Privacy
Privacy policy
Last updated 18 August 2026
The short version: we collect as little as possible, store it securely in the UK or European Economic Area (currently hosted in the EU), use it only for what you gave it to us for, and delete it when you ask. No cookies, no trackers, no ads, and we never sell your data.
Who we are
LeakScan ("we", "us") is operated by LeakScan Ltd, a company registered in England and Wales (company number 17363486, registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ), which is the data controller for this website at leakscan.uk. For anything in this policy, or any question about your data, contact us at privacy@leakscan.uk. We aim to reply within a few days, and always within one month as UK GDPR requires.
What we collect, and why
Right now this website does one thing with personal data: the early-access waitlist. If you join it, we collect:
| Data | Why we collect it | Legal basis (UK GDPR) |
|---|---|---|
| Your email address | To contact you about LeakScan early access and launch | Consent — you gave it to us for this (Art. 6(1)(a)) |
| Your role (homeowner or plumber) | So we send you the right kind of updates | Consent (Art. 6(1)(a)) |
| Your answers to the three sign-up questions | In aggregate, to shape the product and pricing before launch | Legitimate interest — building a product people actually want (Art. 6(1)(f)) |
That's the whole list. This site has no user accounts, no payments, no cookies, no analytics scripts and no third-party trackers. We don't collect your name, address or anything else.
Where your data lives
Waitlist entries are stored in our database hosted by Supabase on servers located in the European Economic Area (Ireland). UK GDPR permits this — the EEA is covered by the UK's adequacy regulations, so your rights are unchanged. Access to that database is restricted and protected — the website itself has no ability to read it back out.
Three service providers help us run things, and each sees only what it technically must: Cloudflare serves this website (like any web host, it briefly processes your IP address to deliver pages securely and defend against attacks), Proton (Proton AG, Switzerland) hosts our email, so anything you email us is stored in Proton's end-to-end-encrypted mailboxes, and Supabase hosts the database described above. None of them is permitted to use your data for their own purposes.
How long we keep it
We keep waitlist entries until LeakScan has launched and the early-access programme is finished, at which point the list is deleted or (with your fresh consent) moved to a normal product-updates list. If you ask to be removed at any point, we delete your entry — usually within days, at most within one month. We review anything still held after 24 months and delete what's no longer needed.
Your rights
Under UK GDPR you can, at any time and for free:
- Ask what we hold about you (right of access) — we'll send you a copy;
- Correct it if it's wrong;
- Have it deleted ("right to be forgotten") — for the waitlist, this simply means we remove your row and stop emailing you;
- Withdraw consent — same effect as deletion for a waitlist;
- Object to, or ask us to restrict, any processing;
- Take your data with you (portability).
To use any of these, email privacy@leakscan.uk from the address you signed up with — that's all the proof we need for waitlist data.
If you're unhappy with how we've handled your data, you have the right to complain to the UK's regulator, the Information Commissioner's Office — ico.org.uk or 0303 123 1113. We'd appreciate the chance to sort it out first, but you don't have to give us one.
The LeakScan app
The LeakScan app is live on iOS and Android. This section covers what we collect there, in addition to the website waitlist data described above.
What we collect in the app
- Account details (email, name, tenure, role) — to run your account and the service you signed up for. Legal basis: contract — necessary to provide the app (UK GDPR Art. 6(1)(b)).
- Photos you submit for diagnosis — to analyse your plumbing problem. Legal basis: consent (Art. 6(1)(a)) — see below.
- The AI diagnosis generated from a photo — to show you the result and, if you choose, keep a record. Legal basis: consent (Art. 6(1)(a)).
- Basic app usage events (e.g. screens opened, actions taken) — to keep the app working, find bugs, and improve it. Legal basis: legitimate interest — running and maintaining the service (Art. 6(1)(f)).
- Property, tenancy and case data (landlord/tenant features — see below) — to let landlords and tenants share plumbing reports. Legal basis: consent (Art. 6(1)(a)).
Photos you submit are used to analyse your plumbing problem and nothing else — never sold, never handed to advertisers, and never used to train our AI without your separate consent.
If you're linked to a landlord or tenant
LeakScan has an optional landlord feature. If you're a tenant and you link your account to a landlord (by accepting an invite, or by a landlord claiming a report you sent them), and you then choose to send a plumbing report to that landlord:
- Your diagnosis results (the AI's findings — what the problem likely is, the confidence level, and the reasoning — along with the date of the scan) are stored in your LeakScan account so your history is available across devices and survives reinstalls. Your photos are NOT stored by us — they are sent to our AI analysis provider and immediately discarded after the result is generated. When you send a report to a linked landlord, we also store the photo, any note you add, and the timestamps of that report, so your landlord can see and act on it.
- Your landlord can also see your display name, the email address you were invited with, your tenancy status and dates, and — only if you switch on sharing in the app (off by default) — your phone number. They cannot see anything else: not your other scans, not your tenure answers, not any profile field beyond this list.
- Your landlord is a separate data controller for how they use this information — once it's shared with them, what they do with it (for example, keeping their own records to manage the property) is their responsibility under data protection law, not ours. We're the controller for running the app itself: storing the data securely, keeping it accurate, and applying the retention below.
- If you delete your LeakScan account, reports you've already sent to a landlord are not deleted from their view. Your landlord keeps the case record (photo, diagnosis, note, dates) until they remove it or the property is deleted. Everything else tied to your account is deleted or, where a shared record depends on it, irreversibly anonymised — either way it is no longer linked to you.
- If a landlord invites you and you don't submit any reports, we hold only your name, invited email and tenancy status for as long as the tenancy record exists, so the roster stays accurate.
How long we keep app data
- App usage events: no longer than 90 days, then deleted.
- Diagnosis results stored in your account: Retained until you delete individual results, or until your account is deleted, at which point all results are permanently deleted from our servers within 30 days.
- Case reports sent to a linked landlord: see "If you're linked to a landlord or tenant" above.
When you delete your account, all diagnosis results stored in your account are permanently deleted from our servers within 30 days.
Who else sees app data
Supabase hosts the app database and file storage, in the same EEA (Ireland) location as the waitlist, alongside the Cloudflare and Proton services described above.
Google LLC provides the AI analysis service (Gemini API) that processes photos you submit for diagnosis. Your photo is transmitted to Google's servers to generate the diagnosis result and is not retained by Google under the standard API terms. Google is our data processor for this step and is not permitted to use your photos for its own purposes. Google's data-centre locations include the United States; this transfer is covered by standard contractual clauses providing equivalent protection to UK GDPR.
Your rights (access, correction, deletion, objection, portability, and the right to complain to the ICO) apply to app data exactly as described above for the waitlist. Email privacy@leakscan.uk.
Children
This site and the waitlist are not aimed at children under 13, and we don't knowingly collect their data. If you believe a child has joined the waitlist, email privacy@leakscan.uk and we'll delete the entry.
Changes to this policy
If we change how we handle your data, we'll update this page and the date at the top. If a change materially affects waitlist members, we'll email you about it before it takes effect.