Privacy Policy

Version 1.0 · Effective 2026-09-25

Plain-English summary (not part of the policy): We collect the details you give us to run your account and take payment, and we count your API usage. We do not record what you look up. We don't sell data or run advertising. Your data is held by a small set of named providers. You can ask for a copy, correction or deletion at any time.

1. Who is responsible

WeGetDesign Ltd, trading as OneVal, a company registered in England and Wales, is the data controller for personal data processed through the OneVal website, console and API. We are registered with the Information Commissioner's Office under reference ZA501952. Contact: support@wegetdesign.com.

2. What we collect and why

What	Examples	Why	Lawful basis
Account details	Name, work email, organisation, password (stored hashed)	To create and secure your account and contact you about it	Contract
Billing details	Plan, seats, billing address, VAT number, payment status. Card details are handled by Stripe and never reach us.	To take payment and issue invoices	Contract; legal obligation (tax records)
Usage metering	Number of API calls per key per period, timestamps, response status	To apply your allowance and bill correctly; to detect misuse	Contract; legitimate interests
Technical logs	IP address, user agent, request timing, error traces	To keep the Service secure and working	Legitimate interests
Support correspondence	Emails you send us	To help you	Legitimate interests
Marketing preferences	Whether you've opted in to product updates	To send updates only if you want them	Consent

3. What we do not collect

3.1 We do not record the content of your queries against your account. The postcodes and house numbers you send to the API are used to produce a response and are not stored with your account identity. Our usage records hold counts and timestamps only.

3.2 Property data returned by the Service concerns properties, not people. Recorded sale prices come from HM Land Registry's published Price Paid Data, which is public information about transactions; we do not return the names of buyers or sellers, and the addresses in that dataset are used only for internal matching and are never shown.

3.3 We do not build profiles of you, sell personal data, or show advertising.

4. Who we share data with

We use a small number of service providers who process data on our instructions:

Provider	What they do for us	Where
Stripe Payments UK Ltd / Stripe Inc.	Payments, invoices, billing portal	UK / EU / US
Supabase Inc.	Database and login for the console and API accounts — the only place account data is stored	United Kingdom
Railway Corp.	Runs our data-processing service (property data only, no account data)	United Kingdom
Replit Inc.	Hosts the API gateway; handles requests in transit and stores no account data	Global edge
Lovable Labs Inc.	Hosts the website and console front-end; account data is read from Supabase and not stored	Global edge
Google (Workspace)	Our business email and support correspondence	EU / US

We do not share personal data with anyone else except where the law requires it, to enforce our terms, or with a purchaser or successor of the OneVal business (who would be bound by this policy).

5. International transfers

Account data is stored in the United Kingdom. Stripe and Google may process data in the EU or US, and requests to the API and website pass through globally distributed hosting; where personal data leaves the UK, transfers are protected by the UK International Data Transfer Agreement or Addendum, or by an adequacy decision covering the destination. You can ask us for details.

6. How long we keep data

Account details: for as long as your account is open, then deleted within 30 days of closure, except as below.
Billing records and invoices: 6 years after the end of the tax year, as HMRC requires.
Usage metering: 24 months in identifiable form, so billing questions can be answered, then aggregated.
Technical logs: 30 days.
Support emails: 2 years after the last message.

7. Your rights

You can ask us to: give you a copy of your personal data; correct it; delete it; restrict or object to how we use it; or transfer it to you or another provider. Where we rely on consent you can withdraw it at any time. Email support@wegetdesign.com; we respond within one month.

You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to resolve it first.

8. Cookies

The website and console use only the cookies needed to keep you signed in and secure. We do not use advertising or third-party analytics cookies. If that changes we will update this policy and, where required, ask for your consent first.

9. Security

Data is encrypted in transit and at rest. Access to account data is limited to staff who need it. API keys are stored hashed and cannot be recovered by us once issued.

10. Children

The Service is for businesses and is not directed at anyone under 18.

11. Changes

We will post changes here with the effective date and email account holders about material changes at least 30 days in advance.

Effective date: 2026-09-25