Privacy Policy
Last updated: 8 March 2026
1. Who We Are
Footprint is operated by Graham Hemingway. We are the data controller for the purposes of UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact: hello@getfootprint.co.uk
2. What Data We Collect
Account data
Name, email address, and authentication credentials managed by Clerk. We do not store your password.
Payment data
Processed by Stripe. We store your Stripe customer ID, subscription ID, and billing status only. We never store or have access to your card details.
Usage data
Business descriptions, projects, search criteria, shortlisted areas, notes, areas viewed, and competitor searches you make within the service.
Lead data
If you provide your email during the demo flow, we collect your email address, business description, and search criteria.
Technical data
IP address, browser type, pages visited, device type, referring URL, and session duration. Collected via Google Analytics and Vercel Analytics.
Error tracking data
Technical error information and IP address, collected via Sentry.
Email engagement data
Email opens, clicks, and interaction data, collected via Klaviyo.
3. How We Use Your Data
To provide the service (contract)
Processing business descriptions via the Anthropic API, generating recommendations, fetching competitor data via Google Places, storing projects and results, and processing payments.
To communicate (contract and legitimate interest)
Transactional emails, trial notifications, and support communications.
To send marketing communications (consent)
If you provide your email during the demo flow or sign up for updates, we may send a limited email sequence about the service via Klaviyo. You can unsubscribe at any time via the unsubscribe link in each email.
To improve the service (legitimate interest)
Analysing usage patterns, error monitoring, and understanding common search patterns.
4. How We Share Your Data
| Provider | Purpose | Data shared |
|---|---|---|
| Clerk | Authentication | Name and email |
| Stripe | Payments | Email and payment details |
| Anthropic | AI analysis | Business descriptions (no personal identifiers) |
| Google Places | Competitor search | Location coordinates and search terms (no personal identifiers) |
| Google Analytics | Website analytics | IP address, browser data, pages visited, session behaviour |
| Vercel | Frontend hosting and analytics | IP address, browser data, pages visited |
| Sentry | Error tracking | Technical error data, IP address |
| Railway | Backend hosting and database | All service data |
| Klaviyo | Email marketing | Name, email, business type searched, email engagement data |
We do not sell personal data or share it for third-party marketing purposes.
5. Where Data Is Stored
Our backend and database are hosted on Railway. Our frontend is hosted on Vercel. Google Analytics data is processed by Google. Klaviyo data is processed by Klaviyo, Inc. (US-based). Data may be stored outside the UK. Where data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR, including standard contractual clauses.
6. How Long We Keep Data
| Data type | Retention period |
|---|---|
| Account data | Until account deletion |
| Project and search data | Until account deletion or individual project deletion |
| Payment data | Until account deletion plus any legally required retention |
| Lead data | 12 months or until deletion requested |
| Google Analytics data | 14 months (Google’s default retention) |
| Vercel Analytics data | 12 months |
| Klaviyo data | Until user unsubscribes and requests deletion, or 12 months after last engagement |
| Error logs (Sentry) | 90 days |
On account deletion, all personal data is deleted within 30 days except where we are legally required to retain it. This includes requesting deletion from third-party services including Klaviyo.
7. Cookies and Similar Technologies
We use cookies, pixels, and similar tracking technologies on our website. A cookie is a small text file placed on your device by a website. Similar technologies include tracking pixels, local storage, and scripts that collect information about your browsing activity.
Categories of cookies we use
Strictly necessary cookies
These cookies are essential for the website to function and cannot be switched off. They include cookies that maintain your authenticated session, remember your cookie consent preferences, and enable core platform functionality. Because these cookies are necessary to provide the service, they do not require your consent under the Privacy and Electronic Communications Regulations 2003 (PECR).
Analytics and performance cookies
These cookies help us understand how visitors interact with our website by collecting information about pages visited, time spent on the site, and any errors encountered. We use this data to improve how our website works. These cookies may be set by us or by third-party analytics providers acting on our behalf. They do not directly identify you but may collect your IP address, browser type, and browsing behaviour.
Marketing and advertising cookies
These cookies and tracking pixels are used to deliver relevant advertisements and measure the effectiveness of our advertising campaigns. They may be set by us or by third-party advertising platforms. These technologies may track your browsing activity across different websites and build a profile of your interests. We do not sell your personal data to advertisers.
Third-party providers
Some cookies are placed by third-party services that appear on our pages. We do not control how these third parties use their cookies. These providers include, but are not limited to, authentication services, payment processors, analytics platforms, email marketing services, error monitoring tools, and advertising networks. Each provider operates under its own privacy policy and cookie practices.
Your choices
A cookie consent banner is shown on your first visit. You can accept all cookies or choose essential only. You can change your preferences at any time via the “Cookie Settings” link in the site footer. You can also control cookies through your browser settings, although disabling certain cookies may affect site functionality.
In accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR, we obtain your consent before setting any non-essential cookies. Consent is recorded and can be withdrawn at any time.
8. Your Rights under UK GDPR
- Access: Request a copy of all data we hold about you. We will respond within 30 days. Contact hello@getfootprint.co.uk.
- Rectification: Update your information via account settings or contact us.
- Erasure: Delete your account via settings or email us. Processed within 30 days, including deletion from third-party services including Klaviyo.
- Portability: Request your data in a machine-readable format.
- Object: You can object to processing based on legitimate interest.
- Restrict processing: You can request restriction in certain circumstances.
- Withdraw consent: Unsubscribe from marketing emails via the link in any email. Change cookie preferences via the footer link.
- Complain: You have the right to complain to the Information Commissioner’s Office at ico.org.uk.
9. Data Security
We protect your data using HTTPS encryption, Clerk authentication, Stripe PCI compliance, restricted database access, rate limiting, webhook verification, and regular security reviews. However, we cannot guarantee absolute security. In the event of a data breach, we will notify affected users and the ICO in accordance with UK GDPR requirements.
10. Children
Footprint is not intended for use by anyone under the age of 18. We do not knowingly collect data from children. If we discover that we have collected data from someone under 18, we will delete it.
11. Changes to This Policy
We will notify you of any material changes to this policy via email or in-app notification.
12. Contact
If you have any questions about this privacy policy, contact us at hello@getfootprint.co.uk.
Data Sources and Attribution
Footprint uses data from the following sources:
- Demographic data: Office for National Statistics, licensed under the Open Government Licence v3.0
- Crime data: data.police.uk, licensed under the Open Government Licence v3.0
- Station usage data: Office of Rail and Road, licensed under the Open Government Licence v3.0
- Business counts: ONS via NOMIS, licensed under the Open Government Licence v3.0
- Competitor data: Google Places API