Legal
Privacy Policy
How GasTrack collects, uses and protects your information.
Last updated: 27 September 2026
Canonical URL: https://gastrackapp.co.uk/privacy
Who controls your data
The data controller responsible for your personal data is Daniel Ndaba Mpehla, trading as GasTrack. GasTrack is not currently operated by a registered limited company. These details will be updated if a company is incorporated and becomes the data controller. For any privacy question or request, contact us at admin@gastrackapp.co.uk.
Who GasTrack is for
GasTrack is decision-support software for professional UK Gas Safe registered gas and heating engineers. It is not directed at children, and we do not knowingly collect personal data from children.
Information we collect
A. Account information — When you create an account we collect your email address and a password. If you use Sign in with Google, Google shares your basic profile (name and email) with us. Your account record stores your name, email and app role (user/admin).
B. Business profile — To use invoicing and certificates you may enter your business/trading name, address, phone, email, Gas Safe registration number, VAT number and payment details. This is entered by you and used to populate the documents you issue.
C. Customer, property and appliance records — You may enter customer names, addresses, phone numbers and email addresses; property addresses; and appliance details including manufacturer, model, serial number and GC number. You may also attach photos, including rating-plate photos.
D. Job, diagnostic, service and safety records — As you work, GasTrack stores the information you enter: fault descriptions, symptoms, observations, test readings (e.g. gas pressure, gas rate, combustion values), service checklists, unsafe-situation assessments, landlord gas safety records, warning notices, tightness-test calculations, notes and photos.
E. Financial records — Invoices, quotes, payments, expenses and receipts you create, including the customer email used to send documents and payment references.
F. Voice notes — If you record a voice note, the audio is uploaded to a private storage bucket, held only long enough to transcribe (approximately two minutes), and then deleted. Only the transcribed text is saved.
G. Photos — Photos you attach (job, appliance, service, safety, rating-plate, receipt and company-logo photos) are stored in a private Supabase Storage bucket. They are not publicly accessible and have no permanent public URL. Each photo is stored under an object path namespaced by your user id with an unpredictable filename, and the bucket is private with row-level access controls that prevent any user from reading, overwriting or deleting another user’s photos. The Supabase service key is used only server-side and is never exposed to your device. To view a photo, GasTrack verifies server-side that you own the record holding the photo (or are an authorised admin) and that the path matches that record, then mints a short-lived signed URL that expires within 60 seconds. Signed URLs are not stored as permanent record values; only the object path is stored. Only the owning engineer and authorised admin/support can retrieve a photo; other engineers cannot access it.
H. Early-access and support requests — If you are not logged in, you may submit your name, email and message. These are used only to respond to you and are not made public.
I. Usage and diagnostics — We record limited, first-party analytics events (for example, which screens were viewed) and technical logs to operate and improve the service. We do not use third-party advertising or analytics SDKs in the app.
How we use your information
To provide the GasTrack toolkit, create and send the documents you issue, power the diagnostic and safety-assistant features, transcribe voice notes, process payments you enable, respond to support and correction requests, prevent abuse, and maintain and improve the service. We do not sell your personal data.
AI features
Some features use AI models to assist with diagnostics, safety-assessment suggestions, invoice descriptions and field-intelligence search. AI output is decision-support only: it is never stored as evidence, and it does not replace manufacturer instructions, regulations, or your professional judgement. To provide these features, relevant job context (such as model identity, symptoms and observations) may be sent to our AI sub-processor.
How information is shared
- Between engineers: Your customer, property, job and financial records are isolated to your account. Other engineers cannot see them. Administrators can access records only to operate, support and protect the service.
- Sub-processors: We use the following providers to deliver GasTrack:
- Base44 — app hosting, authentication, database, file storage and analytics.
- Supabase — database, private photo storage (user-photos bucket) and temporary private storage for voice-note transcription.
- OpenAI — language models for AI features and voice transcription.
- Google — when you choose Sign in with Google.
- Stripe — only if you enable online payments.
- An accounting provider (QuickBooks Online, Xero, FreeAgent or Sage) — only if you connect it.
We share information with these providers only as needed to provide the feature, under their terms, and we do not authorise them to use your data for their own unrelated purposes. We may disclose information where required by law, to respond to a valid legal request, or to protect the rights, property or safety of GasTrack and its users.
International transfers
Some providers process data outside the UK/EEA. Where this occurs, appropriate safeguards (such as standard contractual clauses) are relied upon to protect your information.
Data retention
We keep your information for as long as your account is active and as needed to provide the service, plus any period required to comply with legal, accounting or reporting obligations. You can request deletion of your data at any time (see Your rights). A formal retention schedule is not yet published; contact us for specifics.
Security
Data is encrypted in transit (HTTPS). Access to records is restricted by ownership controls so that one engineer cannot see another engineer’s data. Uploaded photos are held in a private Supabase Storage bucket, namespaced by owner, with row-level access controls that prevent cross-owner reads, writes, updates and deletes; the Supabase service key is used only server-side. Photos are only ever exposed through short-lived signed URLs (60-second expiry) minted after server-side ownership verification; no permanent public URL is created and only the object path is stored. No method of transmission or storage is fully secure, however, and we cannot guarantee absolute security.
Your rights (UK GDPR)
You have the right to access, correct, erase, restrict, port, or object to the processing of your personal data, and to withdraw consent where processing is based on consent. To exercise any right, contact us at admin@gastrackapp.co.uk. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk).
Account deletion
You can request deletion of your account and associated data via the in-app Support page or by contacting us. We will action verified requests within a reasonable period.
Changes to this policy
We may update this policy. We will indicate the “Last updated” date above and, for material changes, notify you in the app.
Contact
For privacy questions or requests, use the in-app Support page or email admin@gastrackapp.co.uk.