Privacy Policy

• We collect what you give us to use Coriva: your account, your business details, your jobs, photos, chats, job sheets and invoices.
• Other users see what they need to do the job with you. For example, the engineer you confirm sees your venue address.
• We use a small number of service providers to run Coriva. They are listed below with what each one gets.
• We do not sell your data. We do not show ads. We do not track you across other apps or websites.
• You can delete your account in the app at any time: More, then Settings, then Delete account. See how to delete your account.

Information you give us

• Account: your name, email address, password (stored only in scrambled, hashed form by our sign-in provider), optional phone number, and whether you are a kitchen or an engineer. If you sign in with Apple or Google, they send us your name and email address.
• Kitchens: business name, contact name, venue and site addresses, postcodes, and access notes for engineers.
• Engineers: business or trading name, the kinds of work you do, your service area and base postcode, working hours, rates, VAT number, Gas Safe and F-Gas details, insurance details and certificate photos, and the payment details you choose to print on your invoices (for example your bank details). If you choose to verify your identity, a photo of your passport or driving licence.
• Jobs: what is broken, the equipment, how urgent it is, photos, the times offered or requested, and the schedule.
• Chat: the messages and photos you send to other users.
• Job sheets and invoices: the work done, time on site, parts, photos, signatures, amounts, and the customer details on each invoice. Engineers can also add their own clients.
• Reviews, reports and blocks: ratings and reviews you leave, reports you make about other users or content, and the people you block.
• Axel (engineers only): the questions you ask Axel and its answers.
• Support: messages and feedback you send us in the app or by email.
• Website forms: what you enter in the contact form, the waitlist or the Android launch sign-up on coriva.co.uk.

Information we collect when you use the app

• Location: only if you allow it, and only while you are using the app. Engineers can use it to set their base postcode and to find jobs nearby. You can type a postcode instead. We never collect location in the background.
• Usage: which screens you open and key actions (for example “job posted” or “invoice sent”), with your account ID, email address and role. We use this to understand how Coriva is used and to improve it.
• Crash reports: when the app goes wrong, a report with your device model, operating system, app version and technical logs. The report can include a short screen recording in which all text and images are hidden. Crash reports are not linked to your name or email.
• Notifications: a push token for your device, so we can send the notifications you have allowed.

Information from others

• Other users: for example a review of you, an invoice with your business name on it, or a report about you.
• Apple and RevenueCat: whether an engineer has a membership, which plan, and when it renews. We never see your card details.
• Public registers: where you give us a company number, we may check it against the public Companies House register.

Coriva connects kitchens and engineers, so some of your information is shown to other users:

• When a kitchen posts a job, signed-in engineers can see the job details and photos, the business name, the town and a rough map point. They can also see the kitchen's contact name, phone number and email address, so they can get in touch about the job.
• The engineer a kitchen confirms also sees the full venue address and access notes.
• Kitchens can see engineers' profiles: business name, photo, service area, the work they do, and the credentials, insurance details, business details, rates and reviews on their profile.
• Chats, job sheets and invoices are seen by the kitchen and the engineer on that job.
• Reviews are shown on the profile of the person reviewed.
• Photo ID is never shown to other users. They only see whether it has been checked.

• To provide Coriva (contract): your account, jobs, matching kitchens with nearby engineers, chat, scheduling, job sheets, invoices, reviews, notifications and engineer memberships.
• To keep Coriva safe (legitimate interests): acting on reports and blocks, checking photo ID when an engineer asks us to, preventing fraud and misuse, and enforcing our Terms.
• To fix and improve Coriva (legitimate interests): usage analytics and crash reports. We keep these to what we need and never use them for advertising.
• To answer you (legitimate interests, or contract if it is about your account): support messages and website enquiries.
• To meet the law (legal obligation): for example keeping records we must keep and answering lawful requests from authorities.
• With your permission (consent): location, camera, photos and notifications. You can turn each one off in your phone's settings.

We do not make decisions about you with legal or similarly serious effects using only automated means. We do not send marketing emails.

We use these service providers to run Coriva. They act on our instructions and only use your data to provide their service to us.

• Supabase: our database, sign-in, file storage and server functions. Holds all the app data listed above. Our project is hosted in Ireland (EU). Supabase also sends sign-in codes and password reset emails.
• PostHog: product analytics. Gets your account ID, email address, role, the screens you view and key actions. Hosted in the EU.
• Sentry: crash and error reports. Gets device and app details, technical logs and masked screen recordings, not linked to your account. Hosted in the EU (Germany).
• RevenueCat and Apple: engineer memberships. RevenueCat gets your account ID and your purchase status from Apple. Apple takes payment under its own terms and privacy policy.
• Expo, then Apple or Google: push notifications. They get your device's push token and the text of each notification, such as a job title or a sender's name.
• OpenAI: powers Axel, the engineers' troubleshooting helper. Gets your question, your recent messages in that Axel chat, and the job's title, equipment and fault description. We do not send your name, email, phone number or address. Please do not type personal details into Axel.
• postcodes.io: turns postcodes into map points. Gets the postcodes entered in the app, and your device's location if you tap to use your location.
• OpenFreeMap: map images, built from OpenStreetMap data. Gets normal web request data (such as your IP address and the map area on screen), not your account.
• Companies House: the public company register, if we check a company number.
• Resend: delivers the messages from the website contact form, waitlist and Android sign-up to us.
• Plausible Analytics: website visit counts. See Cookies below.
• Apple and Google also deliver the app and, if you choose, sign you in.

Invoices and job sheets you send by email go from your own email app, not through our servers.

We do not sell your personal data. We may share data if the law requires it, to answer a lawful request from an authority, or to protect the safety of users or the public. If Coriva is ever sold or merged, your data would pass to the new owner under this policy, and we would tell you first.

Our main database is in Ireland, and our analytics and crash reporting are in the EU. The UK recognises the EU as giving adequate protection. Some providers, including RevenueCat, Expo, OpenAI, Resend, Apple and Google, may process data in the United States or elsewhere. When that happens we rely on UK safeguards, such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum to standard contractual clauses. Email us for details of the safeguard that applies.

• While your account is open: we keep your account data so Coriva works, including your job history, chats, job sheets and invoices.
• Jobs nobody takes: open jobs close automatically after a period with no engineer chosen. They stay in your history.
• When you delete your account: we delete your account and the data linked to it straight away, and remove your files straight after. Our database provider keeps backups for a short period before they are overwritten.
• Reports about you: if another user reported you, we keep that report after you delete your account, but it is no longer linked to you. We need it to deal with the report and keep users safe.
• Analytics and crash reports: kept by PostHog and Sentry for a limited period under our settings, then deleted. Ask us and we will delete analytics linked to your account sooner.
• Purchases: Apple and RevenueCat keep records of membership purchases under their own policies.
• Support and website messages: kept for as long as we need to deal with them and keep a record of what we did.

Deleting your account also deletes the job sheets and invoices you wrote or received in Coriva. If you need them for your own records, for example for tax, download or email yourself a copy first. See deleting your account for the full list.

Under UK data protection law you have the right to:

• get a copy of the personal data we hold about you
• have wrong data corrected (you can also edit most of it in the app)
• have your data deleted
• ask us to limit how we use your data
• object to how we use your data where we rely on legitimate interests
• get your data in a format you can move to another service
• withdraw your consent at any time, where we rely on consent

To use any of these rights, email info@coriva.co.uk from the email address on your account. We may ask you to confirm who you are. We will reply within one month, and there is no charge.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

In the app, tap More, then Settings, then Delete account, then Delete my account. If you cannot sign in, email info@coriva.co.uk from the email address on your account.

Deleting your account does not cancel an engineer membership bought through Apple. Cancel it in your Apple ID settings first. Full details are on our delete your account page.

Chats are private between the kitchen and the engineer on a job. We do not read chats as a matter of course. When someone reports a user, we look at the report and the message or job it is about. We may also look at the related chat and job to decide what to do. We review every report within 24 hours.

Coriva is for businesses and for people aged 18 or over. It is not for children. We do not knowingly collect data from anyone under 18. If you think a child has made an account, email info@coriva.co.uk and we will delete it.

The website uses Plausible Analytics to count visits and see which pages are used. Plausible does not use cookies, does not collect personal data and does not follow you across other websites. We do not use advertising or tracking cookies.

The app does not use cookies. Device permissions are managed in your phone's settings.

Data is encrypted between your device and our servers. Rules in our database limit who can see each piece of data, so users only see what they are allowed to see. Files such as photos, ID documents, job sheets and invoices are stored privately. No system is completely secure, so please use a strong password and keep your phone locked.

If we change this policy, we will update the date at the top. If a change is important, we will also tell you in the app or by email before it takes effect.

Slamships Ltd, registered in England and Wales, company number 15064090. Email info@coriva.co.uk. See also our Terms of Service and Support page.