Privacy policy

Who we are

Smiles Consulting, trading as Sandbox by Sable, is the data controller for the personal data described here. Our ICO registration reference is ICO REGISTRATION TO BE ADDED. You can reach us at hello@sablecreates.co.uk.

What we collect

• Account data: your name, work email address, agency name and a hashed password.
• Content you create: property addresses, descriptions, photographs and the brochures built from them.
• Billing data: your billing address and subscription status. Card numbers go directly to Stripe and never reach our servers.
• Technical data: the usual server logs needed to run and secure a web application.

You can start building a brochure before you have an account. At that point we hold an anonymous session identifier and whatever you have typed into the brochure. No name, no email address. If you create an account, that draft becomes part of your account.

Property photographs

Photographs you upload may contain people, vehicles, or the inside of someone’s home. We store them only to render your brochures, we do not use them to train any model, and we do not use them for anything other than providing the service to you. You are responsible for having the right to upload them.

Why we are allowed to hold it

For account, content and billing data, the lawful basis is performance of our contract with you. For security logging and for keeping records we are required to keep, it is our legitimate interest in operating the service safely and our legal obligations. We do not rely on consent for anything described here, so there is nothing to withdraw, but you can close your account at any time.

Automated drafting

Brochure copy can be drafted for you by an automated system. The property details you enter are sent to that system to produce the draft. It makes no decision about you, it has no legal effect on you, and the output is always yours to edit or discard.

Who else processes it

• Supabase: database and authentication (EU, Stockholm).
• Cloudflare: hosting and file storage.
• Stripe: payments and card handling.
• Resend: transactional email (EU, Ireland).
• Anthropic: the automated drafting described above.

Each is bound by a data processing agreement. Some process data outside the UK; where they do, the transfer relies on the UK International Data Transfer Addendum or an adequacy decision. We do not sell your data and we do not share it for advertising.

How long we keep it

Your account and content stay for as long as your account is open, and for 30 days after you close it so that an accidental closure can be undone. Anonymous drafts that are never claimed by an account are deleted after 30 days. Billing records are kept for six years because tax law requires it.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, or ask for it in a portable form. Email us and we will respond within one month. If you are unhappy with how we have handled it you can complain to the Information Commissioner’s Office at ico.org.uk.

Cookies

We set only the cookies needed to keep you signed in and to keep the service secure. There is no analytics, advertising or tracking cookie in the application, which is why you are not asked to consent to any.