Privacy notice
How we look after your information, in plain English.
Last updated 25 October 2026
This notice explains how Footings uses your personal information: what we collect, why, who helps us look after it, how long we keep it, and the choices you have. We've tried to write it in plain English.
1. Who we are
Footings is a trading name of Mullo Ltd, a company registered in England and Wales (company number 17478834). Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. We are registered with the Information Commissioner's Office (ICO) under registration number ZC257032.
We are the controller of your personal information, which means we decide how and why it is used. You can contact us at hello@usefootings.co.uk.
2. What we collect
- Your account: your email address and name, and records of when you sign in. We don't use passwords: you sign in with a code sent to your email.
- Your build: the name you give it, the claimant's full name, the site address and postcode, the type of build and its stage, planning details (reference, authority and conditions), the completion date and details of your completion evidence.
- Your invoices and documents: the files you upload or email to your Footings address, and what we read from them: supplier names and VAT numbers, invoice numbers, dates, amounts, each line item with its description, quantity and price, and the name and address printed on the invoice. We also keep the results of our checks, the answers you give to our questions, and anything you correct.
- Emails to your Footings address: the message, the sender, the subject and any attachments.
- Other people's details: invoices and emails contain the names and contact details of suppliers and sometimes of your contractors. If you save merchants or tradespeople as contacts, we keep the details you enter (such as name, company, email, phone number and account number).
- Build progress and results: your build stage over time and, if you choose to tell us, what you claimed and what HMRC paid.
- Payments: Stripe takes your payment. We receive the plan you bought, the amount, the date, the status and your email address. We never see or store your card number.
- Messages to us: anything you send to us, including feedback and bug reports, with the page you were on and the type of device you were using.
- Technical information: your IP address, browser and device type, and error records, held in our providers' logs so we can keep the service secure and fix faults.
- Your choices: the consents you give or withdraw, such as allowing anonymised price data to be used (see section 3).
We do not ask for, and you shouldn't send us, special category information such as health details.
3. Why we use your information, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Set up and run your account and build; read, store and check your invoices; receive and file emails sent to your Footings address; prepare your claim schedule; give you the plan you have chosen | Contract: we need this to provide the service you asked for |
| Take payments, give refunds, keep our accounts, and meet tax and company law duties | Contract, and legal obligation |
| Send you emails about your account and builds, such as sign-in codes, notices that something needs your attention, and a monthly statement of where your build stands | Contract, and our legitimate interest in keeping you informed about a service you use. You can stop the monthly statement at any time |
| Keep Footings secure and working; prevent fraud and misuse; take backups; investigate faults | Legitimate interests: running a safe and reliable service |
| Understand how Footings is used and improve it, using summarised figures; answer your feedback and support requests | Legitimate interests: making the service better |
| Show you price history for materials you have bought, drawn from your own invoices | Contract: it is part of the service |
| Include prices from your invoices in anonymised, grouped figures (for example, average prices for a material in a region), and publish or share figures about the DIY Housebuilders' Scheme that cannot identify you | Your consent for using your prices in this way, which you can withdraw at any time. Truly anonymised figures are not personal information |
We do not pass your details to builders' merchants. If we ever offer to connect you with merchants, we will only do it if you ask us to, one request at a time.
We do not sell your personal information, and we do not send anything to HMRC on your behalf. You always make your own claim.
4. Who helps us look after your information
We use a small number of trusted providers to run Footings. They act on our instructions and are bound by contracts that protect your information.
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Our database, file storage and sign-in | London, UK |
| Vercel | Runs the Footings app | Servers in London, UK. Pages may be delivered through Vercel's global network |
| Cloudflare | Hosts this website, and receives emails sent to your Footings address before passing them to us | Global network |
| Resend | Sends our emails, such as sign-in codes and statements | Provider based in the US |
| Anthropic | An AI service that reads your invoices, so you don't have to type them in. See section 8 | Processed in the US |
| Stripe | Takes payments and makes refunds. Stripe is also responsible for its own fraud prevention and legal duties | Operations in the UK, EU and US |
We may also share information with: people you invite to your build (they can see what you can see); our professional advisers and insurers, under confidentiality; a person reviewing a Claim Check you have bought, under confidentiality; and public authorities where the law requires. If our business were ever sold, the new owner would take on this notice.
5. Where your information goes
Your database and files are stored in London. Some providers listed above are based outside the UK, or process information outside the UK. Where that happens we rely on the safeguards the UK law provides for these transfers: a UK adequacy decision (such as the UK-US data bridge, where the provider takes part), or the UK's International Data Transfer Agreement or Addendum. You can ask us for more detail using the contact details above.
6. How long we keep it
- Your account, builds, invoices and emails: for as long as your account is open. We recommend you download your own copy (there is a Download everything button on your dashboard) because you may need your records long after you have finished.
- If you ask us to delete your account: we delete it within 30 days. Deleted information stays in encrypted backups for up to a further 35 days before it is overwritten.
- Inactive free accounts: if you haven't signed in for 24 months, we will email you first, and if we don't hear back within 60 days we may delete the account.
- Emails waiting because of the free plan limit: the sender, subject and date are kept for 30 days and the email is then deleted (see our terms).
- Payment and accounting records: 6 years, as the law requires.
- Feedback and bug reports: up to 3 years.
- Invoices sent to our AI provider: deleted from its systems within 30 days.
7. How we keep it safe
- Everything is encrypted in transit and stored encrypted.
- Each build's information can be seen only by the people on that build. This is enforced in the database itself, not only in the app.
- Uploaded documents are kept in private storage, never on public links.
- Payment card details never reach our systems.
- Our own administrator accounts are protected with two-factor authentication, and access is limited to the people who need it.
- We take regular backups, so your information can be recovered if something goes wrong.
If a security incident affects your information and puts you at risk, we will tell you and the ICO as the law requires.
8. Reading and checking your invoices
When you add an invoice, an AI service (Anthropic) reads it and we save what it finds. Our own rules, based on HMRC's published guidance, then check each line. This is automated, but it doesn't make decisions about you with legal or similarly significant effects: HMRC alone decides whether to repay VAT, and you decide what to claim. Reading can make mistakes, so we ask you to check the details against your invoice and correct anything that's wrong.
Anthropic's terms say it does not use information sent through its business service to train its models, and it deletes that information within 30 days.
9. Emails we send you
We send emails about your account and builds: sign-in codes, notices when something needs your attention, receipts from Stripe, and a monthly statement of where your build stands. The monthly statement goes to everyone who has access to a build, on the 2nd of each month. Every statement has a link to stop it, and pressing it switches statements off for you straight away. You can also email us and ask. Sign-in codes and notices about your account cannot be switched off while you have an account.
10. Cookies and similar technologies
This website (usefootings.co.uk) uses the Meta Pixel, an advertising tool from Meta (the company behind Facebook and Instagram). It tells Meta that you visited, which pages you looked at and whether you clicked through to start, so we can see whether our ads work and show them to people likely to be interested. Meta receives your IP address and browser details and may link the visit to your Facebook or Instagram account, under its own privacy policy. We don't send Meta your name, email or anything from the app. You can block it with your browser's privacy or tracking settings, and control how Meta uses it in your Facebook or Instagram ad preferences.
Our pages also load fonts from Google Fonts, which means your IP address is sent to Google when a page loads.
11. If we've written to you
We sometimes write by post to people who look, from public planning records, to be building or converting their own home, to tell them about Footings. If you've had a letter from us, this is what we hold and why.
- Where it came from: the public planning register of your local council, found through PlanIt, a free search of UK planning applications. We look for planning permission for a single new home, and a recent application to discharge its conditions.
- What we keep: the planning reference, the description and dates of the application, the site address and, where the council publishes it, the applicant's name and address and the name and business address of any agent (such as an architect) named on the application. If the site has no postal address yet, we may use an address for you shown on the council's planning page. We also keep the code printed on your letter and whether it has been used to visit our website, open an account or buy.
- Why, and our lawful basis: our legitimate interest in telling people who are likely to be self-building about a service that may help them. We send one letter only and don't follow it up.
- How long: if we don't write to you, within 6 months. If we do, for 2 years after the letter, so we can see whether letters are useful, then it's deleted.
- Who sees it: only us, and the printing and posting company that sends the letters for us.
- To stop it: email hello@usefootings.co.uk with your postcode, or the code on your letter, and ask us to remove you. We delete your details and keep only a scrambled fingerprint of your name and postcode, which can't be turned back into either, so we never write to you again.
12. Your rights
Under UK data protection law you have the right to:
- be told about, and get a copy of, the personal information we hold about you (the Download everything button gives you most of it straight away);
- have inaccurate information corrected;
- have your information deleted;
- ask us to restrict how we use it;
- receive the information you gave us in a portable format;
- object to us using it for our legitimate interests; and
- withdraw a consent you have given, at any time.
To use any of these rights, email hello@usefootings.co.uk from the address on your account (or, if we've only written to you, with your postcode or letter code). We normally reply within one month and it is free.
13. Children
Footings is for adults building or converting their own home. It is not aimed at anyone under 18 and we don't knowingly collect information from children.
14. Changes to this notice
If we make an important change, we'll email you before it takes effect. The date at the top of this page shows when it was last updated.
15. Complaints
If you're unhappy about how we've used your information, please tell us first at hello@usefootings.co.uk and we'll do our best to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, telephone 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.