Privacy Policy

SmartCore Technology ("SmartCore", "we", "us") operates the SmartCore platform, available at smartcoretechnology.co.uk. We are committed to being transparent about how we handle your data.

For any data-related queries, you can reach us at support@smartcoretechnology.co.uk.

This policy applies to all personal data we collect when you:

• Visit our website at smartcoretechnology.co.uk
• Create an account or subscribe to SmartCore
• Use any SmartCore module or feature
• Contact us by email or through our support channels
• Make a purchase through our shop

If you're a business using SmartCore to manage your own employees or clients, we also process personal data on your behalf as a data processor. That relationship is covered by a separate Data Processing Agreement — contact us if you need one.

3.1 Information You Give Us

• Account details — your name, email address, company name, and password when you register
• Payment information — billing details processed securely through Stripe; we never see or store your raw card number
• Employee data — where you use SmartCore HR modules, data about your staff (names, contact details, job information, emergency contacts) that you upload yourself
• Client data — where you use CRM or client-facing modules, information about your clients
• Support communications — emails and messages you send us
• Preferences — theme settings, notification preferences, and other customisations you make within the platform

3.2 Information Collected Automatically

• Usage data — which pages and modules you visit, when, and how often, to help us improve the platform
• Device & browser information — browser type, operating system, and screen size for compatibility purposes
• IP address — used for security monitoring and fraud prevention; not linked to your personal profile
• Cookies & local storage — see Section 6 for full details

3.3 Information from Third Parties

We may receive limited information from Stripe (payment confirmation) and from other integrated services you choose to connect. We don't purchase or obtain personal data from data brokers.

We use your data to:

• Provide the Service — run your account, process payments, and give you access to the modules you've subscribed to
• Communicate with you — send order confirmations, invoices, important account updates, and replies to your support requests
• Improve SmartCore — understand how people use the platform so we can fix issues and build better features
• Keep things secure — detect and prevent fraud, abuse, and unauthorised access
• Meet legal obligations — retain records as required by law, respond to legal requests

We do not use your data for:

• Selling or renting it to third parties
• Advertising or profiling for marketing by others
• Automated decision-making that significantly affects you

We may occasionally send you product updates or news about new SmartCore modules. You can opt out of these at any time by emailing support@smartcoretechnology.co.uk or using the unsubscribe link in any email we send.

Under the UK GDPR, we rely on the following legal bases:

• Contract — processing necessary to provide the Service you've subscribed to (e.g. running your account, processing payments)
• Legitimate interests — improving the platform, fraud prevention, and security monitoring, where our interests don't override your rights
• Legal obligation — where we're required to retain data by law
• Consent — for optional communications such as product updates, which you can withdraw at any time

We use a small number of cookies and browser local storage to make SmartCore work properly. We keep this minimal.

Essential (always on)

• Authentication session — keeps you logged in across pages
• Theme preference (sc_theme) — remembers whether you've set dark or light mode
• Basket & order state — stores your current shop basket locally so it persists across page loads

Analytics

We may use lightweight, privacy-respecting analytics to understand how people navigate the platform. This does not involve tracking you across other websites or creating advertising profiles.

Managing Cookies

You can clear cookies and local storage data through your browser settings at any time. Clearing essential cookies will log you out and reset your preferences.

We share data only where necessary to run the platform:

• Stripe — payment processing. Your card details go directly to Stripe; we only receive a payment confirmation token. Stripe's privacy policy.
• Supabase — our cloud database and authentication provider. Your data is stored securely on their infrastructure. Supabase's privacy policy.
• Cloudflare — our hosting and content delivery provider. Traffic to smartcoretechnology.co.uk passes through Cloudflare's network. Cloudflare's privacy policy.
• Resend — transactional email delivery (invoices, order confirmations, notifications). Resend's privacy policy.
• Legal or regulatory bodies — where we're required to disclose data by law, court order, or regulatory authority

We do not share your data with advertisers, social media companies, or data brokers. We never sell your data.

We keep your data for as long as your account is active, plus a reasonable period after to handle any queries, disputes, or legal obligations.

• Active accounts — data retained for the duration of your subscription
• After cancellation — data retained for 30 days, then permanently deleted. You can export your data during this window.
• Payment records — retained for 7 years to meet HMRC requirements
• Support communications — retained for up to 2 years

If you'd like your data deleted sooner, just contact us at support@smartcoretechnology.co.uk and we'll handle it promptly.

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct any inaccurate or incomplete data
• Erasure — ask us to delete your data ("right to be forgotten"), subject to any legal obligations we have to retain it
• Restriction — ask us to limit how we process your data in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent (e.g. marketing emails), you can withdraw it at any time

To exercise any of these rights, email us at support@smartcoretechnology.co.uk. We'll respond within 30 days and won't charge you for reasonable requests.

We take security seriously and use a layered approach to protect your data:

• All data is encrypted in transit using TLS/HTTPS
• Data at rest is encrypted at the database level
• Access to production systems is restricted and logged
• Passwords are never stored in plain text
• We use row-level security policies in our database so users can only access data they're authorised for
• We monitor for suspicious activity and unauthorised access attempts

If we become aware of a data breach that is likely to affect your rights, we will notify you and the relevant authority as required by law.

SmartCore is a business platform. It is not directed at or designed for personal use by children. If you are setting up an account on behalf of a business that employs young workers, you remain responsible for ensuring that any personal data you upload about those individuals is handled appropriately and in compliance with applicable law.

Your data is primarily stored and processed within the UK and European Economic Area. Where it is transferred outside these areas — for example, to US-based service providers like Stripe and Supabase — we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

We may update this policy as our platform evolves or as legal requirements change. When we make significant changes, we'll let you know by email or by a notice on the platform before the changes take effect.

The date at the top of this page always reflects the most recent revision.

If you have any questions about this policy or how we handle your data, please get in touch:

• Email: support@smartcoretechnology.co.uk
• Website: smartcoretechnology.co.uk

If you're not happy with how we've handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk — though we'd appreciate the chance to address your concern first.