play

Because RepairKeeper is a business tool, we handle two different kinds of personal data in two different capacities. This distinction matters for your compliance obligations, so we want to be explicit about it.

Data controller — for data about you (the RepairKeeper user)

When you sign up for RepairKeeper and use the service, we collect and decide how to use personal data about you: your name, email, how you use the product, and so on. For that data we are the data controller, and this policy explains how we handle it.

Data processor — for data about your customers

When you enter your own customers' details into RepairKeeper (customer names, phone numbers, device information, repair records, etc.), you remain the data controller for that information. We process it only on your instructions, under the Data Processing terms of our Terms of Service. You are responsible for having your own lawful basis to collect and store that data, and for providing your customers with your own privacy notice.

3. What personal data we collect

Account and profile data

• Your name and email address
• A secure hash of your password (we never store the password itself)
• Your organisation name and billing contact details
• If you enable two-factor authentication: a hashed TOTP secret, passkey credentials, and hashed recovery codes

Usage data

• Timestamps of login and last activity
• Audit log entries recording actions taken in your workspace (for security and compliance)
• Technical logs including your IP address, browser, and device type (for debugging, rate limiting, and abuse prevention)
• Bot-protection signals collected by Cloudflare Turnstile during signup and login

Billing data (paid plans only)

• Your Stripe customer identifier, subscription status, and plan history
• Billing address
• VAT registration details if you provide them

We do not store your card number, expiry date, or CVV. Those are held by Stripe, our payment processor, who is independently certified to PCI DSS Level 1.

Communications

• Emails you send us (support enquiries, feedback)
• Feedback items you submit through the in-app feedback tool

4. How we use your data, and our legal basis

We rely on the following legal bases under Article 6 of the UK GDPR:

Performance of contract (Art 6(1)(b))

• Creating and maintaining your account
• Providing the RepairKeeper service you subscribed to
• Processing payments for paid plans
• Sending transactional emails (verification, password reset, invoices, product notifications)
• Providing customer support

Legitimate interests (Art 6(1)(f))

• Securing the service — rate limiting, bot protection, fraud prevention
• Keeping audit logs for accountability
• Understanding product usage to improve RepairKeeper (aggregated, not targeted)
• Monitoring service health and investigating incidents

Where we rely on legitimate interests, we've considered the impact on you and are satisfied the processing is proportionate. You have the right to object — see Section 8.

Legal obligation (Art 6(1)(c))

• Retaining billing records for UK tax compliance (HMRC requires 7 years)
• Responding to lawful requests from regulators or law enforcement

Consent (Art 6(1)(a))

We don't currently run marketing campaigns or use tracking analytics. If that changes, we will ask for your explicit consent first, and you will be able to withdraw it at any time.

5. Who we share your data with (sub-processors)

We use carefully-chosen third parties to operate RepairKeeper. We have data processing agreements with each, and they process your data only on our instructions.

• Vercel Inc. (United States) — application hosting and content delivery
• Neon Inc. (United States) — managed PostgreSQL database
• Cloudflare, Inc. (United States) — DNS, Turnstile bot protection, R2 file storage, network security
• Resend Inc. (United States) — transactional email delivery
• Stripe Payments UK, Ltd. (United Kingdom) — payment processing for paid plans (acts as an independent controller for payment card data)

Except for Stripe (which acts as an independent controller for payment details under PCI DSS rules), all of the above act as data processors on our behalf.

We will update this list as it changes and notify active users of material changes. We do not sell your personal data under any circumstances.

6. International transfers

Several of our sub-processors are based outside the UK, primarily in the United States. Where your data is transferred outside the UK, we rely on one or more of the following safeguards:

• UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses
• The UK's adequacy regulations where they apply
• Supplementary measures (such as encryption in transit and at rest) where appropriate

7. How long we keep your data

Account and usage data

We keep your account and usage data for as long as your account is active, plus a short period after closure to finalise any outstanding matters.

Inactivity policy for Free accounts: to keep the service tidy and minimise data we don't need, Free-plan accounts that have had no ticket activity for a sustained period will receive warning emails and eventually be suspended and deleted:

• Day 90 — we send a first warning email
• Day 120 — we send a final warning email
• Day 150 — we suspend the account (you can reactivate with a single click)
• Day 210 — we schedule your data for permanent deletion
• Day 240 — your data is permanently deleted

Any ticket activity (creating or updating a ticket) resets the clock. Paid accounts are not subject to this policy while your subscription is active.

Customer data you enter into RepairKeeper (processor role)

We retain this data for as long as you keep it in RepairKeeper. When you delete records, we remove them from active systems immediately. Database backups may retain deleted data for up to 30 days before full rotation. When your organisation is deleted, all associated customer data is deleted with it under the timeline above.

Billing data

Retained for seven years from the date of the final transaction, as required by HMRC for VAT and income-tax records.

Security and audit logs

Retained for up to 12 months from creation, then automatically pruned.

8. Your rights under UK GDPR

You have the following rights in respect of your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — ask us to delete your data ("right to be forgotten"), subject to our legal retention requirements
• Right to restrict processing — ask us to limit how we use your data in certain circumstances
• Right to data portability — receive your data in a structured, commonly-used, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent
• Right not to be subject to automated decision-making — we do not make automated decisions with legal or similarly significant effects about you

To exercise any of these rights, email [email protected]. We will respond within one month as required by Article 12(3). We may ask for information to verify your identity before acting on a request.

If your request concerns customer data you have entered into RepairKeeper (where we act as processor), we will forward the request to the relevant shop that controls that data.

9. Security

We take the security of your data seriously. Measures in place include:

• All traffic to RepairKeeper is encrypted with TLS 1.2+
• Passwords are hashed with bcrypt before storage
• Two-factor authentication is available (TOTP and passkeys) and we recommend enabling it
• Database and file storage are encrypted at rest by our sub-processors
• Access to production systems is restricted to authorised personnel under role-based controls
• Regular automated backups with point-in-time recovery
• Rate limiting, bot protection (Cloudflare Turnstile), and abuse monitoring on public-facing endpoints
• Audit logging of administrative actions

No system is completely impenetrable. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours as required by Article 33, and notify affected users without undue delay.

10. Cookies and tracking

RepairKeeper uses only essential cookies required to operate the service: session authentication and CSRF protection. We do not use third-party advertising, tracking, or analytics cookies on the application.

Our marketing site (repairkeeper.co.uk) may use minimal first-party analytics in future. If that changes, we will update this policy and provide cookie controls.

11. Children's data

RepairKeeper is a B2B tool for repair businesses and is not intended for use by anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us and we will delete it promptly.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of the page will reflect the most recent change. For material changes affecting how we use your data, we will notify active users by email at least 30 days before the change takes effect.

13. Contact us and your right to complain

If you have any questions about this policy, want to exercise your rights, or believe we have mishandled your data, please contact us first:

Email: [email protected]
Post: DannStarr Electronics Limited, 61 Rotten Row, Pinchbeck, Spalding, PE11 3RQ

You also have the right to lodge a complaint with the UK Information Commissioner's Office:

Website: ico.org.uk/make-a-complaint
Phone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the chance to address your concerns before you approach the ICO, so please do contact us first if you can.