Privacy Policy

Who we are

ctrl.detail is a trading name of Ctrl Alt Elite Studio Ltd, a company registered in England and Wales under company number 17140083, registered office 33 Birch Grove, Cwmbran NP44 6EP. We operate the website detail.ctrl-alt-elite.uk and provide the ctrl.detail SaaS for mobile detailers in the UK.

For the purposes of UK GDPR and the Data Protection Act 2018 we act as the data controller for the personal data described in section 3 below, and as a data processor for the personal data our customers (detailers) upload about their own clients (see section 4).

Contact us at contact@ctrl-alt-elite.uk.

Scope

This policy covers two relationships:

• You as a visitor or customer of ctrl.detail. We are the controller of your personal data here - your account, billing, support contact, and so on.
• Data your customers (your detailing clients) upload to ctrl.detail. You decide what to capture about them; we host and process it on your instructions. You are the controller of that data and we are the processor. Section 4 sets out how that processing works.

Data we collect about you

• Account data: name, email address, password (hashed), business name, postcode area you cover, services and pricing you publish.
• Authentication metadata: IP address and user-agent at sign-in, magic-link tokens, OAuth identifiers if you sign in with a third-party provider. Held by Supabase (see section 7).
• Billing data: when paid plans go live, your billing email, postal address, VAT/business number where applicable, and a Stripe customer reference. Card details are submitted directly to Stripe and never reach our servers.
• Support correspondence: emails or messages you send us, retained so we can keep helping you.
• Cookie consent record: your accept/decline choice is stored in your browser's localStorage. See the Cookie Policy.

We don't currently run third-party analytics, advertising pixels, or marketing automation on this site. If that changes we'll update this policy and the cookie banner.

Data your customers' details we process for you

When you use ctrl.detail to run your business you'll add information about your own customers - their name, contact details, vehicle, job history, payments, notes, photos. You control what you collect and how long you keep it.

We act as a processor for that data: we hold it on your behalf, act on your instructions through the product (you create, edit, and delete records), and don't use it for our own purposes beyond keeping the service running. The detailed processor terms - subprocessors, security measures, audit rights, breach notification - are set out in our Data Processing Addendum, which forms part of the Terms of Service. A standalone DPA is available on request.

Why we use your data and lawful bases

• Contract performance. Operating your account, processing payments, and providing the service you subscribed to.
• Legitimate interests. Diagnosing errors, preventing fraud and abuse, communicating service updates, improving the product. We balance these against your rights and you can object at any time.
• Consent. Optional analytics or marketing cookies (none currently enabled - see Cookie Policy).
• Legal obligation. Tax and accounting records, responding to lawful requests from authorities.

Sharing your data

We only share personal data with the subprocessors listed in section 7, and where required by law. We don't sell your data, and we don't share it with advertisers.

Subprocessors

The following providers process personal data on our behalf to deliver the service. Where data leaves the UK, transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

• Supabase (database + authentication). Stores account data, sessions, and your customer records. Project hosted in the EU.
• Stripe (payments, when paid plans launch). Processes card payments, holds your billing address and the card-on-file token. PCI-DSS Level 1.
• Resend (transactional email, when wired). Delivers sign-in links, account notifications, booking confirmations from noreply@ctrl-alt-elite.uk. US-based with EU sending regions.
• Vercel (hosting + edge logs). Serves the site and stores short-lived request logs. US-based with EU edge regions.

Retention

• Account data: kept for the lifetime of your account, then deleted within 30 days of closure (we may retain anonymised aggregates).
• Billing records: 7 years, as required by UK tax law.
• Support correspondence: up to 2 years from last contact.
• Authentication logs: 90 days, then purged.
• Customer data you upload: retained while your account is active. On account closure, exported on request and deleted within 30 days unless you tell us otherwise.

Your rights

Under UK GDPR you can:

• Access the personal data we hold about you.
• Have inaccurate or incomplete data corrected.
• Request erasure where we no longer have a lawful reason to keep it.
• Object to processing based on legitimate interests, or withdraw consent at any time.
• Receive a copy of your data in a portable, machine-readable format.
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. We'd ask you to come to us first if you can.

To exercise any of these rights, email contact@ctrl-alt-elite.uk. We aim to respond within one calendar month.

Security

Data is encrypted in transit (TLS) and at rest. Access to production data is restricted to engineers who need it, audited, and gated by SSO + 2FA. We don't store card numbers or CVVs. If we ever discover a personal-data breach affecting you we'll notify you and the ICO in line with our legal obligations.

Children

ctrl.detail is a B2B product and not intended for anyone under 18. We don't knowingly collect personal data from children.

Changes to this policy

We'll update this policy as the product evolves. Material changes will be notified by email to active accounts. The version and date at the top of this page reflects the current revision.

Contact

Questions about this policy or the data we hold: contact@ctrl-alt-elite.uk.