Privacy notice

Notice version: draft-2026-08

This is a draft privacy notice

This notice is published in good faith for this early, limited launch but is still a working draft. Our retention schedule, rights process, complaints procedure, lawful-basis record and processor register are documented below. Independent review of our lawful-basis wording, and verification of where each provider processes data, genuinely are not finished yet, and those sections say so.

Who controls your data

Before You Apply is a UK educational publisher of mortgage preparation resources. It is not a lender, mortgage adviser or broker.

The data controller for this website is the operator of Before You Apply, an independent UK sole trader established in Scotland. Data protection enquiries: hello@before-you-apply.com.

The controller is a sole trader, not a company, so there is no company number. No ICO registration number, VAT number or FCA authorisation is claimed anywhere on this site.

Correspondence addressTo be confirmed

Privacy contact mailbox (hello@before-you-apply.com)Verified

What we collect, and where it goes

This table is generated from our internal data-flow record, so it describes what the website actually does today rather than what it might do in future.

Contact enquiry form

Where: /contact

Why: Receiving and replying to a question about the website, tools, content corrections, media or accessibility.

Stored: In our hosted database (contact_submissions). The website can only add records — it cannot read, change or delete them from your browser.

Fields

name (as the visitor wishes to be addressed)
email address
telephone number (optional)
enquiry category
message (2,000 characters maximum)
page the form was submitted from
record of consent to reply, with timestamp
optional marketing consent, with timestamp
privacy notice version
random submission token

Keeping it: Kept for 12 months after the last meaningful contact about the enquiry, then deleted unless a separate legal need genuinely justifies keeping it for longer. Deletion is a documented manual review today; nothing is deleted automatically.

Marketing consent is a separate, optional tick box. It is unticked by default and never required.

Free resource request and download interest

Where: Free resource pages under /mortgages/resources/

Why: Recording a request for a free educational resource, and serving the file on screen where a configured file exists. Where no file exists the record is an expression of interest only.

Stored: In our hosted database (free_resource_requests). The website can only add records — it cannot read, change or delete them from your browser.

Fields

email address
first name (optional)
product slug requested
page the request came from
optional marketing consent, with timestamp
privacy notice version
random request token

Keeping it: Kept for 12 months, then deleted or anonymised as appropriate. Where you have separately opted in to marketing email, that consent record is kept while we rely on it. Deletion is a documented manual review today.

Marketing consent is a separate, optional tick box. It is unticked by default and never required.

Tool summary waiting list

Where: Optional module on tool result pages

Why: Recording a waiting-list expression of interest in a possible future emailed summary of a tool result band. No summary feature exists and none is delivered.

Stored: In our hosted database (tool_summary_requests). The website can only add records — it cannot read, change or delete them from your browser.

Fields

email address
tool identifier
result band label (never the underlying answers or figures)
page the request came from
optional marketing consent, with timestamp
privacy notice version
random request token

Keeping it: Kept for 12 months, then deleted or anonymised as appropriate. Deletion is a documented manual review today.

Marketing consent is a separate, optional tick box. It is unticked by default and never required.

First-party analytics events

Where: Whole site, only after analytics consent is actively accepted

Why: Understanding which pages and tools are used, so the site can be improved.

Stored: In our hosted database (analytics_events). The website can only add records — it cannot read, change or delete them from your browser.

Fields

event name
page path
content type label
tool name label
result band label
random rotating session label (not derived from any personal data)
consent version

Keeping it: Kept for up to 14 months in identifiable or pseudonymous form, then deleted or irreversibly anonymised. Analytics remains consent-gated, so nothing is recorded at all unless you accept it.

Readiness checker answers

Where: /mortgages/tools/readiness-checker

Why: Letting a visitor pause and return to the educational checker without starting again. Answers are broad preparation choices only.

Stored: In your own browser only. It is never transmitted to us.

Fields

one of four broad answers per question (organised / partly / not yet / not sure)
which step the visitor reached

Keeping it: Stored only in the visitor's own browser until they clear it or select 'Start again'. The publisher never receives it.

Calculator, checklist and timeline inputs

Where: LTV calculator, document checklist builder, application timeline

Why: Producing an on-screen educational result.

Stored: Nowhere. The values exist only in your open browser tab.

Fields

figures or selections typed by the visitor for that calculation only

Keeping it: Discarded as soon as the page is closed or reloaded. Never stored or transmitted.

What we never collect

These categories are collected nowhere on this site, and no form asks for them:

Health, disability, mental-health or neurodivergence information
Any other special-category data under UK GDPR
Bank account, card or sort code details
National insurance numbers or tax reference numbers
Passwords or account credentials
Uploaded documents such as payslips, bank statements or tax calculations
Credit report contents or credit scores
Date of birth or home address

In particular, we do not collect or infer anything about your health, mental health, disability or neurodivergence, and nothing on this site is personalised on that basis.

Storage in your own browser

This site sets no advertising cookies. The only things it stores in your browser are listed below; the Google Analytics entry is set only if you accept analytics. See the cookies page for how to change or clear them.

bya.consent.v1 — Your analytics and marketing choices. Contains no personal information. Kept in local storage until you clear it or change your choice.
bya.session.v1 — A random, rotating label used to group events from one browsing session. Not derived from personal data. Session storage only — discarded when the browser tab is closed.
bya.checker.v1 — Your broad answers in the readiness checker, so you can pause and return. Local storage until you select 'Start again' or clear your browser storage.
bya.submit.v1 — Timestamps of your recent form submissions, used only to prevent accidental duplicate or flooded submissions. Session storage only — discarded when the browser tab is closed.
_ga, _ga_<stream> — Google Analytics 4 cookies, set only after you accept analytics. They distinguish visits and pages, and never carry your name, email, message text or any figure you type. Up to 2 years, or until you decline analytics or clear your browser storage. Nothing is set, and no request is made to Google, before you accept.

Analytics

We use our own first-party analytics and, in addition, Google Analytics 4 loaded as a single Google Analytics tag. Both are strictly consent-gated: nothing is recorded, and no Google script or Google cookie is loaded, until you actively accept analytics in the consent banner. If you withdraw consent, no further events are sent to either.

Events never contain your name, contact details, message text, readiness-checker answers or any figures you type, such as property values or mortgage amounts. Google receives only the same short categorical labels — page type, tool name, broad result band, resource identifier. Advertising and personalisation storage stay denied, and there is no advertising pixel on this site. Google acts as our processor for this analytics data; see the cookies page for the detail.

Our lawful bases

This is our own record as controller of the lawful basis we rely on for each thing the site can actually collect today.

Contact enquiry form

Basis: Legitimate interests — responding to an enquiry the person chose to send us

The person contacts us and asks for a reply, so replying is what they expect and want. We ask for a positive confirmation that we may reply, which evidences the expectation; the basis relied on for the reply itself is legitimate interests, not marketing consent.

Still to do: A necessity and balancing assessment must be written up and reviewed as part of the outstanding independent data-protection review.

Free resource request and download interest

Basis: Steps taken at the request of the individual for the free resource they asked for; legitimate interests only where that is genuinely the better fit

The person actively asks for a specific free educational resource, and the record exists to answer that request. This is not marketing consent, and it must never be treated as one: any marketing email is a separate, optional, unticked consent.

Still to do: Confirm in the independent review whether request-based processing or legitimate interests is the correct framing for a free, no-contract resource.

Checker-summary and waiting-list requests

Not settled yet

Basis: Deliberately not stated yet, because it is genuinely unsettled.

The person joins a waiting list for a summary feature that does not exist yet and is never sent, so whether this is a step taken at their request or a legitimate interest is genuinely ambiguous on today's facts. It is deliberately left unsettled rather than stated with false certainty. It is not marketing consent.

Still to do: Settle the basis in the independent review, or before any summary is actually built or sent.

Optional marketing email

Basis: Consent

Marketing is a separate, optional, unticked choice that can be withdrawn at any time, and it is never bundled with an enquiry or resource request.

First-party analytics and consent-gated Google Analytics 4

Basis: Consent

Nothing is recorded and no request is made to Google before analytics consent is actively granted, and withdrawal stops further analytics. Analytics storage stays denied by default.

We also rely on legitimate interests for keeping the site secure, for example limiting abuse of the enquiry form, balanced against your rights.

Our record, not an independent legal sign-off

Operator/controller record only. Not an independent legal sign-off. Independent qualified data-protection review remains outstanding before broader or commercial activity.

How long we keep data

UK data-protection law does not set one universal retention period. The periods below are Before You Apply's own documented operational schedule, and we review them against the purpose the data serves and whether we still need it.

Contact enquiries

How long: 12 months after the last meaningful contact about the enquiry

Then: Deleted, unless a separate legal need genuinely justifies keeping the record longer.

Free-resource requests

How long: 12 months

Then: Deleted, or anonymised where an anonymised record is all that is still needed.

Checker-summary and waiting-list requests, where captured

How long: 12 months

Then: Deleted, or anonymised where an anonymised record is all that is still needed.

Marketing subscribers

How long: Kept while consent is relied on, and reviewed at least annually

Then: On unsubscribe or withdrawal of consent, removed from active marketing, keeping only the minimal suppression record needed to respect the opt-out.

First-party analytics events

How long: 14 months in identifiable or pseudonymous form

Then: Deleted or irreversibly anonymised. Analytics is only ever recorded after explicit consent.

Marketing consent evidence

Proposed, not final

How long: Kept while the consent is relied on, plus an appropriate evidence period afterwards; the exact post-reliance period is not finally fixed

Then: Reviewed and reduced to the minimum evidence needed to show the consent was validly given and later withdrawn. The final period is still to be settled.

Records of data-subject requests

Proposed, not final

How long: 3 years after the request is closed (proposed, not finally approved)

Then: Deleted, keeping only the minimal audit record of the request and its outcome. Copies of identity documents are not retained.

Orders and accounting records

Not collected yet

How long: to verify before commerce

Then: Not applicable today: checkout is disabled and no order or payment record is created. Statutory accounting retention must be verified before any commerce is enabled.

Failed or abandoned checkouts

Not collected yetProposed, not final

How long: 90 days (proposed, not finally approved)

Then: Not applicable today: checkout is disabled, so no abandoned-checkout record exists. The proposed period must be confirmed before any commerce is enabled.

Deletion is a documented manual review rather than an automated job, so a record may exist for a short period after its retention point while that review is carried out.

Decisions we have not made yet

We would rather list these openly than imply a level of maturity we have not reached. Each is an open task:

Independent review of our lawful-basis record and wording by a suitably qualified adviser, before any broader or commercial activity
Verification of the remaining processors: the database project region, Google's processing locations, and our domain and mailbox provider and its terms
International transfer positions and any safeguard relied on, which we have not verified and therefore do not claim
A formal data processing agreement with our hosting and build platform, which our current plan does not include and which is a post-validation upgrade
ICO registration and data protection fee reassessment, immediately before commercial go-live or first genuine trading
Independent factual review of the launch guides
Our complaints wording checked against current UK guidance by a qualified adviser

What we do not do

We do not sell personal data to anyone.
We do not run advertising trackers or third-party advertising cookies.
We do not share your data with lenders, advisers or brokers.
We do not use automated decision-making or profiling.

Who processes data on our behalf

These are the providers we actually use, what they do, and exactly how far our checks have gone. Where we have not verified something, we say so rather than assume it.

Supabase

Details to verify

Database processor for enquiry, resource-request, waiting-list and analytics records.

Data involved: Name, email address, optional telephone number, enquiry text, consent records, analytics events.

Processing terms: Supabase's March 2026 data processing addendum applies and includes transfer and sub-processor provisions.

Where: Project region not yet verified in project records.

Lovable (Pro plan)

Recorded

Site build and hosting platform.

Data involved: Site delivery; no separate store of enquiry records beyond the database above.

Processing terms: Lovable's Business/Enterprise data processing agreement does not formally apply to the Pro plan, so no formal DPA is in place today. This is not a claim that Pro carries the Business DPA.

Where: Hosting region not yet verified in project records.

Known limitation we have accepted: Accepted for the limited free test launch only, with a deliberately minimal data footprint: no financial documents or uploads, no adviser lead distribution, no Open Banking, and no unnecessary personal data. Moving to a plan with a formal DPA is a post-validation upgrade gate at incorporation or meaningful revenue.

Google (Google Analytics 4)

Details to verify

Consent-gated third-party analytics, stream G-FGC8H43MHT loaded directly. No Google Tag Manager container is loaded at runtime.

Data involved: Categorical events and Google's own analytics identifiers only, after consent. No name, email, free text, figures or raw checker answers.

Processing terms: Google's standard analytics terms apply. Not separately reviewed by or for the operator.

Where: Google processing locations not verified in project records.

Domain and mailbox provider

Details to verify

Domain registration and the hello@before-you-apply.com mailbox.

Data involved: Email correspondence sent to and from the public mailbox.

Processing terms: Provider, DPA position and location to verify. Not recorded in project records yet.

Where: To verify.

Email delivery provider

Recorded

Not engaged. Transactional email delivery is switched off and the site sends nothing.

Data involved: None today.

Processing terms: Not applicable until a provider is actually engaged.

Where: Not applicable.

International transfers

To be verified

We have not verified where each provider above stores or processes data, so we do not claim any particular region or transfer safeguard. Our database provider's data processing terms include transfer and sub-processor provisions, but the region our own project runs in is still to be verified. We will state the position accurately once we have checked it, and before any broader or commercial activity.

Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Have inaccurate data corrected
Ask us to delete data, in some circumstances
Restrict or object to certain processing
Withdraw consent at any time, without affecting past processing
Request a copy of your data in a portable format, where applicable

To exercise any of these rights, email us at hello@before-you-apply.com or use the contact page.

How we handle your request

A request can arrive at the canonical business mailbox, hello@before-you-apply.com, or via the contact form.
Log the date the request was received and the right being exercised.
Acknowledge the request to the person who made it.
Verify identity only where it is genuinely necessary, and proportionately; no copies of identity documents are kept unnecessarily.
Locate the relevant data across the enquiry, resource-request, waiting-list and analytics records.
Assess the right requested and any exceptions that apply.
Action the relevant systems and, where used, any processor.
Respond within the applicable legal deadline, generally within one month, handling and documenting any lawful extension where one applies.
Record completion, retaining only a minimal audit record of the request and outcome.

We keep a short register of requests so we can show they were handled properly. It records only: request id, date received, type of request, systems checked, identity-verification status, action taken, date and form of response, date closed. We do not keep copies of identity documents unnecessarily.

Complaints

If you are unhappy with how we handle your data, or with anything else about this site, we would like the chance to put it right. This is how a complaint is handled:

A complaint can be sent to the public business mailbox, hello@before-you-apply.com, or raised through the contact form.
Log the date received, how to reply to the person, and what the complaint is about.
Acknowledge the complaint promptly, so the person knows it has been received and is being looked at.
Investigate it fairly, looking at what actually happened and what the site or its records show.
Respond with the outcome and any corrective action taken or planned.
Keep a minimal record of the complaint, the outcome and any action, and nothing more than is needed.
For a complaint about how personal data has been handled, explain that the person can also complain to the Information Commissioner's Office (ICO) at any time, whether or not they raise it with us first.

We keep a short complaints record so we can show it was handled properly. It records only: complaint id, date received, how the complaint arrived, contact details for the reply, summary of the issue, date acknowledged, investigation notes, outcome and any corrective action, date and form of response, date closed.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at any time, whether or not you raise it with us first.

ICO data protection fee

Self-assessment completed; no registration claimed

No data protection fee due at this stage because trading has not started. This is the outcome of the operator's own pre-trading self-assessment, not an ICO registration or an ICO-issued exemption.

Retake the self-assessment immediately before commercial go-live, the first genuine sale, or any other start of trading, and register and pay the fee if the outcome then requires it.

We hold no ICO registration number and claim none. If registration becomes required, we will state the actual position here.