Privacy Policy
Last updated: 5 July 2026
1. Introduction
BuildSales.Homes ("BuildSales", "we", "our", or "us") operates the BuildSales.Homes platform: the public marketing site at buildsales.homes, the public sales demo, bespoke buyer-facing sales portals for UK housebuilders and developers, and the admin/sales tools those teams use. This policy explains, honestly and in full, what data we collect on each of those surfaces, why, on what legal basis, and for how long.
This page replaces an earlier version that said we use "essential cookies only". That was inaccurate — we also run analytics and outreach-tracking technologies, described in full below, gated behind your cookie consent where the law requires it.
2. Who is responsible for your data
BuildSales.Homes is the data controller for buildsales.homes and the public sales demo. We are still completing our formal company registration details on this page (registered company name, number, office and VAT number) — for our current company information, contact us at the email address in section 11.
On a developer's own buyer portal (a subdomain such as a housebuilder's<developer>.buildsales.homes), that developer is the data controller for the buyer-analytics data described in section 5 — BuildSales.Homes processes it on their behalf as their data processor, under a data-processing agreement with that developer.
3. Cookies and consent
When you first visit buildsales.homes, a demo, or a buyer portal, a banner asks you to accept or reject non-essential cookies — with equal-prominence buttons and nothing pre-ticked. Your choice is stored in the bs_consent cookie and is the single switch every tracker below checks before it runs. You can change your mind at any time using Manage cookies in the footer of every page.
bs_consent — your cookie choice
Remembers whether you accepted or rejected non-essential cookies, so we don't ask you again on every page. We also log the choice once (with a device hint where available, never your name) to an internal, append-only consent record, so we can demonstrate compliance if asked.
- Lawful basis
- Strictly necessary
- Consent required
- No — this is the consent record itself
- Retention
- 12 months, or until you change your choice
4. Analytics and tracking cookies
These only run once you have accepted cookies. If you reject non-essential cookies, none of the following are set or fired — the site still works, you just won't be recognised on a return visit.
Umami analytics (self-hosted, analytics.buildsales.homes)
Aggregate, privacy-focused analytics we host ourselves — page views, top pages and referrers for the public site. We do not use Google Analytics or any third-party ad-tech analytics.
- Lawful basis
- Consent
- Consent required
- Yes — the analytics script only loads after Accept
- Retention
- Aggregate stats in our own Umami instance
bs_vid — durable visitor id
A random, opaque identifier — not your name or email — that lets us recognise a repeat visit across the site, the demo and buyer portals, so analytics and dwell-time stats aren't double counted. It carries no meaning on its own.
- Lawful basis
- Consent (PECR non-essential cookie)
- Consent required
- Yes — never set until you accept
- Retention
- 400 days from setting
bs_ref — outreach attribution cookie
If you arrive via a personalised tracking link we sent to a named business contact (buildsales.homes/d/<code>), this short-lived cookie carries that link's code so a same-session visit to the demo still resolves back to the right contact. The primary carrier is a one-time URL parameter, not a cookie — this is only a same-session fallback.
- Lawful basis
- Consent (PECR non-essential cookie)
- Consent required
- Yes
- Retention
- 30 minutes
5. Buyer portal analytics (page views, dwell time, events)
On a developer's buyer portal and the public demo, we record which pages are viewed, how long is spent on them, and specific interactions (for example opening a house type, selecting a plot, reaching a booking step) so the developer's sales team can see how buyers are engaging. This also covers the Customer Plot Portal (CPP) page a sales exec shares with a named buyer.
buyer_views / buyer_dwell / buyer_events
Recorded only once you have accepted cookies. A durable visitor id (bs_vid, above) is attached only when consent is present, so we can tell a returning visit from a new one. For a real developer's portal, that developer is the data controller for this analytics data and BuildSales.Homes processes it on their behalf, under a data-processing agreement.
- Lawful basis
- Consent (PECR non-essential)
- Controller
- The developer, for their own portal; BuildSales.Homes for the demo
- Retention
- 24 months from the event
6. Outreach and tracking-link logging (B2B, legitimate interests)
BuildSales.Homes runs a direct B2B outreach programme, sending personalised tracking links to named contacts at housebuilders and developers we would like to work with, and helping developer sales teams share tracked links with their own named customers. These links are server-side redirects, not analytics cookies, so they are not gated by the cookie banner — they rely on a different lawful basis, described below.
outreach_clicks — /d/<code> tracking links (BuildSales.Homes' own outreach)
Every hit on one of our own outreach links — human or automated (bot/link-preview crawlers are logged too, flagged as such, never silently dropped) — is logged: the tracking code, an approximate location derived from your IP address (country, region, city), your network operator (ISP/ASN), and the referring page. We use this to see whether a named business contact engaged with a link we sent them.
- Lawful basis
- Legitimate interests — targeted B2B business development
- Consent required
- No — server-side click log, not a cookie
- Retention
- 24 months from the click
customer_crm_clicks — /c/<code> tracking links (a developer's own customer links)
The same mechanism, used when a developer's sales exec shares a tracked link (for example to a plot page) with one of their own named customer contacts. Logs the same data class as above, associated with that contact's record inside the developer's own workspace. The developer is the controller of this processing; BuildSales.Homes processes it on their behalf.
- Lawful basis
- Legitimate interests — the developer's own customer relationship
- Consent required
- No — server-side click log, not a cookie
- Retention
- 24 months from the click
You can ask us to stop this processing or to erase your data from either ledger at any time — see "Your rights" in section 8.
7. Cookieless site analytics
site_pageviews — aggregate public-site counter
A simple visit counter for the public marketing pages. No cookie is set, and we never store your IP address or user-agent string. Each page load is combined with a secret value that changes every day and is thrown away after 48 hours, so the resulting record can never be traced back to you or linked across days.
- Lawful basis
- Not applicable — no cookie, no personal data stored
- Consent required
- No
- Retention
- Aggregate counts only
8. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure of your data (including from the tracking ledgers described above)
- Restrict or object to our processing — including objecting to legitimate-interest processing such as outreach tracking
- Receive a copy of your data in a portable format
- Withdraw consent at any time, for anything that relies on consent, without affecting processing already carried out
To exercise any of these rights, contact us at the email address in section 11. If you are not satisfied with our response, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint, or by phone on 0303 123 1113.
9. Third-party services
We integrate with third-party services to provide our functionality:
- Google Drive: When you link a Google Drive folder, we access files you explicitly share with our service account to import assets
- Dropbox: When you provide a Dropbox shared link, we access the files in that folder to import assets
- Contabo: Our hosting and data infrastructure provider, including the self-hosted email server we use to send authentication codes
We only access files and folders you explicitly provide links to. We do not access any other files in your cloud storage accounts.
10. Data storage and security
Your data is stored on our own Contabo-hosted infrastructure. Concrete controls in place:
- Data encrypted in transit (HTTPS) and at rest
- Row-level database security and least-privilege staff access — people see only the organisations and developments their role requires
- Append-only audit logging for sensitive records (audit trail, buyer analytics, document control) that cannot be edited or deleted, only added to
- Automated intrusion-ban protection (fail2ban) on our self-hosted mail infrastructure against repeated failed login attempts
- A GDPR redaction process to erase or anonymise an individual's personal data on request, including from append-only logs, without breaking the integrity of the rest of the record
11. Contact us
If you have questions about this Privacy Policy, or want to exercise any of your rights, contact us at:
Email: privacy@buildsales.homes
12. Changes to this policy
We may update this Privacy Policy as the product changes. We will update the "Last updated" date above whenever we do, and material changes will be communicated where practical.