Privacy policy

Last updated: July 2026.

Plain-English summary. Stop The Mould is an independent UK damp and mould evidence service operated by Stop The Mould Ltd (Company No 17316399), registered at 66 Paul Street, London, EC2A 4NA. We only ask for information needed to create your report, manage your case file, process payment, share or send your evidence pack, track responses and provide support. We do not sell your data. We do not run advertising cookies. We do use one privacy-friendly analytics script (Ahrefs) to understand aggregate site traffic — details below.

Who is the data controller

Stop The Mould Ltd, 66 Paul Street, London, EC2A 4NA, United Kingdom. Contact: hello@stopthemould.com.

What we collect

Case data: information you submit through our evidence forms — name, contact details, postcode, property details, mould details, tenant/landlord notes and uploaded photos.
Account data (if you create a portal login): email, password hash, role (tenant/landlord/agent), full name.
Payment data: card details are entered directly into Stripe — we never see or store them. We receive a payment reference, amount and email used at checkout.
Landlord portal responses (where applicable): messages, response dates, inspection notes and repair updates entered by landlords or agents on shared cases.
Technical data: IP address, browser type and pages viewed (via aggregate analytics only).

Legal basis for processing (UK GDPR Article 6)

Contract — creating your report, running your case dashboard, processing payment.
Legitimate interests — securing the service, preventing fraud, aggregate analytics to improve the product, and responding to your enquiries.
Consent — sharing your case file with a specialist, landlord or third party when you explicitly ask us to.
Legal obligation — retaining payment and accounting records as required by UK law.

How we use your data

To prepare your evidence report, manage your secure case file, generate PDF exports, send your report to a landlord or agent when you request it, track responses, provide next-step guidance, process payment, provide support, and (with your explicit consent) share the case with a specialist who may be able to help.

Cookies, analytics and third-party scripts

We use the following:

Essential cookies — needed to keep you signed in, remember your case-in-progress, and process payment. These cannot be disabled without breaking the service.
Ahrefs Analytics (analytics.ahrefs.com/analytics.js) — privacy-friendly, aggregate-only web analytics used to understand which pages are useful. It does not identify individual visitors, does not use advertising cookies, and does not build cross-site profiles.
Stripe — loaded on checkout pages only, to process card payments securely.
Static hosting — the site is served as static files by our hosting provider (Hostinger). No hosting-provider scripts are loaded into the page.

We do not run advertising cookies, retargeting pixels, Facebook/Meta trackers, Google Ads, TikTok pixel or session-replay tools.

Payments

Card payments are processed by Stripe Payments Europe, Ltd. Card details are entered directly into Stripe and are never stored on our servers. We receive only a payment reference, the amount, and the email you used at checkout. Stripe's privacy policy is at stripe.com/privacy.

Sharing your case (tenant/landlord portal)

If you generate a secure share link, or explicitly send your report to a landlord, letting agent, council or specialist, the recipient will be able to view the report and any photos or notes you have chosen to include. Timestamps of when the report was sent, viewed and responded to may be recorded in your case timeline. You control what is shared and can revoke share links at any time.

Data retention

Active case files: retained while your account is active. You can delete individual cases at any time.
Closed case files: retained for up to 24 months after case closure, so you can reopen or export for escalation.
Account data: deleted within 30 days of you closing your account, except records we are required to keep for legal or accounting reasons.
Payment records: retained for 7 years to comply with UK accounting and tax law.
Aggregate analytics: retained for up to 24 months in anonymised form.

International transfers

Some processors we use (Stripe, our hosting provider, Ahrefs) may process data outside the UK. Where they do, they operate under UK GDPR-approved safeguards (adequacy decisions or Standard Contractual Clauses).

Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, port or object to processing of your data, and to withdraw consent at any time. Contact hello@stopthemould.com and we will respond within one month.

Complaints

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve it directly first.