Privacy Notice

Last updated: 5 October 2026

Who we are

Bruno Santos Covre & Angelo Paulo Vedova trading as Covre Vedova Home Services, operating in North West & South East London, United Kingdom. We are not an incorporated company. We are the data controller for your personal data.

If you have any privacy questions, please contact us at hello@covrevedova.co.uk.

Information we collect

When you request a quote, we collect the following personal data:

• Your name
• Your phone number
• Your email address
• Your postcode
• A free-text description of the work you need
• Optional photographs of the property

Why we collect your data

We collect this information to prepare a quotation and carry out the work requested. Our lawful basis for processing this data is taking steps at the customer’s request before entering into a contract, and our legitimate interests in running our business.

We do not use your data for marketing. We send no marketing email.

How we handle photographs

Photographs are stored in private storage and are viewed by the team through links that expire after five minutes. They are never published and never made publicly accessible.

How we use AI

Inside our internal admin area, we can ask an AI model from Google (Gemini) to help us handle your request in two ways: to point out what information is still missing before we can quote, and to draft a reply for one of us to edit and send. Both are started by hand, by Bruno or Angelo. Neither happens automatically when you submit the form.

When we do this, what is sent to Google is your name, the service you asked for, your postcode, the timing you asked for, how many photographs you attached, whether you asked for a phone call, and the description you wrote.

One of us works in Portuguese. When the admin area is set to Portuguese, the draft reply that has just been written is sent to Google once more, on its own, to be translated — so that whoever is about to reply can read it in their own language before sending it. That request carries only the draft itself, which normally contains your first name. The translation is for us to read and is never sent to you: the message you receive is always the English one.

The phone number and email address you gave us in the contact fields are not sent. Your photographs are not sent either — only how many there are. Google processes this on its own infrastructure, which may be outside the United Kingdom.

The description you wrote is sent exactly as you wrote it. We do not edit it or strip anything out of it first. If you typed a phone number, an address or anything else personal into that box, it is sent along with the rest of it.

We use the paid tier of Google’s API. On that tier, Google’s terms say it does not use prompts or responses to improve its products, and that it keeps them only for a limited period, to detect misuse of the service and to meet its own legal obligations.

If you would rather we did not send your request to the AI at all, say so anywhere in your description and we will handle it by hand. It costs you nothing and changes nothing about the quote.

No decision about you is made by the AI. What it writes is an internal note that one of us reads, and nothing it drafts reaches you until a person has read and approved it. It is never used to set a price.

Where your data is stored

Our database and file storage are hosted by Supabase in London (eu-west-2). The website runs on Vercel with functions in London (lhr1). Notification emails about new requests are sent to the owners from a Gmail account, so Google handles them, and are delivered to our business mailboxes, which are hosted by Zoho Mail in its EU data centre. Those emails carry the service, the first part of the postcode, how urgent it is, the reference number of your request, how many photographs you attached, the best time to call if you asked for a call, and a link to our admin area — never your name, phone number, email address, description or photographs themselves.

To stop the request form being flooded, we count how many requests come from the same internet connection. We do not store your IP address: we store a one-way fingerprint of it, made with a secret key, which cannot be turned back into the address. That fingerprint is deleted automatically about 40 minutes after your visit, and it is never linked to your request.

How long we keep your data

Requests that do not become work are deleted, along with their photographs, after 6 months without activity. Records of completed work are kept as long as needed for tax and legal obligations.

We keep private backup copies to protect against accidental loss. Data deleted from our systems is removed from those backups within 30 days, and when you ask us to erase your data, we remove it from the backups at the same time.

When you ask us to erase your request, we also delete the notification email about it from every mailbox it was sent from or delivered to. That email is the only copy that lives outside our own systems, and it never held your name, phone number, email address, description or photographs.

Cookies

We use no advertising cookies, and our analytics uses no cookies at all — see Website analytics below. The only cookies are the ones that keep the team signed in to the internal admin area, plus a temporary draft of the request form kept in the browser’s own storage so a refresh does not lose what was typed. That draft never leaves the visitor’s device.

Website analytics

We use Vercel Web Analytics to count page views and see which pages people find useful. It sets no cookies and stores nothing on your device. Visitors are counted using a hash generated from the incoming request, which is discarded after 24 hours; it cannot identify you, and it cannot follow you to any other website.

What is recorded with each page view is the page address, the site you arrived from, your country, region and city, and your device type, operating system and browser.

The confirmation page of a quote request carries a reference that belongs to one customer, and our internal admin area carries request identifiers. Neither reaches Vercel Web Analytics: the reference is removed before the page view leaves your browser, and admin pages are dropped before they are counted. Anyone with the reference can open that page and see which stage the request has reached. The page does not show your name, phone number, email, address, postcode, what you wrote, or your photographs.

We also use PostHog, hosted on servers in the European Union, to measure how people use the quote request form — for example, which step they stop at or how often the form is completed. PostHog is configured with no cookies and no device storage: the temporary session identifier it uses exists only in memory and is lost when you close the tab. No personal data is included in these measurements, and nothing in them can be linked back to you across sessions or devices.

PostHog also measures how our own staff work inside the admin area, so we can see how quickly we respond to a request. Those measurements record the stage a request has reached and how long it has been waiting, never the reference that identifies it or anything you wrote to us.

Your rights under UK GDPR

Under the UK GDPR, you have the right to access, rectification, erasure, restriction, objection, and portability of your personal data.

To exercise any of these rights, please email us at hello@covrevedova.co.uk.

You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.