Effective date: 9 November 2026 · Version 2026-11-09.2
Who is responsible
Kyle Monrose, trading as UK Energy Toolkit is a UK sole trader and the controller for the personal information handled for this business. Contact: Kylemonrose@gmail.com. Correspondence address: Hamerton Road, Northfleet, Kent, DA11 9DX.
Information we handle
Our contact form holds your name, email address and message in your browser and opens your email application. It does not submit an enquiry to our website database. If you send that email, we receive it in our Gmail mailbox. Your mail provider also processes the message.
Stripe's embedded checkout collects the payment and contact information it requires, which can include your email, name, billing address and payment details. Card details are entered in Stripe's payment form, not our website form. We use payment status and purchase details to verify delivery; we do not store full card numbers in our application database.
Our private order records contain payment environment, checkout session ID, product, payment status, update time and revision. A separate event ledger contains event and session IDs and processing times. New checkout sessions also record your immediate-supply consent, acknowledgement, Terms acceptance, their version and the server-recorded time in Stripe session and payment metadata. These identifiers can be linked to a person through payment records.
A random purchase-access token is kept in session storage in the browser tab; its hash is attached to the Stripe checkout. This protects your download. A private download link expires after five minutes; that does not mean purchase records are deleted after five minutes.
Calculator entries stay in the page's browser state; our calculator code does not send them to a database. Information you enter into a downloaded workbook remains in your copy; the workbook delivery process does not upload that information back to us.
Why we use it
We use enquiry details to respond to your request and take steps at your request before a contract. We use purchase information to perform the contract, confirm payment and provide the correct workbook. Legitimate interests in preventing fraud, protecting downloads and resolving complaints support proportionate security and support processing. Legal obligations can require accounting records and responses to lawful requests. The digital-supply checkbox is consumer-contract consent, not permission for marketing or a substitute for a UK GDPR lawful basis.
Services involved
Lovable hosts this website and provides its Cloud database and private storage, using Supabase infrastructure. Stripe processes payments through the Lovable-managed payment connection. Our support mailbox is Gmail (Google). These services process information to provide hosting, payment, security or correspondence services; Stripe may also act as an independent controller for its own fraud, payment and regulatory purposes.
Our checkout enables Stripe’s merchant-of-record payment service: actual test and live checkout sessions have this enabled. Stripe (through Link) is the merchant of record for those transactions, processes refunds and handles payment disputes and transaction-level support. UK Energy Toolkit provides the workbooks and product support. The specific Stripe legal entity is identified in the transaction’s payment terms or invoice; we have not verified that entity for an individual completed sale. Stripe is not described solely as our processor. Please also read Stripe's privacy notice at https://stripe.com/privacy and Google's at https://policies.google.com/privacy.
Providers may process data outside the UK. Their published terms describe their locations and transfer safeguards. The project’s database connection is in the EU-central region; this does not establish the location of all hosting, storage, logs or backups. Stripe publishes a Data Processing Agreement and international-transfer mechanisms, including Standard Contractual Clauses and applicable Data Privacy Framework arrangements. Which safeguards apply to this seller and transaction must be confirmed against the applicable provider contracts; we do not claim UK-only storage. Hosting, Google/Gmail and payment-service locations and transfer arrangements still need the seller’s documented review.
Browser storage, cookies and diagnostics
The purchase token uses session storage, normally cleared when that tab's session ends; browser restore behaviour can vary. Stripe may use storage or cookies for payment security and its optional features. We have not added a marketing analytics service to the application. This is not a claim that hosting or payment providers set no cookies.
Website failures may be logged by the host and forwarded to Lovable diagnostics with error text, stack and page path. Providers can also receive connection information such as IP address and request metadata. In a fresh published-site browser check, Stripe set __stripe_mid (about one year), __stripe_sid (about 30 minutes) and m on m.stripe.com (about 400 days); the site also set __dpl (about one day). A preview checkout also set hCaptcha __cf_bm and __cflb cookies (about 30 minutes). These are observed lifetimes, not a claim about underlying data deletion or a complete inventory for every payment method. The published site exposes Lovable’s diagnostic event hook. Google Fonts requests go to Google, and the checkout can contact Google payment and hCaptcha services. The seller must confirm each purpose, provider retention and whether any optional storage/tracking requires consent; we do not describe all observed tracking as necessary.
Retention
The application currently has no automatic deletion schedule for order and event records. Support-email retention, payment-provider retention and hosting-log deletion periods have not been confirmed. Lovable Cloud documents one automatic database backup per day, retained for up to roughly 14 days; those backups contain database schema and data, not workbook files in storage. We have not inspected this project’s actual backup inventory or snapshot dates. A log search window is not evidence of a deletion period. We therefore cannot promise a specific deletion period or describe one as already implemented. The seller must document and implement periods appropriate to support, accounting, legal obligations and claims, and remove or anonymise information when no longer needed. Contact us about a specific record or deletion request.
Your rights and complaints
Depending on the circumstances, you may ask for access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent without affecting earlier lawful processing. Rights have exceptions, including records required by law. Contact our support email; we may need proportionate identity checks and will normally respond within one month, or explain a permitted extension.
You can complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113. You do not have to contact us first, although we welcome the chance to resolve concerns.