Privacy Policy
VentCalc · Last updated: September 2026 · UK GDPR compliant
1. Who We Are
VentCalc ("we", "us") operates the ventilation calculation tool at ventcalc.ai. We are the data controller for personal data processed through this Service.
VENTCALC LTD
Company No. 17123275
Registered in England and Wales
Registered office: 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Contact: info@ventcalc.ai
2. What Data We Collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email address (used to sign in via a one-time code); IP address hash, used only for beta abuse/rate-limit prevention, not for identification | Sign-in, one-free-analysis entitlement |
| Usage data | Pages visited, actions taken | Service improvement |
| Technical data | IP address, browser type, device | Security, performance |
| Uploaded drawings | Floor plans, M&E drawings (images/PDF) | Automated analysis to pre-fill form |
| Project inputs | Floor area, room counts, system type | Calculation engine |
| Upload audit record | Email, company name (if provided), drawing filename, detected project type, and drawing-interpretation metadata (rooms/areas/confidence, integrity-check results) — not the drawing file itself | Service delivery, quality monitoring, abuse prevention |
We collect your email address to provide sign-in via a one-time code and to apply the one-free-analysis-per-email beta entitlement. We do not require your name, and we do not collect payment details — VentCalc does not currently process any payments (see Section 4).
3. Legal Basis (UK GDPR Art. 6)
- Art. 6(1)(b) — Contract: Processing necessary to provide the Service you have requested (sign-in, drawing analysis, report generation)
- Art. 6(1)(f) — Legitimate interests: Fraud prevention, security, service improvement
- Art. 6(1)(a) — Consent: Analytics cookies (where consent is given)
4. How We Process Your Data
Sign-in uses Supabase Authentication with a one-time 8-digit email code (no password). Supabase stores your email address and manages the authentication session; we store your email, a count of free analyses used, and (if applicable) a Stripe customer reference in our own account record.
Uploaded drawings, depending on file type and processing path, may be sent to OpenAI (GPT-4o) and/or Anthropic (Claude) for automated analysis. They are processed in-memory and are not stored on our servers after the analysis response is returned. We do not retain drawing files.
Calculation inputs (floor area, room types, system selection) are processed server-side to generate results. Results are returned to your browser and stored temporarily in your browser session (sessionStorage) for the duration of your visit.
Draft progress is saved to your device's localStorage only — it is never uploaded to our servers. You can delete your saved draft or turn off draft saving at any time using the controls on the home screen. Drafts remain on your device until you delete them or clear your browser data.
Upload audit record: for each analysis, we record your email, company name (if provided), the drawing's filename, detected project type, and summary drawing-interpretation metadata (e.g. rooms/areas detected, confidence level, integrity-check results) for service delivery, quality monitoring and abuse prevention. This record does not include the drawing file itself. No fixed automatic deletion schedule is currently configured for this record — see Section 6.
Operational monitoring: a summary of each analysis (including your email, the drawing filename, and the outcome of automated integrity checks) may be sent to an internal Discord channel used by VentCalc staff to monitor service quality and investigate faults. This is not shared outside VentCalc.
Payment data: VentCalc does not currently process any payments. The Service is in beta, offering one free drawing analysis per verified email with no payment required. If paid access is introduced later, payment card details will be handled entirely by Stripe and this policy will be updated first.
5. Automated Processing & Your Data
VentCalc uses automated analysis models to assist with drawing interpretation and calculation support. The following applies:
- Processing is automated — outputs are generated based on your inputs and assumptions
- Depending on file type and processing path, uploaded drawings may be passed to Anthropic (Claude) and/or OpenAI (GPT-4o) solely for extraction purposes, under each provider's standard API terms
- We do not have a confirmed enterprise agreement or bespoke training opt-out with either provider beyond their standard API terms of service; if you require assurance on data training/retention for a specific project, please contact us before uploading
- No guarantee is made of the accuracy, completeness, or suitability of automatically extracted data for specific projects
- All outputs are indicative and intended for early-stage feasibility and design support only
You should not upload drawings that contain sensitive personal data (names, addresses, occupier information) beyond what is necessary for ventilation sizing purposes.
6. Data Retention
| Data type | Retention period |
|---|---|
| Uploaded drawings | Not retained — in-memory processing only |
| Calculation results | Browser session only (cleared on tab close) |
| Draft progress | Your device only (localStorage) — never uploaded. Deleted when you clear it or your browser data. |
| Account record (email, free-analysis count) | Retained for as long as your account exists. No automatic deletion schedule is currently configured — contact us to request erasure (Section 10). |
| Upload audit record (email, filename, drawing-interpretation metadata) | Retained indefinitely at present — no automatic deletion schedule is currently configured. This is flagged for review; contact us to request erasure. |
| Hosting/infrastructure logs (Vercel, Supabase) | Governed by each provider's own default log-retention policy — not independently configured or verified by us |
7. Cookies & Analytics
We use essential cookies required for the Service to function (session state, payment flow). We do not load analytics or tracking scripts without your explicit consent.
On your first visit a cookie banner is shown. Analytics scripts load only if you click Accept all. If you click Reject, no analytics scripts are loaded or executed during that visit or future visits.
| Service | Purpose | Legal basis | Loaded without consent? |
|---|---|---|---|
| Session cookies (Supabase) | Authentication — keeps you signed in | Art. 6(1)(b) — Contract | Yes — essential |
| Google Analytics 4 (G-LKHF9LP77R) | Page views, session data, feature usage | Art. 6(1)(a) — Consent | No |
| Microsoft Clarity (xblze8qohb) | Session recordings, heatmaps | Art. 6(1)(a) — Consent | No |
Your consent choice is stored in your browser's localStorage under the key vc_consent. You can withdraw consent at any time by clearing your browser's localStorage or site data, which will cause the banner to reappear on your next visit.
8. Third-Party Services
- Supabase — authentication (email one-time-code sign-in) and account/database storage. Supabase Privacy Policy
- Anthropic — drawing analysis (Claude), depending on file type and processing path. Processed under Anthropic's standard API terms; we do not currently have a confirmed enterprise agreement or bespoke training opt-out beyond those terms.
- OpenAI — drawing analysis (GPT-4o), depending on file type and processing path. Processed under OpenAI's standard API terms; we do not currently have a confirmed enterprise agreement or bespoke training opt-out beyond those terms.
- Vercel — hosting and infrastructure. May log anonymised request metadata.
- Discord — internal operational monitoring only (not user-facing). Receives a summary of each analysis (email, drawing filename, integrity-check outcome) so VentCalc staff can monitor service quality and investigate faults.
- Google Analytics 4 (Google LLC) — analytics, loaded only with consent. Google Privacy Policy
- Microsoft Clarity (Microsoft Corp) — session recording and heatmaps, loaded only with consent. Microsoft Privacy Statement
VentCalc does not currently use Stripe or any other payment processor — no payments are collected during the beta (see Section 4).
Each third party operates under its own privacy policy. Except where an enterprise agreement is explicitly stated above, processing is under each provider's standard terms of service.
9. Security
We implement appropriate technical and organisational measures to protect personal data, including TLS encryption for all data in transit, restricted access to infrastructure, and in-memory-only processing of uploaded drawings.
No internet transmission is completely secure. If you have concerns about a specific data security matter, contact us at info@ventcalc.ai.
10. Your Rights (UK GDPR)
You have the right to:
- Access personal data we hold about you
- Rectification of inaccurate data
- Erasure ("right to be forgotten") where applicable
- Restriction of processing in certain circumstances
- Data portability where technically feasible
- Object to processing based on legitimate interests
To exercise any right, contact: info@ventcalc.ai
You also have the right to lodge a complaint with the ICO (Information Commissioner's Office) at ico.org.uk.
11. Changes to This Policy
We may update this policy periodically. Continued use of the Service after changes are posted constitutes acceptance. Material changes will be clearly indicated.