Privacy notice

Who we are

Blockwise is run by Blockwise Software Limited, a company registered in England and Wales, company number 17536881, registered office Codsall Community Hub, Wolverhampton Road, Codsall, Wolverhampton, WV8 1PX (“we”). For anything in this notice, email privacy@blockwiseapp.co.uk.

If you are a resident, leaseholder or tenant

Your managing agent decides what happens to your details, not us: they are the controller and we handle the data only on their instructions. Please ask them about it.

Our role

Our customers are managing agents. The details they put into Blockwise, including their own staff’s accounts and activity records, belong to them: they are the controller and we are their processor, under a data processing agreement.

We are the controller for a few things of our own: keeping the service secure (sign-in checks, blocking misuse), running our relationship with each customer (contacts, invoices, support), and the in-app Help assistant.

What we collect

• Your account — name, work email, role, the office you work in, sign-in times, and your password (stored only as a one-way hash). If you set up two-step sign-in, a secret for your authenticator app, stored encrypted.
• Sign-in security — your device’s IP address and browser type when you sign in or use the service, kept in the account’s activity record. Failed sign-in attempts are counted against a scrambled form of your email and IP address, not the address itself.
• Help assistant — the questions you type into Help and the screen you asked them on.
• Customer contacts — the name, email and phone number of the people we deal with at each customer.

Why, and our lawful basis

Running the service our customer has signed up for (contract with them, and our legitimate interest in providing it to their staff); keeping it secure and preventing fraud (legitimate interests, and our legal duty to keep personal data secure); answering Help questions (legitimate interests).

Who else handles it

• Railway — hosts the service and its database — Netherlands (EU)
• Cloudflare — stores files, and checks sign-in attempts come from a person — UK and EU
• Resend — sends sign-in emails: invitations, password resets, two-step codes — EU
• Backblaze — holds our encrypted backups — Germany (EU)
• Anthropic — answers Help questions — United States

Sending Help questions to Anthropic is a transfer outside the UK, covered by the safeguards UK law requires. Nothing you send is used to train AI models. We never sell personal data.

How long we keep it

• Your account: while your employer is a customer and you have access, then as their agreement with us says.
• The activity record (including IP addresses): 6 years, in case a claim or complaint needs it.
• Security alerts: 1 year. Failed sign-in counts: about 2 days.
• Help conversations: 24 hours.
• Backups: up to 400 days, encrypted, then deleted.

Cookies and browser storage

We only store what the service needs to work. There are no advertising or analytics cookies, so we don’t ask you to accept any.

• session — keeps you signed in; ends when you sign out, after inactivity, or at most after 8 hours (30 days for site staff signed in only to do meter rounds on a phone)
• 2fa_pending — holds your place between your password and your two-step code; 10 minutes
• perm_preview — only when an administrator previews another role’s view; 30 minutes
• xero_oauth_state — only while an administrator connects Xero; deleted once it is done
• Browser storage — your display choices (for example list or calendar view) and the time of your last activity, so an idle sign-out works across tabs
• Cloudflare check — the sign-in pages run Cloudflare’s check that tells people from bots; it is not used for advertising
• Stripe — the resident payment page loads Stripe’s card form, which sets its own cookies to prevent fraud

Your rights

You can ask for a copy of your details, have them corrected or deleted, restrict or object to how they are used, or move them elsewhere. For anything held for your employer, we’ll pass the request to them, as the decision is theirs. Email privacy@blockwiseapp.co.uk.

You can also complain to the Information Commissioner’s Office (ico.org.uk), though we’d like the chance to put things right first.