Privacy Policy

1. Introduction

Welcome to Term Seeker ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service at term-seeker.com.

Term Seeker is provided by Flewidity Ltd, a company registered in England and Wales (company number 16615633) whose registered office is at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. Flewidity Ltd is the data controller for personal information processed through Term Seeker.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address
• Password (stored only as a secure hash)
• Company information (optional)

2.2 Payment Information

Payment processing is handled by Stripe. We do not store your credit card information. We receive only:

• Subscription status
• Last 4 digits of payment method
• Billing email

2.3 Email Connection Information

When you connect your Microsoft or Google email account:

• OAuth access tokens (encrypted and stored securely)
• Email address of connected account
• Permission scopes granted

2.4 Usage Information

We collect information about how you use Term Seeker:

• Case details, lender contacts and templates you enter
• Emails sent through our service
• Feature usage and preferences
• Log data (IP address, browser type, access times)

2.5 Information About Your Clients

Case details you enter may include information about your clients, such as borrowers and properties. You are the controller of that information, and we process it on your behalf only to provide the Service.

3. How We Use Your Information

We use your information to:

• Provide and maintain the Term Seeker service
• Generate lender enquiry emails from the case details you enter
• Send emails on your behalf to lenders
• Process payments and manage subscriptions
• Send important service notifications
• Improve our service and develop new features
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Email Sending Permissions

When you connect your Microsoft or Google email account, we request permission to send emails on your behalf. We use these permissions only to:

• Send emails to lenders when you explicitly click "Send Email"
• The emails are sent from YOUR email account, not ours
• We do not read, access, or store the contents of your inbox
• We do not send emails without your explicit action
• You can revoke access at any time from your account settings

Google user data

This section explains how Term Seeker handles data it receives from Google when you connect a Google (Gmail) account.

What we access

• Permission to send email on your behalf (gmail.send). This does not allow us to read, search, list, change or delete anything in your mailbox, and we never do.
• Your Google account email address (userinfo.email), so we can show which account is connected and send from it.
• The OAuth access and refresh tokens Google issues, which let us send when you ask us to.
• For each email you send, the message ID Google returns, plus the recipient address and the time and status of the send, so you can see what was sent.

The emails themselves are written by you in Term Seeker from the case details you enter; we do not receive any existing email content from Google.

How we use it

Only to send the lender enquiry emails you have reviewed and chosen to send, from your own Gmail address, one click at a time, and to show you which account is connected and which emails were sent. We do not use Google user data for advertising, profiling, credit or lending decisions, or any purpose other than providing these features, and we never send email without your action.

Who we share it with

We do not sell Google user data or share it with advertisers, data brokers or anyone else. It is stored with the service providers that host Term Seeker on our behalf (Vercel for hosting and Supabase for our database), under contracts that limit them to providing that service. We would disclose it only if required by law, or as part of a merger or acquisition with the same protections in place.

How we protect it

• OAuth tokens are encrypted at rest with AES-256-GCM, and all data is encrypted in transit (HTTPS/TLS).
• Tokens are used only on our servers and are never sent to your browser or to third parties.
• Access to our production systems is restricted to the account owner.

How long we keep it and how to delete it

• We keep your tokens and connected email address only while Google is connected. ClickingDisconnect in your account settings deletes them immediately.
• Records of emails you have sent (message ID, recipient, time and status) are kept for as long as you have an account, so you can see your history.
• Deleting your account permanently deletes all of this data. You can also remove Term Seeker's access at any time from yourGoogle Account permissions, and ask us to delete your data by emailing hello@term-seeker.com.

Limited Use

Term Seeker's use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements. Term Seeker does not use AI or machine-learning models with Google user data, does not use it to train any such models, and does not transfer it to third-party AI services. No person reads Google user data unless you ask us to for support, it is needed for security or to comply with the law, or it has been aggregated and anonymised.

5. Data Storage and Security

We take data security seriously:

• All data is encrypted in transit (HTTPS/TLS)
• OAuth tokens are encrypted at rest using AES-256-GCM
• Passwords are hashed using industry-standard algorithms
• Data is stored in secure databases (Supabase/PostgreSQL)
• Regular security audits and updates

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in these circumstances:

• Service Providers: Stripe (payments), Vercel (hosting), Supabase (database), Resend (system emails), Sentry (error monitoring)
• Legal Requirements: If required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

7. Your Rights and Choices

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct your information
• Deletion: Request deletion of your account and data
• Revoke Consent: Disconnect email accounts at any time
• Data Portability: Export your data in a standard format
• Object: Object to certain processing activities

To exercise these rights, contact us at hello@term-seeker.com or use the account settings page. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, although we would appreciate the chance to resolve your concern first.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide services. When you delete your account:

• Personal data is deleted within 30 days
• Aggregated, anonymized data may be retained for analytics
• Financial records retained for 7 years for legal compliance

9. Cookies and Tracking

We use essential cookies for:

• Authentication and session management
• Security (CSRF protection)
• Remembering your preferences

We do not use third-party advertising or analytics cookies. We use Vercel Web Analytics to count page visits; it does not use cookies or identify you.

10. Children's Privacy

Term Seeker is not intended for users under 18 years of age. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us immediately.

11. International Data Transfers

Your data may be transferred to and processed in countries outside your residence. We ensure appropriate safeguards are in place to protect your information in compliance with applicable data protection laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice on our service. Continued use after changes constitutes acceptance.

13. Contact Us

If you have questions about this Privacy Policy or our data practices:

• Data controller: Flewidity Ltd (company number 16615633), 71–75 Shelton Street, Covent Garden, London WC2H 9JQ
• Email: hello@term-seeker.com
• Website: https://term-seeker.com

14. UK GDPR

We process personal information in line with the UK General Data Protection Regulation and the Data Protection Act 2018. In addition to the rights in section 7, you have the right to restrict processing and to object to automated decision-making.

Our legal bases for processing are: performance of our contract with you, legitimate interests, compliance with legal obligations, and consent where we ask for it.