Privacy Policy

24Plumb Ltd  ·  Last updated: 15 July 2026  ·  Effective: 19 May 2026

1. Who We Are

24Plumb Ltd ("24Plumb", "we", "us", "our") builds software for plumbing and heating firms — 24Plumb Pro, at 24plumb.com. We are not a consumer plumber-booking service and we do not dispatch plumbers. We are the data controller for personal data collected through this website.

24Plumb previously operated a consumer emergency plumber booking service. That service is paused and we are not taking consumer bookings. This policy still describes the personal data that service collected, but we no longer hold it: no booking was ever completed, and the records of plumbers who began an application have been deleted. Your rights in Section 8 continue to apply to any personal data we do hold.

We are registered in England and Wales. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller for the personal data we process about you.

We are registered with the Information Commissioner's Office (ICO). Our ICO registration number is ZC161578.

2. Data We Collect

From customers who made a booking (service paused)

We are not collecting this data, and we hold no booking-customer records — the consumer service never took a completed booking. For transparency, these are the categories the service was designed to collect from a booking customer:

• Identity data: full name
• Contact data: phone number, email address
• Location data: full service address including postcode
• Job data: description of the plumbing problem, urgency level
• Financial data: payment amount, Stripe payment intent ID (your card number is processed directly by Stripe and is never transmitted to or stored by 24Plumb)
• Technical data: IP address, browser type, and referring page (collected automatically by Firebase Hosting)

From plumbers who applied to join the platform (applications closed)

We are not accepting applications. The records of the plumbers who began an application have since been deleted, so we no longer hold this data. For transparency, these are the categories collected during the (now paused) application process:

• Identity data: full name
• Contact data: phone number, email address
• Professional data: Gas Safe registration number, public liability insurance status, areas of operation, home postcode
• Account data: Google account ID (used for authentication)

Business contacts

We process limited business-contact data — firm name, business email or phone number, and director name where published — about UK trade businesses and agencies. This data comes from the public Companies House register and firms' own public websites. We process it under our legitimate interests (Article 6(1)(f)) to send relevant business-to-business communications. If you object, we honour it within 24 hours and add your details to a permanent suppression list. We retain this data only while it remains relevant, or until you object.

Founding-partner questionnaire and waitlist

• Business data: agency name, website
• Contact data: contact name, business email
• Questionnaire data: your answers to our founding-partner questionnaire

We use this data solely to evaluate and operate the founding-partner programme. Our legal basis is our legitimate interests (Article 6(1)(f)) and, where you have asked to join the programme, steps taken at your request prior to entering into a contract (Article 6(1)(b)).

From 24Plumb Pro customers and founding members

• Identity data: your name
• Business data: your firm's name
• Contact data: business email address, business phone number
• Financial data: subscription status, Stripe customer ID and payment records (your card details go directly to Stripe and are never seen or stored by 24Plumb)
• Onboarding data: the setup details and answers you send us after signing up

We use this data to provide and bill the 24Plumb Pro subscription, to support you, and to keep our statutory accounting records. Our legal basis is contract performance (Article 6(1)(b)) and, for our accounting records, legal obligation (Article 6(1)(c)).

Data we do not collect

We do not collect card numbers, sort codes, or bank account details. We do not collect special category data (health, ethnicity, religion, etc.). We do not knowingly collect data from anyone under 18.

3. How We Use Your Data

The two sections below describe how we used booking and plumber data while the consumer service was running. That service is paused and the data has since been deleted, so these uses are no longer active — we describe them here for transparency about what the service did while it ran. Business-contact, questionnaire, and waitlist data is used as described in Section 2.

For customers (service paused)

• To process your booking and dispatch a verified plumber to your address
• To process payment and issue a payment confirmation
• To send you SMS or email updates about your booking status
• To share your name, address, and phone number with the assigned plumber so they can attend the job
• To handle disputes, complaints, and refund requests
• To detect and prevent fraud
• To comply with our legal and regulatory obligations

For plumbers (service paused)

• To verify your Gas Safe registration and professional credentials
• To create and manage your plumber account
• To dispatch jobs to you and share customer contact details for confirmed bookings
• To calculate and record your earnings and platform fees
• To communicate platform updates, policy changes, and support

4. Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing personal data. We rely on the following:

• Contract performance (Article 6(1)(b)): Processing your firm's contact and billing details is necessary to provide the 24Plumb Pro subscription you have taken out, and to take steps at your request before that contract begins. This basis also covered the name, address, phone and email of consumer booking customers while that service was running.
• Legal obligation (Article 6(1)(c)): We are required to maintain financial records for HMRC purposes, and were required to verify plumber credentials while the consumer service was running.
• Legitimate interests (Article 6(1)(f)): We process technical data (IP addresses, usage logs) to maintain the security and performance of our platform, prevent fraud, and improve our service. We have assessed that these interests do not override your rights.
• Legitimate interests (Article 6(1)(f)) — business-to-business marketing: we contact UK plumbing, heating and agency businesses about our software. We only contact corporate subscribers (limited companies and LLPs), never sole traders or unincorporated partnerships, which is what PECR requires of us. We have carried out and documented a legitimate interests assessment; ask and we'll share it. You can opt out at any time by replying "unsubscribe" or emailing us, and we honour opt-outs within 24 hours and add you to a permanent suppression list so you are never contacted again.

5. Third-Party Services and Data Processors

We share your data only with trusted processors who are contractually bound to handle it securely and only for the purposes we specify:

Stripe (Payment Processing) — United States

We use Stripe to process payments and subscriptions. When you enter payment card details, they go directly to Stripe's servers and are never seen or stored by 24Plumb. Stripe is PCI-DSS Level 1 certified and processes data in the United States. See Section 6 for the safeguards covering this transfer. Stripe's privacy policy is available at stripe.com/gb/privacy.

Google LLC — Firebase and Google Cloud (Cloud Infrastructure) — United States

Our website, our database, and our server functions all run on Google Firebase and Google Cloud. Everything we hold is stored in Google's US multi-region ("nam5" — data centres in Iowa and Oklahoma), and our server functions run in Google's Iowa region ("us-central1"). There is no UK or EU copy of our data. Google acts as our data processor under the Firebase Data Processing and Security Terms. See Section 6 for the safeguards covering this transfer. Google's privacy policy: policies.google.com/privacy.

Google Workspace (Email) — United States

Our email runs on Google Workspace. If you email us, or we email you, that correspondence — your name, your business email address and whatever you write — sits in a Google mailbox. Google acts as our data processor for it. See Section 6 for the safeguards covering this transfer.

Cloudflare, Inc. (Website Analytics) — United States

We use Cloudflare Web Analytics on our public pages to count visits. It sets no cookies and does not track you across sites, but your IP address is transmitted to Cloudflare in the United States in order to serve the request. Cloudflare acts as our data processor. See Section 6 for the safeguards covering this transfer.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

6. International Data Transfers

All of the personal data we hold is stored in the United States. We are a UK company and the data controller, but our infrastructure provider, Google, stores our database in its US multi-region ("nam5" — Iowa and Oklahoma) and runs our server functions in Iowa ("us-central1"). Our payment processor (Stripe) and our analytics provider (Cloudflare) also process data in the United States. Your data is transferred outside the UK from the moment you submit it. There is no UK-hosted copy.

The United States is not covered by a general UK adequacy decision. Each of our processors is contractually bound to us under a data processing agreement that incorporates the European Commission's Standard Contractual Clauses for restricted transfers, as extended to the UK. You can read each one, or ask us for a copy:

• Google (Firebase / Google Cloud / Workspace): Firebase Data Processing and Security Terms and the Google Workspace Data Processing Addendum
• Stripe: Stripe Data Processing Agreement
• Cloudflare: Cloudflare Customer Data Processing Addendum

To request a copy of the safeguards that apply to your data, or to ask where a specific piece of your data is held, email contact@24plumb.com and we will answer within one month.

7. Data Retention

We keep your data only as long as necessary for the purposes for which it was collected:

• Pro customer and subscription records: 6 years from the end of the accounting period they relate to, as required by HMRC company record-keeping rules.
• Pro onboarding and support correspondence: 24 months, or until you ask us to delete it.
• Booking records and payment information: 6 years from the end of the accounting period, as required by HMRC company record-keeping rules. In practice we hold none: the consumer service never took a completed booking or a payment.
• Plumber application data: the application records have been deleted and we hold none. (Had any been retained, the period would have been the duration of the plumber's account plus 2 years after closure.)
• Business-contact data (firms we've contacted about our software): for as long as it stays relevant to us, and no more than 24 months from our last contact with you, then deleted. If you object or unsubscribe, we stop immediately and keep only the minimum needed to make sure we never contact you again — see the suppression note below.
• Suppression list: kept indefinitely, on purpose. If you tell us to stop, we keep your email address forever for the sole purpose of never contacting you again. Deleting it would mean you reappear in a future list and get emailed again — the opposite of what you asked for. It is never used for anything else.
• Email correspondence: 24 months from our last exchange, unless it relates to a contract or a payment, in which case the accounting retention above applies.
• Technical logs: 90 days.
• Founding-partner questionnaire and waitlist data: 12 months, or until the founding-programme decision is made, whichever is sooner, after which we delete the data of applicants we do not take forward. If you become a founding partner, we keep your contact details and the terms you reserved for the life of the partnership, plus 2 years.

When data is no longer required, we securely delete or anonymise it.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data. To exercise any of them, please contact us using the details in Section 11.

• Right of access: You may request a copy of the personal data we hold about you (a Subject Access Request). We will respond within one month.
• Right to rectification: You may ask us to correct inaccurate data.
• Right to erasure: You may ask us to delete your data. We will comply unless we are required to retain it for legal reasons (e.g. financial records).
• Right to restrict processing: You may ask us to pause processing of your data in certain circumstances.
• Right to data portability: You may request your data in a structured, machine-readable format.
• Right to object: You may object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
• Rights related to automated decision-making: We do not make solely automated decisions that significantly affect you.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

9. Cookies and Tracking

We use the following cookies and browser storage:

• Session storage: We temporarily store your booking reference in your browser's session storage to populate the confirmation page. This is deleted when you close your browser tab.
• Local storage: For plumber portal users, we store your login state and PWA installation preferences in local storage.
• Firebase Authentication cookies: Firebase sets a session cookie to maintain your authenticated state in the admin and plumber portals.

We use Cloudflare Web Analytics, a cookieless, privacy-preserving analytics service, on our public pages. It sets no cookies and does not track you across sites. See Section 5 for how it handles your IP address.

We do not use advertising cookies, tracking pixels, or any third-party analytics other than Cloudflare Web Analytics, described above.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page. For material changes, we may notify you by email if you have an account. We encourage you to review this page periodically.

11. Contact Us