Privacy Policy

Account information

Your email address, an encrypted password (or your Google account identity if you sign in with Google), your household name, your language preference, your reminder email address and settings, and when you last signed in.

Family member and household member records

Details of family members you add (name, relationship, date of birth), and the names and email addresses of people you invite to share your household.

Documents, files and extracted details

Files you upload or email to us (PDFs, images and other file types, up to 20 MB each), and the details read from them: retailer or provider, product names, order and policy numbers, purchase dates, prices, warranty lengths, renewal dates, premiums and any other information the document contains. Documents can include personal data about other people, such as named drivers on an insurance policy.

Emails sent to your upload address

When you or a household member forwards an email to your upload address, we store the sender, recipient, subject, date, message text and all attachments, plus a processing report showing what happened to each attachment.

Records we create for you

From your documents we create warranty records, an Asset Register, an Ownership Timeline, Purchase Journeys (linking order, payment, dispatch, delivery, receipt and warranty emails for the same purchase), service plan schedules, renewal cards (provider, renewal date, current and renewal price) and savings opportunities.

Household Assistant and feedback

Questions you ask the Household Assistant and its answers, and any feedback, bug reports or feature requests you send us.

Technical and usage data

Limited access and error logs, delivery records for emails we send you, and simple usage events (for example, when your QR Pass is shown, copied or scanned into checkout mode) so we can improve the service. We do not use third-party advertising trackers.

We use your data only to provide HouseholdVault: to run your account; to receive, read and organise your documents; to create warranties, assets, timelines, purchase journeys, service schedules and renewal cards; to send you the reminders you have switched on (warranty expiry, service due and renewal reminders); to let members of your household share one vault; to answer your Household Assistant questions using only your own stored data; to respond to feedback; and to keep the service secure. We do not use your data for advertising, we do not sell it, and we do not use it to train AI models.

HouseholdVault uses AI models to read the emails and files you send to your upload address. The AI suggests a title, category and key details (such as dates, prices, warranty lengths and policy numbers), groups multi-document packs such as insurance bundles, labels each attachment (for example Certificate, Schedule or IPID), sorts emails into Documents, Renewals & Savings Opportunities, Marketing or Other, detects possible service plans and their length, reads renewal details, and links related retailer emails into a Purchase Journey. To do this, the content of your emails and files is sent to our AI processing provider. AI can make mistakes: extracted details are shown with confidence scores, and new documents stay in Pending Review until you approve, edit or reject them. The AI does not make decisions that have legal or similarly significant effects on you, and it never contacts retailers, insurers or providers on your behalf. Savings opportunities and renewal cards are information only — HouseholdVault is not a price comparison, insurance or financial advice service.

Each household gets a unique, private upload address (vault-xxxx@uploads.householdvault.co.uk). Anything sent to it is added to your household's Inbox for review, and emails addressed to another household's address can never reach yours. Your QR Pass is a QR code containing your upload address and household name, so a retailer can send a receipt straight to your vault. Anyone who sees or scans your address or QR Pass can send emails to your Inbox — they cannot read your vault. You can generate a new address at any time, which stops the old one working. Treat your address like a private email address and only show your QR Pass to retailers you trust.

A household owner can invite other people by email. Invited members sign in with their own account and, once they join, can see everything in the shared household vault — documents, files, emails in the Inbox, assets, warranties, service plans, purchases, renewals and the timeline — and can upload documents and approve Inbox items. Only the owner can invite or remove members, and edit or delete records. Before inviting someone, make sure you are happy for them to see all of the household's data, including information about other family members. The owner remains responsible for the household's data. If a member is removed, they lose access to the shared vault. Invitations expire after 14 days.

Under UK GDPR we rely on: performance of a contract (to run your account, read and organise your documents, and provide Household Sharing); legitimate interests (to keep the service secure, prevent abuse, measure how features are used, and send reminders you have switched on); and consent where we ask for it (for any optional analytics or cookies). Where you upload documents containing other people's data, you are responsible for having a lawful reason to store it, which for normal household records is usually managing your own household's affairs.

Your data is stored on secure cloud infrastructure. Access rules in the database make sure each household's records can only be reached by that household's owner and invited members.

Document storage

Files are kept in a private storage area and opened through short-lived signed links. Every attachment on an email is stored, even if it cannot be read automatically, unless it is larger than 20 MB, in which case the processing report tells you it was not stored.

Account information storage

Your password is never stored in plain text — it is protected by one-way hashing managed by the authentication system.

Family and household member data

Family and household member records are covered by the same access controls as the rest of your vault.

We use trusted providers to run HouseholdVault, each bound by contract to protect your data and use it only on our instructions: cloud hosting, database, file storage and authentication (Supabase, via Lovable Cloud); web hosting (Cloudflare); inbound email receiving (Mailgun); outbound email delivery for reminders and invitations; AI processing for document extraction and the Household Assistant (via the Lovable AI Gateway, which routes requests to model providers such as Google and OpenAI); and Google, if you choose to sign in with Google. We will keep this list up to date and can provide more detail on request.

HouseholdVault uses only what is strictly necessary for the service to work — for example, to keep you signed in, remember your language, and remember a pending household invitation while you sign in. We do not use advertising cookies.

You can delete individual documents, packs and records at any time; deleting a pack deletes all of its files. You can delete your account from Settings. If you are a household owner, this permanently removes the household vault and everything in it, including for any members. If you are a member, deleting your account removes your access and your personal account but not the owner's household records. You can also request deletion by emailing support@householdvault.co.uk.

We keep your data while your account is active. Rejected Inbox emails are kept in your Inbox until you delete them. When an account is deleted, its vault data and files are removed; limited security logs and email delivery records may be kept for a short period for security and legal purposes. Backups are overwritten on a rolling basis.

We do not share your personal data with third parties for marketing. We share data only with the members of your household you invite, with the service providers listed above, and where required by law.

Some of our service providers, including AI model providers, may process data outside the UK, for example in the United States or the EU. Where this happens we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK–US data bridge.

We protect your data with encryption in transit and at rest, per-household access controls, signed links for files, verification of inbound email signatures and regular security checks. No system is perfectly secure; if a breach affects your data we will tell you and the ICO where required by law.

HouseholdVault accounts are for adults (18+) managing a household. Parents and guardians may store records about their children, such as passports, as part of managing their household. We do not knowingly let children open accounts.

We may update this policy as HouseholdVault develops during beta. We will change the 'last updated' date and, for significant changes, tell you in the app or by email.

Questions about this policy or your personal data? Email support@householdvault.co.uk. We aim to respond within one month.