Privacy Policy

Last updated: 15 March 2026

This Privacy Policy explains how DevSource ("we", "us", "our"), operated by Hugo Fanning, collects, uses, and protects your personal data. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

DevSource is a property intelligence platform operated by Hugo Fanning. For data protection enquiries, contact us at hello@dev-source.co.uk. ICO registration application number: C1895961 (full registration number pending).

2. Data We Collect

We collect the following personal data:

Waitlist signups: First name, last name, email address, professional role

Access applications: First name, last name, email address, company name, professional role, reason for applying

Account data: Email address, authentication tokens (managed by Supabase)

Usage data: Notes, bookmarks, follow-up dates, and contact details you voluntarily enter within the dashboard — stored against your user account

Technical data: IP address, browser type, device information collected automatically for security purposes

3. How We Use Your Data

We use your personal data for the following purposes:

To process your application and grant access to the Service
To send you access credentials and product updates via email
To send you the daily intelligence digest (you can unsubscribe at any time)
To store your notes, bookmarks, and follow-up data within the dashboard
To protect the security and integrity of the Service
To comply with legal obligations

4. Legal Basis for Processing

We process your personal data on the following legal bases:

Contract: Processing necessary to provide the Service you have requested
Legitimate interests: To protect the security of the Service and prevent abuse
Consent: For marketing communications — you can withdraw consent at any time

5. Data Sharing

We do not sell your personal data. We share data only with the following trusted third-party processors:

Supabase — database and authentication (US-based, Standard Contractual Clauses apply)
Resend — email delivery
Netlify — website hosting (US-based, with EU adequacy measures)
Anthropic — AI processing for deal brief generation (anonymised site data only, no personal data)
Cloudflare — DNS, security, and email routing

All third-party processors are subject to data processing agreements and are required to maintain appropriate security measures.

6. Data Retention

We retain your personal data for as long as your account is active. If you request deletion of your account, we will delete your personal data within 30 days, except where we are required to retain it for legal purposes.

Waitlist data is retained for 12 months or until you request deletion.

7. Your Rights

Under UK GDPR, you have the following rights:

Right of access — request a copy of your personal data
Right to rectification — request correction of inaccurate data
Right to erasure — request deletion of your personal data
Right to restrict processing — request we limit how we use your data
Right to data portability — request your data in a portable format
Right to object — object to processing based on legitimate interests

To exercise any of these rights, contact us at hello@dev-source.co.uk. We will respond within 30 days.

8. Cookies

DevSource uses essential cookies only — specifically authentication tokens to keep you signed in. We do not use advertising or tracking cookies. No cookie consent banner is required as we only use strictly necessary cookies.

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

HTTPS encryption for all data in transit
Row-level security on all database tables
API keys stored as server-side environment variables
Rate limiting on all public-facing endpoints
Cloudflare DDoS protection

10. International Transfers

Some of our third-party processors are based outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place including Standard Contractual Clauses or adequacy decisions.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email. The date at the top of this page indicates when it was last updated.

12. Complaints

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

13. Contact

For any privacy-related questions, contact us at hello@dev-source.co.uk.