Privacy Policy

Buried Beneath LTD is the controller of personal data described in this notice for the Buried Beneath Vault service. Registered office: 61 Bridge Street, Kington, HR5 3DJ, United Kingdom.

Privacy enquiries and data-rights requests can be submitted through the Contact Us form using the Privacy/Data Request topic.

• Account and identity data: name, account identifier, email address and authentication information managed by our cloud authentication provider.
• Billing data: customer/subscription identifiers, payment status, price/product references, billing events and credit transactions. Buried Beneath Vault does not need to store full payment-card details.
• Find data: Front/Back photographs, object descriptions, identification results, confidence information, sources, valuations, favourites and report metadata.
• Land data: postcode, What3Words or other location input, resolved coordinates, research radius, Land Intelligence reports, evidence, features, zones, target scores and cached LiDAR metadata.
• Support data: name, reply email, topic, subject, message and optional report/reference supplied through Contact Us.
• Technical and security data: logs, timestamps, device/browser information where available, authentication/security events, API usage, processing times, errors and audit records.

We use account, billing, uploaded find and land-location information primarily because it is necessary to provide the service you request and perform our contract with you.

We use security, fraud-prevention, service-integrity, diagnostic and limited operational records where necessary for our legitimate interests in operating a secure and reliable service, balanced against your rights.

We process information where necessary to comply with legal obligations, including accounting, tax, consumer-protection and lawful requests.

Where consent is the appropriate lawful basis — for example for optional non-essential cookies or marketing — we will ask for it separately and you may withdraw it.

Find photographs and associated instructions may be sent to an AI provider to perform the identification/research workflow. Land Intelligence may also use AI-assisted research and explanation where the feature is configured to do so.

AI output is not treated as infallible. The service presents confidence, evidence and limitations and combines AI with deterministic processing where appropriate.

We do not use Buried Beneath Vault to make decisions that produce legal or similarly significant effects about you solely by automated means.

The standalone Buried Beneath Vault project currently uses a managed cloud PostgreSQL database for records, managed cloud authentication for sign-in and managed cloud storage for private files.

Private storage buckets include find-images and lidar-data. Files are intended to be accessed only through server-side controls or short-lived signed URLs rather than public bucket access.

During identification, the original Front/Back images may be temporarily retained so the AI can inspect the best available image rather than a compressed derivative.

After successful analysis and safe creation of retained derivatives, the original image variants are designed to be deleted and their corresponding database rows soft-deleted. For each side, an archival WebP (approximately 2400 px long edge) and thumbnail WebP (approximately 520 px long edge) are retained while Vault retention applies.

If processing fails, operational handling may temporarily retain data needed to diagnose or safely retry the request, subject to retention controls.

Exact land inputs and resolved coordinates are treated as private account data. Public/customer-facing presentation should use masked references where exact coordinates are not required.

Land locations are used to obtain or compare relevant mapping, LiDAR, historic-map and research evidence and to calculate target areas and navigation information.

We may share only the data reasonably necessary with service providers that help us operate Buried Beneath Vault. These categories include:

• Our application platform — hosting, database, authentication, storage and server functions.
• Stripe — subscription, checkout, billing portal and payment-event processing.
• OpenAI — AI processing used for configured Find Identification and/or Land Intelligence workflows.
• Mapping, geocoding, LiDAR, historic-map and public-data providers — where requests are necessary to obtain the relevant data or imagery.
• Professional advisers, regulators, courts or law-enforcement bodies where disclosure is legally required or reasonably necessary to establish, exercise or defend legal rights.

We do not sell personal data to advertisers.

Some technology providers may process data outside the UK. Where UK data-protection law requires safeguards for an international transfer, we will rely on an applicable adequacy regulation or appropriate contractual/other safeguards provided for by law.

Provider arrangements can change. The live Privacy Policy should be reviewed when processors or hosting arrangements change.

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including contractual, security, accounting and legal requirements.

• Original Find image variants: designed for deletion after successful analysis and creation of retained WebP derivatives.
• Vault archival/thumbnail images and Find reports: while the account/membership retention rules apply; after paid membership ends, the current design provides one month of read-only Vault retention before scheduled deletion.
• Land reports and evidence: retained for the account while needed to provide saved reports and subject to account deletion/retention rules.
• Billing, tax and transaction records: retained for the period reasonably required by applicable accounting, tax and legal obligations.
• Support, security and audit records: retained for a proportionate period based on the nature of the request, dispute, security need or legal requirement.

We use account authentication, owner-scoped database rules, private storage, signed URLs, server-side secret handling, payment-webhook verification and audit controls designed to reduce unauthorised access.

No online system can be guaranteed completely secure. If we become aware of a personal-data breach, we will assess and respond to it in accordance with applicable law.

Depending on the circumstances and lawful basis, you may have rights of access, rectification, erasure, restriction, objection and data portability, and a right to withdraw consent where processing relies on consent.

Your right to object: where we rely on legitimate interests, you may object to that processing. We will consider the objection in accordance with applicable data-protection law.

Submit a request through Contact Us using Privacy/Data Request. We may need to verify identity before acting on a request.

You may complain to the UK Information Commissioner's Office if you believe your personal data has been handled unlawfully. You can find current complaint information on the ICO website. We would appreciate the opportunity to address your concern first, but you are not required to contact us before contacting the ICO.

Buried Beneath Vault is not designed as a service directed at children. If we learn that personal data has been provided by a child in circumstances where it should not have been processed, we will take appropriate steps.

We will update this Privacy Policy when our processing, providers, retention arrangements or legal requirements materially change. The effective date will be shown at the top.