Privacy Policy

Last updated: 22 July 2026

This policy explains what personal data GASpilot holds, why we hold it, who we share it with and what you can do about it. It covers both engineers who use GASpilot and the customer records engineers store in it — two different relationships, explained in section 2. Plain English throughout; if anything is unclear, email queries@gaspilot.uk and we'll explain it.

1.Who we are

GASpilot is operated by Gaspilot Ltd, a company registered in England and Wales (company number 17321641), registered office 146 Yardley Fields Road, Birmingham, England, B33 8QU. In this policy "we", "us" and "GASpilot" mean that company.

For data protection questions, contact us at queries@gaspilot.uk. We are not required to appoint a Data Protection Officer and have not appointed one; queries go to the same address and are handled by us directly.

2.Two roles: your data and your customers' data

This distinction matters, so it comes early.

• Your account data — we are the controller. Your name, email, business details, Gas Safe registration and billing information are ours to look after, and this policy governs how we do it.
• Your customers' data — you are the controller and we are your processor. The names, addresses, phone numbers, appliance records and certificates you enter belong to your business. We store and process them on your instructions, to provide the app. We do not sell them, mine them, or use them for our own purposes.

That second role carries an obligation for you as well as us: you are responsible for having a lawful basis to hold your customers' details, and for telling your customers how you use them. Article 28 of the UK GDPR requires a written processing agreement between us — the processing terms in section 7 of our Terms of Service serve as that agreement.

3.What we collect

From you, the engineer

• Account details — name, email address, password (stored hashed, never in readable form), business name, business address, phone number and business logo if you upload one.
• Professional credentials — your Gas Safe registration number, card expiry date and a photo of your Gas Safe ID card. See section 5.
• Your signature — the signature image you save to apply to certificates.
• Billing data — your plan, subscription status and renewal dates. Card numbers never reach our servers; they go directly to Stripe, who are PCI-DSS compliant. We receive only a payment reference, the last four digits and the outcome.
• Support correspondence — emails you send us and our replies.

Entered by you, about your customers

• Customer and landlord names, addresses, email addresses and phone numbers.
• Property and appliance details, meter readings, test results and safety classifications.
• Certificates, quotes, invoices, payment status and job history.
• Customer signatures captured on site.
• Diary entries, service reminders and notes you add.

Collected automatically

• Technical data — IP address, browser type and timestamps, recorded in standard server logs by our hosting provider for security and troubleshooting.
• Usage counters — for example the number of Breakdown AI diagnoses you run each day, used to apply fair-use limits.

We do not use Google Analytics, advertising pixels, or any third-party tracking or profiling tools on the GASpilot website or in the app. We do not build advertising profiles and we do not sell data to anyone.

4.Why we use it, and our lawful basis

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and concluded it is not. You can object to that processing — see section 11.

5.Your Gas Safe ID card

6.Breakdown AI

Breakdown AI sends the text of your diagnosis conversation — appliance make, model, GC number, fault code, symptoms and readings — to Anthropic PBC, who provide the underlying AI model. It is worth being precise about what this does and does not involve:

• Only the messages in that conversation are sent. Your customer records are not attached, and no customer name, address or contact detail is included unless you type one into the chat yourself.
• Your email address, account details and authentication token stay on our servers and are not passed to Anthropic.
• Anthropic processes the request under their commercial terms and does not use it to train their models.

Please don't type customer names or addresses into Breakdown AI — it doesn't need them to diagnose a fault, and leaving them out keeps your customers' data out of a US-based service entirely. Breakdown AI is an aid to diagnosis, not a substitute for your judgement or the manufacturer's instructions; see section 5 of the Terms of Service.

7.Who we share data with

We share personal data only with the suppliers below, only to the extent needed to run the service, and each is bound by contract to protect it. We do not sell personal data, and we do not share it for anyone else's marketing.

We may also disclose data where the law requires it — a court order, a regulator, or a legal obligation — or to establish or defend legal claims. If GASpilot is ever sold or merged, data may transfer to the buyer, who would be bound by this policy; we'd tell you before that happened.

8.Where your data is stored

Your GASpilot data is stored on servers in the UK or European Economic Area. Two of our suppliers process data outside that area:

• Anthropic (United States) — Breakdown AI conversations only.
• ClickSend (Australia) — mobile number and message text for SMS you send.

Neither country benefits from a full UK adequacy decision, so these transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the supplier's own technical safeguards. If you'd rather your data never left the UK/EEA, you can simply not use Breakdown AI and send messages by email rather than SMS — the rest of the app is unaffected.

9.How long we keep it

• While your account is open — we keep your data so the app works. Gas safety records need to be available for years; that's the point of the app.
• Gas Safe ID card photo — deleted as soon as verification is complete.
• After you cancel — your data stays available for 90 days so you can export it or change your mind. After that we delete it. Export your records before the 90 days are up; ask us and we'll help.
• Billing and accounting records — six years from the end of the relevant financial year, as UK tax law requires. This is a legal obligation and applies even if you ask us to delete everything else.
• Server logs — a short rolling period set by our host, typically weeks rather than months.

10.Security

• All traffic is encrypted in transit with HTTPS.
• Passwords are stored as salted hashes. Nobody at GASpilot can read your password.
• Access to the production database is restricted to those who need it to run the service.
• Card details are handled entirely by Stripe and never touch our servers.
• GASpilot works offline, which means a copy of your data is held on your device. Lock your phone with a PIN or biometric, and tell us promptly if it's lost or stolen so we can revoke the session.

No system is perfectly secure. If a breach ever occurs that is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours and tell you without undue delay.

11.Your rights

Under UK GDPR you have the right to access your data, have it corrected or erased, restrict or object to how we use it, receive it in a portable format, and withdraw consent where we rely on it. You will never be charged or penalised for exercising any of these.

Email queries@gaspilot.uk and we'll respond within one month.

If you think we've handled your data badly, please tell us first — we'd rather fix it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Gaspilot Ltd is registered with the Information Commissioner's Office under registration number C1992275.

12.Cookies and on-device storage

GASpilot does not use advertising or tracking cookies, and there is no cookie banner because there is nothing to consent to. What we do use:

• Local storage on your device — holds your records so the app works with no signal. This is what makes GASpilot offline-first. It stays on your device until you sign out or clear it.
• A session token — keeps you signed in. Strictly necessary, and exempt from consent requirements under the Privacy and Electronic Communications Regulations.
• A service worker — caches the app itself so it loads instantly and runs offline.

13.Changes to this policy

If we change this policy we'll update the date at the top. For anything that materially affects your rights — a new supplier receiving your data, a new purpose — we'll email you before it takes effect.