Privacy Policy

This Privacy Policy explains how Coullweb Ltd ("we", "us", "our") collects, uses, stores, and protects your personal data when you visit the ApproveEase website (approveease.com) and use the ApproveEase platform and related services (the "Service").

Registered office: 16/16a Hart House, Priestley Road, Basingstoke, Hampshire, RG24 9PU

We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

Coullweb Ltd is the data controller for personal data processed through the Service. You can contact us at support@approveease.com.

2. What Data We Collect

2.1 Data You Provide

• Account information: name, email address, password, organisation name, and role.
• Billing information: payment card details and billing address (processed by our third-party payment provider; we do not store full card details).
• Content: any data, files, text, or materials you upload or create within the Service.
• Communications: any messages you send to us via email or support channels.

2.2 Data Collected Automatically

• Usage data: features used, actions taken, timestamps, and session duration.
• Technical data: IP address, browser type and version, operating system, device type, and screen resolution.
• Cookie data: see our Cookie Policy for details.

2.3 Data From Third Parties

If you sign up or log in using a third-party service (e.g. Google), we may receive your name and email address from that provider in accordance with your settings on that service.

3. How We Use Your Data

We process your personal data for the following purposes and on the following legal bases:

We do not use your data for marketing purposes unless you have explicitly opted in.

4. Data Sharing

We do not sell your personal data. We may share data with the following categories of third parties, solely to the extent necessary to provide and support the Service:

• Payment processors:to process subscription payments securely.
• Hosting providers:DigitalOcean (UK region) for backend infrastructure; Cloudflare for frontend hosting and CDN.
• Email service providers:to send transactional emails on our behalf.
• Professional advisors:legal, accounting, or audit professionals where required.
• Law enforcement or regulators:where required by law or to protect our legal rights.

All third-party processors are bound by data processing agreements and are required to process data in accordance with applicable data protection law.

5. International Transfers

Your data is primarily stored and processed in the United Kingdom. Where data is transferred outside the UK (for example, through our use of Cloudflare's global network), we ensure appropriate safeguards are in place, including Standard Contractual Clauses or adequacy decisions recognised by the UK Government.

6. Data Retention

We retain your personal data for as long as your Account is active or as needed to provide the Service. After Account deletion:

• Account and profile data is deleted within 30 days.
• Content is deleted within 30 days unless you have exported it beforehand.
• Billing records are retained for up to 7 years as required by UK tax and accounting law.
• Server logs containing IP addresses are retained for up to 90 days.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), access controls, and regular security reviews. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Under UK GDPR, you have the following rights:

• Access:request a copy of the personal data we hold about you.
• Rectification:request correction of inaccurate or incomplete data.
• Erasure:request deletion of your data where there is no compelling reason for its continued processing.
• Restriction:request that we limit processing of your data in certain circumstances.
• Portability:request your data in a structured, commonly used, machine-readable format.
• Objection:object to processing based on legitimate interests.
• Withdraw consent:where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at support@approveease.com. We will respond within one month.

9. Children

The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The "Last updated" date at the top of this page indicates when the policy was last revised.

11. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Website: ico.org.uk
Helpline: 0303 123 1113

12. Contact

For any questions about this Privacy Policy or your personal data, contact us at: