Privacy Policy

LAST UPDATED: 18 September 2026

This policy is a genuine, substantive starting point covering what Aeriva actually collects and how it's used - but it isn't a substitute for review by a qualified solicitor, particularly before onboarding customers at scale. UK GDPR compliance depends on your specific business setup and should be checked properly, not assumed from a template.

Who we are

Aeriva is a heat pump survey, design and quoting platform for heating engineers and installers. This policy explains what personal data we collect, why, and what your rights are, whether you're an Aeriva account holder or a customer whose details have been entered into the platform by an installer using it.

What we collect

Account data, when you register: your name, email address, and a securely hashed password.

Project and customer data, which you enter as part of using the platform: your customers' names, addresses, postcodes, phone numbers, email addresses, and details about their property and heating system gathered during a survey.

Technical data: IP address, browser type, and basic usage logs, collected automatically for security and to keep the service running reliably.

How we use it

To provide the core service - storing your projects, running heat loss calculations, generating proposals and documents
To look up Energy Performance Certificate data from the UK government's EPC register, when you use the EPC Lookup feature on a property you specify
To identify radiators from photos using AI image analysis (Google Gemini), when you use Smart Radiator Capture
To send account-related emails (password resets, service notices)
To maintain security and prevent misuse of the service

Third parties we share data with

We don't sell personal data. Data is shared with the following third parties only as needed to provide the features you use:

UK Government EPC register - a postcode you search is sent to look up certificate data. No customer data is sent beyond the postcode/address searched.
Google (Gemini AI) - photos you upload for radiator identification are processed by Google's AI service to return analysis results. Photos are sent for this specific purpose only.
Our email provider - used solely to deliver account emails such as password resets.
Our hosting provider - stores the application and its database.

Some of these third parties may process data on servers outside the UK. Where that happens, it's on the basis of the third party's own standard safeguards for international transfers.

How long we keep data

Account and project data is retained for as long as your account is active. If you close your account, we'll delete your data within a reasonable period, except where we're required to keep records for legal or accounting reasons.

Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Have inaccurate data corrected
Request deletion of your data ("right to be forgotten")
Object to or restrict certain processing
Receive your data in a portable format

To exercise any of these rights, contact us using the details below. If you're a customer whose details were entered by an installer using Aeriva, the installer is the data controller for that information - contact them directly, or contact us and we'll help direct your request.

Security

We use industry-standard measures to protect data, including encrypted password storage and encrypted storage of sensitive API credentials. No system is completely immune to risk, but we take reasonable steps to keep data secure.

Cookies

Aeriva uses essential cookies only - to keep you logged in and to protect against cross-site request forgery. We don't use tracking or advertising cookies.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated via the platform or by email.

Contact

Questions about this policy or your data can be sent to hello@aeriva.co.uk.