Privacy notice

Who is responsible for your data

Stedwise is run by Doffy Labs Ltd (company number 17183964, registered office 66 Paul Street, London EC2A 4NA). Doffy Labs Ltd is the controller for account and billing data: who signs in, which organisation they belong to, and how the subscription is paid.

For records about residents, staff, referrals and incidents that a customer keeps in Stedwise, the customer is the controller and Stedwise is its processor, acting only on its instructions under the data processing agreement. If you are a resident or staff member and want to use your rights over those records, contact the organisation that holds them; we will help it respond.

What we collect

The free readiness check

• Your answers, the short profile you give (the rule set you chose, organisation type, number of addresses, whether you are opening new schemes, whether your support is commissioned, whether there is a live Regulator of Social Housing judgement against you, and whether your safety certificates are in date), and the resulting scores.
• Your email address, only if you ask us to email a link to carry on, a sign-up link or a PDF report. Opening a link we email you signs you in, and the first time creates a Stedwise account for that address, so the check can come back to you. You can ask us to delete that account.
• If you send the report to someone else, their email address, used to send it and kept in our email log. Once you have opened a link we emailed you for the check, or kept it in your account, the email names your address and their replies go to you; until then it names nobody. They get the PDF only, not access to your check.
• A cookie that lets this browser return to the checks you started. It holds random values, not your identity.

Accounts

• Name, work email address, organisation and role.
• Sign-in records, and an audit log of views and changes to sensitive records.
• Billing contact and subscription details. Card details go straight to our payment processor and never reach Stedwise.

Why we use it

• To provide the service you asked for, under our contract with you or the steps before it.
• To keep scoring honest and accurate, in our legitimate interests. Answers, scores and outcomes are used for calibration only once anything identifying an organisation has been removed.
• To keep the service secure and to meet legal obligations, including tax and accounting records.

We do not sell personal data, and we do not use it for advertising.

AI and your data

Resident personal data never goes to any AI model. The only inputs a model ever sees are public government text, organisational documents that have passed a personal-data screen, and the answers you give when setting up a document. Any model provider we use must name its processing region, retain nothing, and not train on customer data. Scoring and every decision about a person are deterministic or made by a person, never by a model.

Where it is stored

The database, uploaded files and backups are hosted in the United Kingdom, and the website runs in London. The emails we send (sign-in links, alerts and readiness reports) go through our email provider in the European Union (Ireland), under UK transfer safeguards. Data is encrypted in transit and at rest, and the most sensitive fields (resident, referral and incident narratives) are encrypted individually. See the sub-processor list for who helps us run Stedwise and where.

How long we keep it

• Free check answers, profile and scores are kept while you use the check and for 24 months after it was last used. We then remove your email address, the link to your browser and any emailed report, and keep the answers and scores only in anonymous form, to calibrate our scoring. Ask us and we remove your email address sooner. A check you take into an account becomes part of that account’s data.
• Account data is kept while you have an account. At the end of a contract you can export everything; we then delete it.
• Customers set their own retention period for resident records after a resident leaves, with a sensible default.

Cookies

Stedwise uses two strictly necessary cookies: one keeps you signed in, and one lets your browser return to the readiness checks you started. There are no advertising or analytics cookies, so there is no cookie banner.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict it. Email hello@stedwise.co.uk.

If you want to complain about how we use your data, tell us first: we acknowledge every data protection complaint within 30 days, as the Data (Use and Access) Act 2025 requires. You can also complain to the UK regulator, the Information Commissioner’s Office, which becomes the Information Commission on 30 September 2026.