Privacy Policy

24Plumb Ltd  ·  Last updated: 19 October 2026  ·  Effective: 19 May 2026

1. Who We Are

24Plumb Ltd ("24Plumb", "we", "us", "our") builds software for plumbing and heating firms — 24Plumb Pro, at 24plumb.com. We are not a consumer plumber-booking service and we do not dispatch plumbers. We are the data controller for personal data collected through this website.

24Plumb previously operated a consumer emergency plumber booking service. That service is paused and we are not taking consumer bookings. This policy still describes the personal data that service collected, but we no longer hold it: no booking was ever completed, and the records of plumbers who began an application have been deleted. Your rights in Section 9 continue to apply to any personal data we do hold.

We are registered in England and Wales. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller for the personal data we process about you.

We are registered with the Information Commissioner's Office (ICO). Our ICO registration number is ZC161578.

2. Data We Collect

From customers who made a booking (service paused)

We are not collecting this data, and we hold no booking-customer records — the consumer service never took a completed booking. For transparency, these are the categories the service was designed to collect from a booking customer:

• Identity data: full name
• Contact data: phone number, email address
• Location data: full service address including postcode
• Job data: description of the plumbing problem, urgency level
• Financial data: payment amount, Stripe payment intent ID (your card number is processed directly by Stripe and is never transmitted to or stored by 24Plumb)
• Technical data: IP address, browser type, and referring page (collected automatically by Firebase Hosting)

From plumbers who applied to join the platform (applications closed)

We are not accepting applications. The records of the plumbers who began an application have since been deleted, so we no longer hold this data. For transparency, these are the categories collected during the (now paused) application process:

• Identity data: full name
• Contact data: phone number, email address
• Professional data: Gas Safe registration number, public liability insurance status, areas of operation, home postcode
• Account data: Google account ID (used for authentication)

Business contacts

We process limited business-contact data — firm name, business email or phone number, and director name where published — about UK trade businesses and agencies. This data comes from the public Companies House register and firms' own public websites. We process it under our legitimate interests (Article 6(1)(f)) to send relevant business-to-business emails (sent through Instantly, see Section 6), to make a small number of business-to-business sales calls (see Section 5), and occasionally to post a letter to a firm's registered office. One documented assessment covers all three. If you tell us to stop — reply "STOP", or say so on a call or by email — we honour it within 24 hours and add your firm to a permanent suppression list that applies to every channel. If you simply decline the offer ("not interested", "we're fine"), we may send one short human reply in the same thread and, after 12 months, one further approach if we have something genuinely new to say; a second "no" is treated as "stop". See Section 4 for the full rule. If you ring our demo line (07460 529016) from a number we hold for your firm, reply to us, or ask us a question, we treat that as an invitation to get back to you once, within two working days — the stop rules above still apply. We keep this data for no more than 24 months from our last contact with you.

Founding-partner questionnaire and waitlist

• Business data: agency name, website
• Contact data: contact name, business email
• Questionnaire data: your answers to our founding-partner questionnaire

We use this data solely to evaluate and operate the founding-partner programme. Our legal basis is our legitimate interests (Article 6(1)(f)) and, where you have asked to join the programme, steps taken at your request prior to entering into a contract (Article 6(1)(b)).

From 24Plumb Pro customers and founding members

• Identity data: your name
• Business data: your firm's name
• Contact data: business email address, business phone number
• Financial data: subscription status, Stripe customer ID and payment records (your card details go directly to Stripe and are never seen or stored by 24Plumb)
• Onboarding data: the setup details and answers you send us after signing up

We use this data to provide and bill the 24Plumb Pro subscription, to support you, and to keep our statutory accounting records. Our legal basis is contract performance (Article 6(1)(b)) and, for our accounting records, legal obligation (Article 6(1)(c)).

Callers and customers of a firm that uses 24Plumb Pro

24Plumb Pro answers a plumbing firm's missed calls by text. If you ring a firm that uses it and nobody picks up, you may get a text from the firm's 24Plumb Pro number, and you can reply to describe the job and arrange a visit. In that case we process, on the firm's behalf:

• Contact data: the mobile number you called or texted from
• Enquiry data: the texts exchanged between you and the firm's number — typically the problem, your postcode and when you want someone to come — and the booking request we pass to the firm
• Call data: the time of your missed call and whether a text-back was sent

The replies are written by an AI model (Anthropic's Claude, see Section 6) within rules we set: it never quotes a price, never gives repair instructions, and hands anything urgent or unclear to the firm's owner. The texts themselves are carried by Twilio (Section 6). The firm you contacted is the data controller for your enquiry — it chose to use the service, and the booking is between you and the firm — and 24Plumb processes it as the firm's processor. Reply STOP at any time and that number will send you nothing further. We keep conversations and missed-call logs for 12 months (Section 8).

Data we do not collect

We do not collect card numbers, sort codes, or bank account details. We do not collect special category data (health, ethnicity, religion, etc.). We do not knowingly collect data from anyone under 18.

3. How We Use Your Data

The two sections below describe how we used booking and plumber data while the consumer service was running. That service is paused and the data has since been deleted, so these uses are no longer active — we describe them here for transparency about what the service did while it ran. Business-contact, questionnaire, and waitlist data is used as described in Section 2.

For customers (service paused)

• To process your booking and dispatch a verified plumber to your address
• To process payment and issue a payment confirmation
• To send you SMS or email updates about your booking status
• To share your name, address, and phone number with the assigned plumber so they can attend the job
• To handle disputes, complaints, and refund requests
• To detect and prevent fraud
• To comply with our legal and regulatory obligations

For plumbers (service paused)

• To verify your Gas Safe registration and professional credentials
• To create and manage your plumber account
• To dispatch jobs to you and share customer contact details for confirmed bookings
• To calculate and record your earnings and platform fees
• To communicate platform updates, policy changes, and support

4. Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing personal data. We rely on the following:

• Contract performance (Article 6(1)(b)): Processing your firm's contact and billing details is necessary to provide the 24Plumb Pro subscription you have taken out, and to take steps at your request before that contract begins. This basis also covered the name, address, phone and email of consumer booking customers while that service was running.
• Legal obligation (Article 6(1)(c)): We are required to maintain financial records for HMRC purposes, and were required to verify plumber credentials while the consumer service was running.
• Legitimate interests (Article 6(1)(f)): We process technical data (IP addresses, usage logs) to maintain the security and performance of our platform, prevent fraud, and improve our service. We have assessed that these interests do not override your rights.
• Legitimate interests (Article 6(1)(f)) — business-to-business marketing: we contact UK plumbing and heating businesses (and, on the same footing, agencies that serve them) about our software — by email, by live telephone call and occasionally by post. We only contact corporate subscribers (limited companies and LLPs), never sole traders or unincorporated partnerships, which is what PECR requires of us. One legitimate interests assessment covers all three channels, including the call recording described in Section 5; we have carried it out and documented it, and will share it if you ask. How to make sure we never contact you again: reply "STOP" or "unsubscribe", say so on a call, or email us — any words aimed at the contact itself ("remove me", "don't email or call again", "how did you get my details", a complaint, or anything we can't be sure about) count. We honour it within 24 hours, permanently, across email, phone and post, and we never ask why. If you only decline the offer ("not interested", "no thanks", "we're fine", "we use something else"), we will do at most two things: send one short human reply in the same thread or call, with no further pitch, and, after 12 months, approach you once more only if we have something genuinely new to say. A second decline is treated as "stop". If a reply could be read either way, we treat it as "stop".

5. Sales Calls to Limited Companies, and Call Recording

Alongside email, we make a small number of live sales calls to UK plumbing and heating firms to tell them about 24Plumb Pro. This section explains who we call, why, and what happens to the recording.

Who we call, and who we don't

• Only limited companies and LLPs found on the public Companies House register, whose business phone number is published by the firm itself. We never call sole traders, unincorporated partnerships, or personal numbers.
• Screened against the CTPS. Before any number is dialled we check it against the Corporate Telephone Preference Service. If a firm is registered, we do not call it.
• Never anyone who has asked us not to. If you have told us to stop — by email, on a call, or in any words aimed at the contact itself — your firm is on our permanent suppression list and is never dialled. If you declined the offer on a call, we ask whether you mind one line if something changes; "rather not" goes on the same list the same day. We make at most three attempts on different days to reach a person; after that we stop.
• Caller ID is always shown. We call from a UK business number that you can ring back, and we tell you we are calling from 24Plumb at the start of the call. We do not withhold or disguise our number.

Why we call, and our legal basis

The purpose is to offer our software to the business. Our legal basis is our legitimate interests (Article 6(1)(f)), the same basis as our business-to-business email, and we have assessed and documented it — ask and we'll share the assessment. Under PECR, live marketing calls to corporate subscribers are permitted provided we do not call firms that are CTPS-registered or have told us not to, and we show our number: we do all three.

Call recording

Answered calls are recorded, and we tell you so at the start of the call. If you would rather not be recorded, say so and we will stop recording or end the call — your choice. We record calls so that we can review how we explain the product and what concerns firms raise, and so we have an accurate record of what was said and agreed. Recordings are:

• never shared with anyone outside 24Plumb Ltd, and never used in marketing — no clips, no quotes, no testimonials drawn from them;
• never used to take payment. We do not take card or bank details by voice, on any call;
• made by Twilio, our telephony provider, which stores the audio in the United States as our data processor under its Data Processing Addendum (see Sections 6 and 7);
• transcribed by us, on our own equipment — the audio is not sent to any other company to be transcribed;
• analysed only in de-named form. To understand the concerns firms raise, we may have the transcript — with personal names already removed — summarised and categorised by an AI model (Anthropic's Claude, see Section 6). The audio itself is never sent to Anthropic.

What we keep, and for how long

• Audio recordings: deleted 30 days after the call.
• Transcripts: kept for 12 months, labelled with the firm's name only. We remove personal names before filing them.
• Call log (firm, number dialled, date, outcome): 24 months, after which only totals with no personal data are kept. See Section 8.
• "Do not call" requests: kept indefinitely on our suppression list, for the sole purpose of making sure we never call you again.

Your rights on calls

You can object at any time, during the call or afterwards — "don't call again" is enough — and we will not contact you again by any channel: we add your firm to the suppression list within 24 hours. Declining the offer is handled as described in Section 4: one human reply at most, one re-approach after 12 months at most, and a second decline means stop. You can also ask for a copy of the recording or transcript of a call you took part in, or ask us to delete it early. Email contact@24plumb.com; the full list of your rights is in Section 9.

6. Third-Party Services and Data Processors

We share your data only with trusted processors who are contractually bound to handle it securely and only for the purposes we specify:

Stripe (Payment Processing) — United States

We use Stripe to process payments and subscriptions. When you enter payment card details, they go directly to Stripe's servers and are never seen or stored by 24Plumb. Stripe is PCI-DSS Level 1 certified and processes data in the United States. See Section 7 for the safeguards covering this transfer. Stripe's privacy policy is available at stripe.com/gb/privacy.

Google LLC — Firebase and Google Cloud (Cloud Infrastructure) — United States

Our website, our database, and our server functions all run on Google Firebase and Google Cloud. Everything we hold is stored in Google's US multi-region ("nam5" — data centres in Iowa and Oklahoma), and our server functions run in Google's Iowa region ("us-central1"). There is no UK or EU copy of our data. Google acts as our data processor under the Firebase Data Processing and Security Terms. See Section 7 for the safeguards covering this transfer. Google's privacy policy: policies.google.com/privacy.

Google Workspace (Email) — United States

Our email runs on Google Workspace. If you email us, or we email you, that correspondence — your name, your business email address and whatever you write — sits in a Google mailbox. Google acts as our data processor for it. See Section 7 for the safeguards covering this transfer.

Instantly (Business-Email Sending Platform) — United States

Our business-to-business emails to plumbing and heating firms are sent through Instantly (instantly.ai), from two secondary domains that belong to 24Plumb Ltd — get24plumb.com and try24plumb.com — with the sender alex@ on each. Instantly holds, on our instruction only, the firm's name, its business email address, a first name where the firm has published one, and whether each email was sent, bounced or replied to. We send at most three emails to a firm; any reply stops the sequence, and replying "STOP" opts you out for good. We switch off open tracking and link tracking, so Instantly does not record whether you opened an email or clicked a link. Instantly processes data in the United States as our data processor under its Data Processing Addendum. See Section 7 for the safeguards covering this transfer.

Anthropic PBC (AI Replies, Drafting and Analysis) — United States

We use Anthropic's Claude API for three narrow tasks. For 24Plumb Pro, Claude writes the text replies that a firm's number sends to its callers (see "Callers and customers" in Section 2): the caller's messages and the conversation so far are sent to Anthropic to produce each reply, within the rules described there. For our own business, Claude drafts our replies to emails from firms, and summarises and categorises sales-call transcripts (with personal names already removed) so we can see which concerns come up most — for those two, a person reads and sends every reply. In every case the text is processed only for the duration of the request; we use Anthropic's commercial API under terms that do not allow our inputs or outputs to be used to train its models. Anthropic acts as our data processor under its Data Processing Addendum and processes data in the United States. See Section 7 for the safeguards covering this transfer. Call audio and lead lists are never sent to Anthropic.

Twilio Inc. (Telephony, Text Messaging and Call Recording) — United States

Twilio provides the phone numbers behind 24Plumb Pro and carries the missed-call text-backs and the text conversation between a firm's number and its callers (see "Callers and customers" in Section 2): it processes the caller's number, the content of each text and the call metadata (time, duration, outcome). Our outbound sales calls are also placed through Twilio, which records answered calls (see Section 5) and stores the recording in the United States for at most 30 days before we delete it. Twilio acts as our data processor under the Twilio Data Processing Addendum. See Section 7 for the safeguards covering this transfer. Twilio's privacy notice: twilio.com/legal/privacy.

Cloudflare, Inc. (Website Analytics) — United States

We also keep our own anonymous daily counters of page visits and button taps, processed by our server functions (Google Cloud, US). These counters set no cookies and store no IP addresses or any other personal data — only totals per day.

We use Cloudflare Web Analytics on our public pages to count visits. It sets no cookies and does not track you across sites, but your IP address is transmitted to Cloudflare in the United States in order to serve the request. Cloudflare acts as our data processor. See Section 7 for the safeguards covering this transfer.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

7. International Data Transfers

With one exception, all of the personal data we hold is stored in the United States. We are a UK company and the data controller, but our infrastructure provider, Google, stores our database in its US multi-region ("nam5" — Iowa and Oklahoma) and runs our server functions in Iowa ("us-central1"). Our payment processor (Stripe), our analytics provider (Cloudflare), our business-email sending platform (Instantly), our AI provider (Anthropic) and our telephony provider (Twilio, including call recordings) also process data in the United States. Your data is transferred outside the UK from the moment you submit it. There is no UK-hosted copy. The exception is the transcripts of recorded sales calls (Section 5), which we produce and keep ourselves on company equipment in the UK.

The United States is not covered by a general UK adequacy decision. Each of our processors is contractually bound to us under a data processing agreement that incorporates the European Commission's Standard Contractual Clauses for restricted transfers, as extended to the UK. You can read each one, or ask us for a copy:

• Google (Firebase / Google Cloud / Workspace): Firebase Data Processing and Security Terms and the Google Workspace Data Processing Addendum
• Stripe: Stripe Data Processing Agreement
• Cloudflare: Cloudflare Customer Data Processing Addendum
• Twilio: Twilio Data Protection Addendum
• Instantly: Instantly Data Processing Addendum — we hold a signed copy; email us for it
• Anthropic: Anthropic Data Processing Addendum (commercial API terms, no training on inputs or outputs)

To request a copy of the safeguards that apply to your data, or to ask where a specific piece of your data is held, email contact@24plumb.com and we will answer within one month.

8. Data Retention

We keep your data only as long as necessary for the purposes for which it was collected:

• Pro customer and subscription records: 6 years from the end of the accounting period they relate to, as required by HMRC company record-keeping rules.
• Pro onboarding and support correspondence: 24 months, or until you ask us to delete it.
• 24Plumb Pro callers' numbers, text conversations and missed-call logs (the data described under "Callers and customers" in Section 2): 12 months from the last message, or from the call, then deleted automatically by a nightly job. A booking request you confirmed is passed to the firm as its job record and is kept with the firm's account records above. If you replied STOP, your number stays on the suppression list below so the firm's number never texts you again.
• Booking records and payment information: 6 years from the end of the accounting period, as required by HMRC company record-keeping rules. In practice we hold none: the consumer service never took a completed booking or a payment.
• Plumber application data: the application records have been deleted and we hold none. (Had any been retained, the period would have been the duration of the plumber's account plus 2 years after closure.)
• Business-contact data (firms we've contacted about our software — name, address, number, email, source and contact status): 24 months from our last contact with you, then deleted. If you object or unsubscribe, we stop immediately and keep only the suppression entry — see below. If you only declined the offer, we keep the record for the same 24 months so that we know not to approach you more than once more.
• Send log and call log (dates, touches, outcomes): 24 months, after which only aggregate totals with no personal data are kept.
• Sales-call recordings: audio deleted 30 days after the call. Call transcripts: 12 months, filed by firm name with personal names removed, then deleted. See Section 5.
• Suppression list: kept indefinitely, on purpose. If you tell us to stop, we keep your email address — or, for calls, your firm's phone number — forever for the sole purpose of never contacting you again. Deleting it would mean you reappear in a future list and get emailed again — the opposite of what you asked for. It is never used for anything else.
• Email correspondence, including your replies to our outreach: 24 months from our last exchange, unless it relates to a contract or a payment, in which case the accounting retention above applies.
• Technical logs: 90 days.
• Founding-partner questionnaire and waitlist data: 12 months, or until the founding-programme decision is made, whichever is sooner, after which we delete the data of applicants we do not take forward. If you become a founding partner, we keep your contact details and the terms you reserved for the life of the partnership, plus 2 years.

When data is no longer required, we securely delete or anonymise it.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data. To exercise any of them, please contact us using the details in Section 12.

• Right of access: You may request a copy of the personal data we hold about you (a Subject Access Request). We will respond within one month.
• Right to rectification: You may ask us to correct inaccurate data.
• Right to erasure: You may ask us to delete your data. We will comply unless we are required to retain it for legal reasons (e.g. financial records).
• Right to restrict processing: You may ask us to pause processing of your data in certain circumstances.
• Right to data portability: You may request your data in a structured, machine-readable format.
• Right to object: You may object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
• Rights related to automated decision-making: We do not make solely automated decisions that significantly affect you.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Cookies and Tracking

We use the following cookies and browser storage:

• Session storage: We temporarily store your booking reference in your browser's session storage to populate the confirmation page. This is deleted when you close your browser tab.
• Local storage: For plumber portal users, we store your login state and PWA installation preferences in local storage.
• Firebase Authentication cookies: Firebase sets a session cookie to maintain your authenticated state in the admin and plumber portals.

We use Cloudflare Web Analytics, a cookieless, privacy-preserving analytics service, on our public pages. It sets no cookies and does not track you across sites. See Section 6 for how it handles your IP address.

Our public pages also send a first-party measurement signal to our own server that increments anonymous daily counters: which page event happened (for example, a page view or a button click), the campaign tag in the link you followed, and the domain name of the site that referred you, if any. It stores no cookies, no IP addresses, no device details, and nothing that identifies you.

We do not use advertising cookies, tracking pixels, or any third-party analytics other than Cloudflare Web Analytics, described above.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page. For material changes, we may notify you by email if you have an account. We encourage you to review this page periodically.

12. Contact Us