Privacy Policy

HeatNet Designer (“we”, “us”) is a district-heating network design tool, operated in the United Kingdom. For the personal data described below we are the data controller. HeatNet Designer is an independent product in early release and is not yet incorporated as a company; the best way to reach us for any privacy matter is by email at contact@heatnetdesigner.co.uk.

• Account data: your email address. Sign-in is passwordless - we email you a one-time code, so we never store a password for you.
• Project data: the heat-network designs you create - building locations, demands, pipe routes, costs and related engineering inputs, which can be commercially sensitive.
• Team data: if you use team workspaces, the teams you belong to, your role in each, invitations (the invited email address and role), and comments you post on projects. Members of a team see each other’s email addresses, the projects moved into the team, and the comments on them. Invitations are not emailed by us.
• Usage data: a minimal record of sign-ups and sign-ins (your account identifier and a timestamp) so we can understand how many people are using the tool. We do not track your individual activity within the app for advertising or profiling.
• Technical data: standard server logs, and error reports from the app (the error message, the page path, the software build and your browser type), which are kept in our hosting provider’s function logs to fix faults. Share tokens, query strings and email addresses are removed before a report is kept.
• We do not use advertising trackers or sell your data.

• Create and secure your account, store and display your projects, and send sign-in codes - performance of a contract.
• Keep the service secure, debug errors, and understand overall usage numbers - legitimate interests.
• Bill for any future paid plan - performance of a contract / legal obligation.

Your account and project data are stored in a managed PostgreSQL database and authentication service provided by Supabase, hosted in the London (UK) region. Access is isolated per user by database Row-Level Security - one customer cannot read another customer’s projects. Data is transmitted over HTTPS/TLS and encrypted at rest.

We share data only with service providers who process it on our behalf under contract, and only as needed to run the service:

• Supabase - database, authentication and hosting.
• Vercel - application hosting.
• Resend - sending sign-in code emails.

Some map and data services are contacted while you use the designer. They receive the request itself (for example a map area or a search term) and, where your browser contacts them directly, your IP address:

• Esri (ArcGIS Online) - basemap tiles, loaded by your browser.
• OpenStreetMap tile servers - basemap tiles when that basemap is selected, loaded by your browser.
• OpenStreetMap Nominatim - address search, called by your browser with the text you search for.
• Ordnance Survey (OS Data Hub) - OS maps and building and height data for the area you are working in, through our server functions.
• Overpass API (OpenStreetMap data) - building and street data for the area you are working in, through our server function, or from your browser if that is unavailable.
• Open-Meteo - ground elevation for the network area, through our server function, or from your browser if that is unavailable.
• Energy Performance Certificate register (UK government) - when you use Fetch EPC, the addresses looked up, through our server function.
• Google Fonts - web fonts, loaded by your browser.

No analytics or advertising service is loaded. We do not sell personal data or share it for advertising.

Where a processor is outside the UK/EEA, transfers are protected by an adequacy decision or Standard Contractual Clauses / the UK International Data Transfer Addendum.

We keep your account and project data while your account is active. If you delete your account, your projects, their saved versions and your share links are deleted, as are your team memberships (another member becomes owner of a team you owned, or the team is deleted if nobody is left); comments you wrote stay on teammates’ projects without your name, and sign-in and usage records are kept only in anonymous form. Database backups are retained for up to 7 days and server logs for up to 30 days.

Under UK GDPR you can request to access, correct, delete, restrict, object to, or receive a portable copy of your data. On the Account page you can download all your data in one file and delete your account; each project can also be exported on its own at any time. To exercise any right, contact contact@heatnetdesigner.co.uk - we respond within one month. You may also complain to the Information Commissioner’s Office (ICO).

We use essential browser storage only - to keep you signed in and to hold unsaved work locally. We do not use non-essential or advertising cookies.

Per-user data isolation (Row-Level Security), encryption in transit (TLS), passwordless email sign-in (no stored passwords), optional two-factor sign-in with an authenticator app, and least-privilege access. No system is perfectly secure, but we follow industry practice and review our controls.

We may update this policy; material changes will be notified in-app or by email.

HeatNet Designer, United Kingdom - contact@heatnetdesigner.co.uk.