Back to Home

Privacy Policy

Effective Date: 14 January 2026

Win Win Designs · Document PP-001

Overview

  • We collect only what we need to run the platform.
  • We never sell your data or share it with advertisers.
  • Your project data belongs to you. We process it solely to deliver the service.
  • All data is stored in Google Cloud's London (europe-west2) region.
  • Our team does not access your data except for authorised technical support.
  • AI features are optional and you control what project data the AI can access.
  • You can access, correct, delete, or export your data at any time under UK GDPR.
  • We use essential cookies only. No tracking or advertising cookies.

1. Who We Are

Win Win Designs ("we," "us," "our") is the data controller responsible for your personal data. If you have any questions about this policy or how we handle your data, please contact us at contact@winwindesigns.com.

2. What Data We Collect

We collect the following categories of personal data:

Account Information

Name, email address, company name, job title, and profile photo, provided when you register.

Authentication Data

Credentials and authentication tokens (via email/password or SSO providers such as Google, Microsoft, or Apple). We never store third-party passwords.

Project & Business Data

Documents, risk assessments, compliance checklists, cost estimates, and other content you create or upload. This is your User Content and you retain full ownership.

Usage Data

Page visits, features used, device type, browser, IP address, and interaction logs, collected automatically to help us improve the platform.

3. Why We Process Your Data

We process your personal data on the following lawful bases under UK GDPR:

  • Contract performance (Art. 6(1)(b)): To create your account, provide the Win Win Designs platform, manage subscriptions, and deliver features you use.
  • Legitimate interests (Art. 6(1)(f)): To improve the platform, ensure security, detect fraud, and provide customer support. We balance these interests against your rights.
  • Legal obligation (Art. 6(1)(c)): To comply with UK laws, including tax, accounting, and regulatory requirements.
  • Consent (Art. 6(1)(a)): Where we rely on consent (e.g., optional analytics or marketing communications), you can withdraw it at any time.

4. Who We Share Data With

We do not sell your personal data. We share it only with:

  • Infrastructure providers: Google Cloud Platform (hosting, database, authentication). All core platform data is stored and processed in Google Cloud's London region (europe-west2).
  • AI service providers: When you use the Design Intelligence assistant, your prompts and selected project context are sent to Google's Gemini API for processing. See Section 5 (AI-Powered Features) for full details.
  • Third-party integrations you enable: Such as Autodesk, when you choose to connect your account. Data shared is limited to what's needed for the integration.
  • Professional advisers: Lawyers, accountants, or auditors where required by law.
  • Law enforcement: Where we are legally required to do so.

All third-party providers are bound by data processing agreements and must meet our security standards.

5. AI-Powered Features

Our platform includes an optional AI assistant ("Design Intelligence") powered by Google's Gemini API. This section explains how your data is handled when you use AI features.

What data is sent

When you interact with the AI assistant, your prompts and any project context you have chosen to share are sent to Google's Gemini API for processing. You control which project data the AI can access through the platform's context controls. No data is sent to the AI unless you actively use the feature.

How Google handles this data

We use Google's paid Gemini API, under which Google states that customer data is not used to train or improve its foundation models. Google may retain prompts for up to 55 days solely for abuse monitoring and safety purposes, after which they are deleted. Google's processing is governed by Google Cloud's Data Processing Addendum and Terms of Service.

Your control

AI features are entirely optional. You choose when to use the assistant and what project data to include in your queries. You can use the platform without ever activating AI features.

Our commitment

We are actively working towards end-to-end encryption for AI interactions and additional data isolation measures. As these capabilities mature, we will update this policy accordingly. We are committed to giving you the highest level of control over your data when using AI features.

6. International Transfers

All core platform data (your account, projects, documents, and business data) is stored and processed in Google Cloud's London region (europe-west2), within the United Kingdom.

When you use AI-powered features, your prompts may be processed by Google's Gemini API infrastructure, which may involve processing in other Google data centre regions. Where any data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the ICO, or transfers to countries with an adequacy decision.

7. Data Security and Internal Access

We implement appropriate technical and organisational measures to protect your data, including:

  • Encryption in transit (TLS 1.2+) and at rest;
  • Access controls and role-based permissions;
  • Regular security reviews and monitoring;
  • Secure authentication via Firebase with support for multi-factor authentication; and
  • Row-level security in our database to isolate tenant data.

Our staff do not access your project data, documents, or business information during normal operations. Access is granted only when you explicitly request technical support and authorise us to view specific data to resolve your issue. All such access is logged.

No system is 100% secure. If we become aware of a data breach that affects your rights, we will notify you and the ICO within 72 hours as required by UK GDPR.

8. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

  • Account data: Retained while your account is active, plus 30 days after deletion to allow recovery.
  • Project data: Retained while your account is active. Upon termination, you have 60 days to export before deletion.
  • Usage logs: Retained for up to 12 months, then anonymised or deleted.
  • Financial records: Retained for 6 years as required by UK tax law.

9. Your Rights

Under UK GDPR, you have the following rights over your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Ask us to correct inaccurate or incomplete data.
  • Erasure: Ask us to delete your data ("right to be forgotten"), subject to legal retention requirements.
  • Restriction: Ask us to limit how we process your data in certain circumstances.
  • Portability: Receive your data in a structured, commonly used format (JSON/CSV).
  • Objection: Object to processing based on legitimate interests.
  • Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at contact@winwindesigns.com. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

10. Cookies

We use only essential cookies required for the platform to function:

  • Authentication cookies: To keep you signed in securely.
  • Preference cookies: To remember your settings (e.g., theme, language).

We do not use advertising cookies, social media tracking pixels, or third-party analytics cookies. Because we use only strictly necessary cookies, a cookie consent banner is not required under UK PECR regulations.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or via a notice within the platform at least thirty (30) days before the changes take effect. The "Effective Date" at the top of this page will always reflect the latest version.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at contact@winwindesigns.com.

© 2026 Win Win Designs.