Privacy Policy

SolarScout Pro is operated by LOCKSAFEUK LTD, a company registered in England and Wales. We are the data controller for personal data processed through the SolarScout Pro website and application, unless this policy says otherwise.

If you have a privacy question, email contact@locksafe.uk. We do not currently appoint a separate Data Protection Officer. Privacy requests go to the same contact address.

We only collect what we need to run the product, bill for it, keep accounts secure, and (if you choose) to send or receive messages. The main categories are:

• Account data: name, email address, password hash (we never store your password in plain text), optional profile image, role, and whether the account is approved. Accounts are created with NextAuth.
• Solar lead records: business names, categories, addresses, coordinates, estimated roof area, and related contact details we surface from mapping and places data (for example phone, email or website where available).
• Roof and solar estimates: modelled panel counts, energy yield, imagery quality notes and similar figures derived from Google Solar and our own layout tools. These are estimates, not a survey of a specific property.
• Map and imagery data: satellite and map tiles from Google Solar and Mapbox that we display in the product and, where relevant, attach to a lead or proposal.
• Billing data: plan, subscription status, invoices and payment outcome. Card details are handled by Stripe — we do not see or store full card numbers.
• Messaging data (optional): if you use WhatsApp via Twilio, we store conversation threads, delivery status and message content needed to run the inbox.
• Technical data: IP address, browser type, device, pages viewed, timestamps, and security logs (for example sign-in attempts).

We use this information to provide SolarScout Pro, keep it secure, take payment, and improve the service. We do not sell personal data.

• Contract: creating and administering your account, delivering scans and lead lists, generating proposals, and providing paid-plan features you subscribe to.
• Legitimate interests: operating a B2B solar prospecting tool, preventing abuse, understanding how the product is used, and keeping the service reliable. You can object — see “Your rights” below.
• Legal obligation: keeping billing and tax records, and responding to lawful requests.
• Consent: only where we ask for it, for example optional analytics cookies if they are not strictly necessary, or optional messaging features you switch on.

SolarScout Pro uses Google’s Solar API and Mapbox maps and satellite imagery so you can see rooftops, estimate solar potential and place a lead on a map. When you search a location or open a lead, we send that location (and related technical data such as your IP address) to those providers so they can return imagery and solar insights.

Google and Mapbox process that data under their own terms and privacy policies as independent controllers or processors, depending on the product. We do not use their imagery to build a secret consumer profile. Roof outlines, panel layouts and kWh figures shown in the app are modelled from those sources and from OpenStreetMap building data — they are not a measured site survey.

You should not treat Google Solar or Mapbox imagery as proof of current site conditions. Imagery can be out of date, obscured, or commercially licensed for use inside our product only. Do not scrape, bulk-download or republish those tiles outside SolarScout Pro.

Paid plans are billed through Stripe. When you start a checkout or open the customer portal, Stripe collects payment details on its own hosted pages. We receive a customer and subscription identifier, plan, billing email, and payment status so we can unlock the correct features.

Stripe is a separate controller for the card data it collects. We do not store full card numbers, CVC codes or bank account details on our servers. You can manage payment methods and invoices in the Stripe billing portal linked from the app.

SolarScout Pro can optionally send and receive WhatsApp messages through Twilio so a signed-in operator can talk to a lead from the inbox. This is not switched on for every account. If you use it, we process phone numbers, message bodies, media identifiers and delivery receipts in order to show the thread and keep a record of the conversation.

Twilio (and, where the conversation is on WhatsApp, Meta) will also process those messages under their own terms. You are responsible for only messaging people you are allowed to contact, and for complying with PECR, UK GDPR and any local e-privacy rules in Spain, Portugal, Romania or Albania. We do not use the inbox to run unsolicited bulk outreach on your behalf.

We use cookies and similar storage that are required to sign you in and keep the service secure. NextAuth sets a session cookie (typically HttpOnly) so we can recognise you between requests. We may also set a short-lived CSRF token and a locale cookie (`NEXT_LOCALE`) if you choose a language or we detect one.

These cookies are strictly necessary for a logged-in product. Blocking them will usually stop sign-in from working.

If Google Analytics (GA4) or Google Tag Manager is configured on the public site, that may set additional analytics cookies on marketing pages. Those are not required to use the core product. You can control non-essential cookies through your browser settings.

Map tiles loaded from Mapbox or Google may cause those providers to set their own cookies or local storage in line with their policies.

The website is hosted on Vercel. Application data, including accounts and lead records, is stored in MongoDB (accessed via Prisma).

Our processors may store or access data in the UK, the European Economic Area, or other countries (including the United States) where they operate. Where a transfer of UK or EU personal data goes outside the UK/EEA, we rely on an appropriate safeguard such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or a UK adequacy decision.

We share personal data only with the service providers needed to run SolarScout Pro, and only to the extent required:

• Vercel — hosting, CDN and serverless functions.
• MongoDB — database hosting for Prisma.
• Google — Solar API, Places/Maps (where used), and optional analytics.
• Mapbox — maps and satellite imagery.
• Stripe — subscriptions and invoices.
• Twilio — optional WhatsApp / SMS delivery.
• Email delivery providers we use to send verification, password-reset and billing notices.

We keep personal data only for as long as we need it for the purpose it was collected, including legal and accounting needs.

• Account data: for the life of the account, then deleted or anonymised within a reasonable period after you close it (unless we must keep a record of a dispute or legal claim).
• Lead and roof/solar records: while your account remains active and the records are part of your workspace. If you delete a lead, we remove it from the live database; residual copies may linger in encrypted backups for a limited time.
• Billing records: typically six years after the end of the tax year, which is the usual UK accounting retention period.
• WhatsApp / Twilio threads: while the conversation is needed to provide the inbox, and for a short period afterwards for support and abuse investigation.
• Security and server logs: usually up to 12 months, unless needed longer to investigate an incident.
• Session cookies: until you sign out or the session expires. Locale preference cookies last up to 30 days.

You have the following rights over personal data we hold about you, subject to the usual legal limits (for example we may refuse a request that is excessive, or keep data we must retain for tax):

• Access — a copy of the personal data we hold about you.
• Rectification — correction of inaccurate or incomplete data.
• Erasure — deletion where we no longer have a lawful reason to keep it.
• Restriction — asking us to pause processing in certain cases.
• Portability — receiving account data you provided in a commonly used format.
• Objection — objecting to processing based on legitimate interests, including profiling of that kind.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting earlier lawful processing.
• Complaint — you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk. If you are in the EU you may also complain to your local supervisory authority.

When we generate a solar lead list, we are the controller of that database inside SolarScout Pro. If you export leads, copy them into a CRM, or message a business yourself, you become the controller of that copy. You must have a lawful basis before you email, call or WhatsApp anyone, and you must honour opt-outs.

Lead records are aimed at commercial rooftops (warehouses, factories, retail parks and similar). They may still include personal data — for example a sole trader’s name or a direct-dial number. Treat exported lists accordingly.

SolarScout Pro is a business tool. It is not aimed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have, email contact@locksafe.uk and we will delete it.

For privacy requests, including access or deletion, email contact@locksafe.uk from the address on your account where possible, and tell us what you need. We will respond within one month, or explain if we need more time (up to a further two months for complex requests).

Company: LOCKSAFEUK LTD. Product: SolarScout Pro (https://www.solarscout-pro.com). Markets: United Kingdom, Spain, Portugal, Romania, Albania.

We may update this policy when the product or the law changes. The “Last updated” date at the top of the page will change. Material changes will be highlighted on this page or notified by email to account holders where we are required to do so.