Privacy notice

Contact enquiry form

Where: /contact

Why: Receiving and replying to a question about the website, tools, content corrections, media or accessibility.

Stored: In our hosted database (contact_submissions). Records are sent through BYA's trusted application boundary; ordinary browser roles cannot directly read, change or delete them.

Fields

• name (as the visitor wishes to be addressed)
• email address
• telephone number (optional)
• enquiry category
• message (2,000 characters maximum)
• page the form was submitted from
• optional marketing consent, with timestamp
• privacy notice version
• random submission token

Keeping it: Kept for 12 months after the last meaningful contact about the enquiry, then deleted, subject to a genuine legitimate dispute or legal exception. Deletion is a documented manual review today; nothing is deleted automatically.

Marketing consent is a separate, optional tick box. It is unticked by default and never required.

Free resource request and download interest

Where: Free resource pages under /mortgages/resources/

Why: Recording a request for a free educational resource, and serving the file on screen where a configured file exists. Where no file exists the record is an expression of interest only.

Stored: In our hosted database (free_resource_requests). Records are sent through BYA's trusted application boundary; ordinary browser roles cannot directly read, change or delete them.

Fields

• email address
• first name (optional)
• product slug requested
• page the request came from
• optional marketing consent, with timestamp
• privacy notice version
• random request token

Keeping it: Where no marketing consent was given, kept for 90 days and then deleted or anonymised. Where you have separately opted in to marketing email, that consent record is kept while we rely on it. Deletion is a documented manual review today.

Marketing consent is a separate, optional tick box. It is unticked by default and never required.

Tool summary waiting list (public collection disabled)

Where: Not currently rendered anywhere on the public site

Why: The public waiting-list form for a possible future emailed summary of a tool result band has been disabled. No summary feature exists, no email address is collected through this surface today, and none is delivered. The database table and the historic rows in it are unchanged; this entry documents that the collection form itself is switched off.

Stored: In our hosted database (tool_summary_requests). Records are sent through BYA's trusted application boundary; ordinary browser roles cannot directly read, change or delete them.

Fields

• No fields are collected while this surface is disabled.

Keeping it: No new rows are created while the form is disabled. Any historic rows are kept for 90 days from capture, then deleted or anonymised as appropriate. Deletion is a documented manual review today.

First-party analytics events

Where: Whole site, only after analytics consent is actively accepted

Why: Understanding which pages and tools are used, so the site can be improved.

Stored: In our hosted database (analytics_events). Records are sent through BYA's trusted application boundary; ordinary browser roles cannot directly read, change or delete them.

Fields

• event name
• page path
• content type label
• tool name label
• result band label
• random rotating session label (not derived from any personal data)
• consent version

Keeping it: Kept for up to 14 months in identifiable or pseudonymous form, then deleted or irreversibly anonymised. Analytics remains consent-gated, so nothing is recorded at all unless you accept it.

Readiness checker answers

Where: /mortgages/tools/readiness-checker

Why: Letting a visitor pause and return to the educational checker without starting again. Answers are broad preparation choices only.

Stored: In your own browser only. It is never transmitted to us.

Fields

• one of four broad answers per question (organised / partly / not yet / not sure)
• which step the visitor reached

Keeping it: Stored only in the visitor's own browser until they clear it or select 'Start again'. The publisher never receives it.

Calculator, checklist and timeline inputs

Where: LTV calculator, document checklist builder, application timeline

Why: Producing an on-screen educational result.

Stored: Nowhere. The values exist only in your open browser tab.

Fields

• figures or selections typed by the visitor for that calculation only

Keeping it: Discarded as soon as the page is closed or reloaded. Never stored or transmitted.

Save Plan and My Plan (saved preparation plan)

Where: Save Plan from the New Job & Probation preparation check, the /resume sign-in handover, and the signed-in /plan page

Why: Continuity you asked for: keeping the preparation plan you chose to save so you can sign in later and pick up where you left off.

Stored: In our hosted database (Supabase Auth identity, pending_plan_saves for the short-lived handover, and homebuyer_plans with related plan fact/action/derived-state tables for the durable saved plan). Account-based permissions control access to the saved plan; when signed in, you can view it and delete the plan and sign-in from your plan page.

Fields

• the email address you give, used by our hosted authentication service to sign you in
• the categorical employment-preparation answers you explicitly chose to save (broad options only)
• which nation of the UK you are buying in
• the preparation state and action codes worked out from those answers
• tool name and version labels, and created/updated timestamps
• a short-lived handover record for completing the save, holding the pending answers, a hashed one-time token and system record identifiers
• only if you have already accepted analytics cookies: the coarse first-touch labels for how the visit began (channel category such as organic search or direct, any campaign labels in the link you arrived on, and the site page the save was started from), linked to the saved plan

Never included

• No full web address you came from, no referring website address and no search terms
• No question wording, message text or anything else you typed, and no advertising identifier
• No acquisition labels at all if you have not accepted analytics cookies
• No salary, income or any other figure
• No employer name
• No exact dates
• No banking or payment details
• No credit-report content or credit score
• No uploaded documents
• No health or other special-category information

Keeping it: Your saved plan and your sign-in are kept for 24 months after genuine inactivity, and you can delete them yourself from the plan page at any time before that. Any consent-gated first-touch acquisition labels are held on the same plan record, are recorded once only and are never overwritten by a later save, and they are deleted when you delete the plan. A `last_activity_at` inactivity signal and a separated retention-purge capability are being added to the system; automated inactivity deletion is scaffolded but is not yet running, so today deletion of an inactive plan still depends on manual review or your own self-service deletion. The short-lived handover record cannot be used after 60 minutes, the saved answers in it are wiped as soon as the save completes successfully, and a database job removes expired or already-consumed handover records on a 15-minute cadence, which continues to run.

Paid plan purchase and entitlement (New Job & Probation Mortgage Prep Plan)

Where: Checkout for the paid plan, when public checkout is switched on

Why: Taking payment for the one-off paid plan, recording the order, and granting time-limited entitlement to the paid content.

Stored: In our hosted database (order / entitlement records (created only once public checkout is switched on)). Account-based permissions control access to the saved plan; when signed in, you can view it and delete the plan and sign-in from your plan page.

Fields

• email address associated with the sign-in / order
• product identifier and price paid
• order status and timestamps
• entitlement start date and expiry date (12 months after grant)
• Stripe's own reference for the payment (no card details ever reach our systems or database)
• purchase terms and digital-content consent versions accepted, with timestamp

Keeping it: The order and accounting record is kept for the applicable legal and tax retention period, and that record is never deleted just because paid access to the plan itself expires after 12 months. Failed or abandoned checkout records, where stored, are kept for 30 days unless a completed order or another legal exception applies.

Basis: Legitimate interests

The person contacts us and asks for a reply, so replying is what they expect and want, and doing so is necessary to handle the enquiry. There is no reply-consent tick box on the form: ordinary replies are never presented as consent-based.

Still to do: A necessity and balancing assessment must be written up and reviewed as part of the outstanding independent data-protection review.

Basis: Steps taken at the request of the individual for the free resource they asked for; legitimate interests only where that is genuinely the better fit

The person actively asks for a specific free educational resource, and the record exists to answer that request. This is not marketing consent, and it must never be treated as one: any marketing email is a separate, optional, unticked consent.

Still to do: Confirm in the independent review whether request-based processing or legitimate interests is the correct framing for a free, no-contract resource.

Basis: Deliberately not stated yet, because it is genuinely unsettled.

The public form for this waiting list is disabled, so nothing is currently collected under this heading. Any historic rows remain governed by whatever basis applied at the time; that basis was never finally settled.

Still to do: Settle the basis for any historic rows in the independent review, or before this surface is ever re-enabled.

Basis: Legitimate interests

Rate-limiting, duplicate-submission checks, honeypot fields and Cloudflare Turnstile protect the site and its public forms from automated abuse and flooding. Turnstile is used only as a security control, not for advertising or marketing.

Basis: Consent

Marketing is a separate, optional, unticked choice that can be withdrawn at any time, and it is never bundled with an enquiry or resource request.

Basis: Consent

Nothing is recorded and no request is made to Google before analytics consent is actively granted, and withdrawal stops further analytics. Analytics storage stays denied by default.

Basis: Legitimate interests

The person explicitly asks us to save their preparation plan and to create the sign-in that lets them return to it. Providing that continuity, and deleting or expiring it after genuine inactivity, is a legitimate interest balanced against the person's own right to delete the plan at any time. It is not marketing consent.

Still to do: A written necessity and balancing assessment for this basis is still to be completed in the outstanding independent data-protection review.

Basis: Contract

Processing the payment and delivering the paid plan is necessary to perform the purchase contract the buyer enters into. Stripe processes the payment itself as our payment processor.

Basis: Legal obligation

Statutory tax and accounting rules require certain sales records to be kept for a defined period, independent of when paid access to the plan itself expires.

Basis: Legitimate interests

Detecting and investigating failed payments, checkout errors and abuse of the checkout flow is necessary to run a working, secure payment process.

How long: 12 months after the last meaningful contact about the enquiry

Then: Deleted, subject to a genuine legitimate dispute or legal exception.

How long: 90 days

Then: Deleted, or anonymised where an anonymised record is all that is still needed.

How long: Not collected today — the public form is disabled

Then: No new rows are created. Any historic rows are kept for 90 days from capture, then deleted or anonymised.

How long: Kept while the subscription is active

Then: On unsubscribe or withdrawal of consent, removed from active marketing, keeping only the minimal suppression/consent-evidence record needed to respect the opt-out.

How long: 3 years after withdrawal of consent or the end of reliance on it

Then: Deleted, keeping the minimum evidence needed to show the consent was validly given and later withdrawn.

How long: 14 months in identifiable or pseudonymous form

Then: Deleted or irreversibly anonymised. Analytics is only ever recorded after explicit consent.

How long: 24 months after genuine inactivity, with earlier self-service deletion available at any time

Then: Deleted on request, by the person's own self-service deletion from the plan page, or by automated inactivity deletion once that runs. A `last_activity_at` inactivity signal and a separated retention-purge capability are being added; automated inactivity deletion is scaffolded but not yet running, so today an inactive plan still relies on manual review or self-service deletion. The short-lived handover record is unusable after 60 minutes, its answers are wiped on a successful save, and a database job removes expired or already-consumed handover records on a 15-minute cadence, which continues to run.

How long: 3 years after the request is closed

Then: Deleted, keeping only the minimal audit record of the request and its outcome. Copies of identity documents are not retained.

How long: The applicable legal and tax retention period

Then: Kept separately from preparation-content deletion. The expiry of paid access to the plan after 12 months never deletes the underlying order or accounting record.

How long: 30 days

Then: Deleted, unless a completed order or another legal exception applies.

Database processor for enquiry, resource-request, waiting-list, analytics, order/entitlement records, and the hosted authentication and saved-plan store behind Save Plan and My Plan.

Data involved: Name, email address, optional telephone number, enquiry text, consent records, analytics events, order/entitlement records, the sign-in identity created for Save Plan, and the categorical saved preparation plan linked to it.

Processing terms: Data processing terms for this database provider have not been separately re-verified for this note.

Where: London, UK (eu-west-2) — verified for the production database.

Security and abuse-prevention service for the public contact form. The browser obtains a Turnstile token and BYA's trusted server validates that token with Cloudflare Siteverify before accepting the enquiry. Cloudflare's Turnstile Privacy Addendum says Cloudflare is a processor for Signals used to protect customer websites and a controller for Signals it uses to improve Turnstile's bot-detection capabilities.

Data involved: Turnstile security Signals associated with the visitor, device and browser that are necessary to distinguish humans from automated traffic, plus the challenge token and validation metadata. BYA's Siteverify request does not send the enquiry name, email address, telephone number or message to Cloudflare.

Processing terms: Cloudflare Customer Data Processing Addendum version 6.4, effective 3 April 2026, applies where Cloudflare processes personal data as a processor on behalf of a customer. Cloudflare's Turnstile Privacy Addendum separately describes its processor and controller roles for Turnstile Signals.

Where: Cloudflare operates a global service. BYA has not yet mapped the deployment-specific Turnstile processing and sub-processor locations, so that remains to verify.

Domain registration, public mailbox and production Node hosting for before-you-apply.com. The public website runtime is deployed to Hostinger from BYA's Production branch; the application database remains the separate Supabase production project.

Data involved: Email correspondence sent to and from the public mailbox, plus ordinary web-hosting request/runtime data processed when visitors use the public site. Application records are stored in the separate Supabase production database rather than intentionally being used as a Hostinger application-data store.

Processing terms: Provider hosting/mailbox processing terms have not yet been separately re-verified for this note.

Where: Deployment-specific hosting/logging processing locations and retention remain to verify; no unsupported location claim is made here.

Business-address and postal handling for the correspondence address published in this notice.

Data involved: Physical mail addressed to the published business correspondence address.

Processing terms: Provider terms not separately verified for this note.

Where: United Kingdom.

Consent-gated third-party analytics, stream G-FGC8H43MHT loaded directly. No Google Tag Manager container is loaded at runtime.

Data involved: Categorical events and Google's own analytics identifiers only, after consent. No name, email, free text, figures or raw checker answers.

Processing terms: Google's standard analytics terms apply. Not separately reviewed by or for the operator.

Where: Google processing locations not verified in project records.

Payment processor for paid purchases of the plan, when public checkout is switched on. Handles card details directly; no card details reach our own systems or database.

Data involved: Payment details, billing email address and order amount, processed by Stripe directly at checkout.

Processing terms: Stripe's standard processor terms apply. Not separately reviewed by or for the operator.

Where: Stripe's own processing locations not verified in project records.

Not active. A paid-order confirmation email is being built, but it stays configuration-gated and disabled today: no order confirmation email is sent.

Data involved: None today.

Processing terms: Not applicable until a provider is actually engaged and the feature is switched on.

Where: Not applicable.