Privacy Policy

Effective 27 June 2026

1. Who we are

Apex Build Systems Ltd ("we", "us"), trading as Coupler, operates the coupler. scaffolding business management platform.

We act as the data controller for the account data of registered users (people who log in to coupler.). For the business data that subscribing companies enter about their own clients, staff and projects, we act as the data processor on behalf of those companies, who are themselves the data controllers of that information. This policy explains what data we collect, why, and how you can exercise your rights under UK GDPR and the Data Protection Act 2018.

2. Data we collect

Account data

Your name, email address, company name, and billing information when you sign up or update your account.

Business data

Information you enter into the platform: client details, project information, staff records, quotes, invoices, compliance documents, and scheduling data.

Usage data

Log data, IP addresses, browser type, pages visited, and actions taken within the platform. We use Vercel Analytics for anonymous usage statistics.

3. Why we process your data

  • Contract performance — to provide and maintain the coupler. service
  • Legitimate interests — to improve the platform, prevent fraud, and ensure security
  • Legal obligation — to comply with UK tax, accounting, and legal requirements
  • Consent — for marketing communications (you can withdraw at any time)

4. Sub-processors we use

We do not sell your data. We rely on the following sub-processors to operate the service. Each is bound by GDPR-compliant data processing terms and is located in the UK or EEA, or transfers data under appropriate safeguards:

  • Supabase — database, authentication and file storage. Data stored in Ireland (eu-west-1).
  • Vercel — application hosting and CDN.
  • Resend (via AWS SES) — outbound email delivery. Emails routed via Ireland (eu-west-1).
  • Google Places API — address autocomplete. Only the partial address you type is sent to Google to retrieve suggestions; we do not associate it with your account on Google's side.
  • Cloudflare Turnstile — bot protection on sign-in. Sets a strictly-necessary challenge cookie; no personal data is collected.
  • Legal authorities — where compelled by court order or other legal obligation.

5. Data retention

We retain account data for the duration of your subscription plus 2 years, or as required by law. Business data (quotes, invoices etc.) is retained for 7 years to meet HMRC requirements. You may request deletion of personal data at any time, subject to legal obligations — or use the self-serve "Delete company" tool under Settings → Account & Password.

Email send logs: we keep an audit record (recipient address, subject line, sent timestamp, Resend message ID, delivery status) for 7 years to support tax and dispute investigations. The 500-character body preview captured at send time is automatically nulled after 90 days.

6. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request deletion ("right to be forgotten")
  • Restrict or object to processing
  • Data portability — receive your data in a machine-readable format
  • Withdraw consent at any time (where processing is consent-based)

To exercise any right, email us at privacy@coupler.software. We will respond within 30 days.

7. Cookies

We use strictly necessary cookies for authentication (session tokens) and a strictly necessary challenge cookie set by Cloudflare Turnstile on the sign-in page. We use anonymous analytics via Vercel Analytics which does not use cookies or collect personal data. We do not use advertising or tracking cookies.

8. Security and tenant isolation

All data is encrypted in transit (TLS 1.2+) and at rest. Authentication is handled by Supabase with passwordless magic links. coupler. is multi-tenant: every record is tagged with a company identifier and access is enforced at the database level using PostgreSQL Row-Level Security policies, so users of one company cannot access another company's data. We follow industry-standard security practices and conduct regular reviews.

9. International transfers

Data is primarily stored in the EU (Supabase eu-west-1, Ireland) and outbound email is routed via Resend / AWS SES eu-west-1 (Ireland). Any transfers outside the UK/EEA are made under appropriate safeguards (Standard Contractual Clauses or UK Adequacy decisions).

10. Complaints

If you have concerns about how we handle your data, please contact us first at privacy@coupler.software. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Changes to this policy

We may update this policy from time to time. We will notify you by email of any material changes at least 14 days before they take effect.

27 June 2026: Updated operating entity to Apex Build Systems Ltd. Added Resend, Google Places, and Cloudflare Turnstile to the sub-processor list. Removed Stripe (not yet in use). Clarified our role as data processor for tenant-entered business data. Added tenant isolation detail under Section 8.