Privacy Policy
Effective date: 25 April 2026
This Privacy Policy explains how CoreLogic AI Ltd (trading as BioNetGain Pro), registered in England and Wales (company number 16919694), registered office at 5 Brayford Square, London E1 0SG ("we", "us", "our"), collects, uses, stores, and protects your personal data when you use our website at bionetgain.pro and the BioNetGain Pro platform (the "Service").
We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Information We Collect
1.1 Information you provide
- Account data: name, email address, company name, address, phone number, role/user type.
- Order data: site name, address, postcode, site boundary coordinates, development details, block plan images, site photos, planning references.
- Payment data: processed by Stripe. We do not store card numbers. We store Stripe customer IDs and payment session IDs.
- Communications: emails, support messages, feedback you send us.
- Affiliate data: name, email, company, PayPal email, bank details (for commission payouts).
1.2 Information collected automatically
- Usage data: pages viewed, features used, time on page, referral source.
- Device data: browser type, operating system, screen resolution, IP address.
- Cookies: see our Cookie Policy for full details.
- Analytics: we use Google Analytics 4 (GA4) to understand how the Service is used. GA4 collects anonymised usage data. You can opt out via your browser settings or the Google Analytics opt-out extension.
1.3 Information from third parties
- Gentian True Sight: satellite-derived habitat mapping data linked to the site boundary you provide.
- Stripe: payment confirmation, refund status.
2. How We Use Your Data
| Purpose | Lawful Basis (UK GDPR) |
|---|---|
| Provide and deliver the Service (generate reports, process payments) | Performance of a contract (Art. 6(1)(b)) |
| Create and manage your Account | Performance of a contract |
| Send order confirmations, report-ready notifications, and delivery emails | Performance of a contract |
| Process affiliate commissions and payouts | Performance of a contract |
| Improve the Service, fix bugs, and develop new features | Legitimate interests (Art. 6(1)(f)) |
| Analyse usage patterns via Google Analytics | Legitimate interests |
| Send marketing emails about new features or promotions (opt-in only) | Consent (Art. 6(1)(a)) |
| Respond to support enquiries | Legitimate interests |
| Comply with legal obligations (e.g. tax records, fraud prevention) | Legal obligation (Art. 6(1)(c)) |
| Protect against fraud and enforce our Terms | Legitimate interests |
3. Data Sharing
We do not sell your personal data. We share it only in these circumstances:
- Stripe — payment processing. Stripe Privacy Policy.
- Gentian (True Sight) — we share site boundary coordinates to generate habitat baselines. No personal data is shared.
- Google Analytics — anonymised usage data.
- Base44 — our hosting and backend infrastructure provider. Data processed under a Data Processing Agreement.
- Local Planning Authorities — when you share a report verification link, the LPA officer can view report data and your site details (name, address, development type). This sharing is initiated by you.
- Legal requirements — we may disclose data when required by law, court order, or to protect our rights.
4. International Transfers
Your data is primarily stored in the EU/UK. Some sub-processors (Stripe, Google) may transfer data outside the UK/EEA. Where this occurs, transfers are protected by Standard Contractual Clauses (SCCs) or an adequacy decision, in compliance with UK GDPR.
5. Data Retention
- Account data: retained while your account is active, plus 6 months after closure to allow reactivation.
- Order and report data: retained for the lifetime of the 30-year monitoring commitment, or a minimum of 7 years for tax/legal purposes.
- Payment records: retained for 7 years (HMRC requirements).
- Analytics data: retained for 14 months (GA4 default).
- Affiliate data: retained while the affiliate account is active, plus 7 years for financial records.
- Marketing consent records: retained for as long as consent is valid, plus 1 year.
6. Your Rights (UK GDPR)
You have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your data (subject to legal retention requirements).
- Restriction — ask us to restrict processing of your data.
- Portability — receive your data in a machine-readable format.
- Object — object to processing based on legitimate interests or direct marketing.
- Withdraw consent — where processing is based on consent, you may withdraw at any time.
- Lodge a complaint — with the Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any right, email privacy@bionetgain.pro. We will respond within 30 days.
7. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption in transit (TLS/HTTPS) and at rest.
- Role-based access controls and the principle of least privilege.
- Regular security reviews of our infrastructure and third-party providers.
- Secure payment processing via PCI-DSS compliant Stripe.
No system is 100% secure. If we become aware of a data breach that poses a risk to your rights, we will notify you and the ICO within 72 hours as required by UK GDPR.
8. Children
The Service is not intended for individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us at privacy@bionetgain.pro.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the Platform at least 14 days before they take effect. The "Effective date" at the top will be updated.
10. Contact
Data Controller: CoreLogic AI Ltd
Company No. 16919694
5 Brayford Square, London E1 0SG
General: info@bionetgain.pro
Privacy: privacy@bionetgain.pro