Privacy Policy

1. Who We Are

BoundaryFinder is operated by Rock MSP Limited, a company incorporated in New Zealand, trading as BoundaryFinder. Rock MSP Limited is the data controller for personal data collected through this website. This privacy policy explains how we collect, use, and protect your personal data when you use our website and services.

2. Data We Collect

We collect minimal data. BoundaryFinder uses guest checkout — there are no user accounts, no passwords, and no profiles.

When you purchase a report:

• Email address — collected by Stripe during checkout, used to deliver your report
• Property address searched — the address you searched for, stored with your purchase
• Payment information — processed entirely by Stripe; we never see or store your card details

When you visit our website:

• Analytics data — anonymised usage data via Google Analytics (if you consent to cookies)
• Server logs — IP address and request data, retained for 30 days for security

When you request a saved property preview:

We use the email address you provide to send one requested property link and a brief guide to our reports and documents. The link preserves your property reference and selected options, but does not unlock paid content. Delivery is recorded in our email logs. This does not enrol you in a newsletter or create automatic follow-up emails.

3. How We Use Your Data

• To generate and deliver your boundary report
• To send your report download link by email
• To process your payment via Stripe
• To monitor and improve our service
• To invite you to leave a review of our service, via our reviews partner REVIEWS.io

We do not send unsolicited marketing or enrol you in ongoing marketing when you request a preview. We do not sell your data or share it with anyone except Stripe (payment processing), MailerSend (email delivery), REVIEWS.io (review invitations, see below), and DigitalOcean (support chatbot, only if you choose to use it).

4. Lawful Basis

• Contract — processing your purchase and delivering the report
• Your request and consent — sending the saved preview and brief product guide you explicitly ask for
• Legitimate interest — website security, analytics, service improvement, and inviting feedback/reviews from customers after a completed purchase

5. Data Retention

• Purchase records (email, address, amount): retained for 2 years for accounting
• Generated PDF reports: retained for 120 days, then deleted
• Server logs: retained for 30 days
• Support chatbot questions and answers: retained for 90 days, then permanently deleted

6. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data (right to erasure)
• Object to processing of your data

To exercise any of these rights, visit our Contact page.

7. Cookies

We use essential cookies for site functionality and optional analytics cookies (Google Analytics) with your consent. You can manage cookie preferences at any time.

8. Third-Party Services

• Stripe — payment processing (stripe.com/gb/privacy)
• MailerSend — email delivery (mailersend.com/legal/privacy-policy)
• REVIEWS.io — our reviews partner; if you purchase a report, we share your name, email address and order reference with REVIEWS.io so they can invite you, directly, to leave a review of our service (reviews.io/legal/user-privacy-policy)
• Google Analytics — anonymised website analytics (policies.google.com/privacy)
• DigitalOcean — powers the optional support chatbot; if you choose to send it a message, that message text is processed by DigitalOcean's AI inference service to generate a reply (digitalocean.com/legal/privacy-policy)

Data is shared with these services only as necessary to fulfil their stated purpose (processing payments, delivering emails, measuring site usage, answering chatbot questions, inviting reviews). Transmission to all third parties is via encrypted HTTPS/TLS connections and authenticated API keys.

We also keep our own record of chatbot questions and answers on our servers, so we can review and improve the quality of replies. These records are kept for 90 days and then permanently deleted, and are never used for marketing or shared with anyone beyond DigitalOcean (who process the message to generate the reply, as above).

9. Security

We take appropriate technical and organisational measures to protect your personal data:

• All data transmitted between your browser and our servers is encrypted using HTTPS (TLS 1.2+)
• Payment card details are processed entirely by Stripe, which is PCI DSS Level 1 certified — we never see, handle, or store your card information
• Our servers are hosted in the UK/EU with encrypted storage and firewall protection
• Access to purchase records and customer data is restricted to authorised personnel only
• Server access is secured with SSH key authentication and fail2ban intrusion prevention

10. Contact

For privacy enquiries, visit our Contact page.