Privacy Policy

1. Introduction

Segura IT Solutions Ltd, trading as Addresso ("we," "our," or "us"), is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our UK address lookup API and web dashboard (the "Service").

By using Addresso, you agree to the collection and use of information in accordance with this policy. UK company registration: 12567218.

2. Information We Collect

Personal Information

When you register for an account, we collect:

• Full name
• Email address
• Password (stored securely using bcrypt hashing — we never store plain text passwords)

Organisation Information

When you create an organisation, we collect:

• Organisation name
• Billing email (optional)

Payment Information

Payment card details are collected and processed exclusively by Stripe. We do not store, see, or have access to your full card number. We retain only:

• Stripe customer ID (an opaque identifier)
• Transaction records (amounts, dates, invoice links)

Usage Data

We automatically log API usage data including the endpoint called, the query sent (e.g. postcode searched), the number of results returned, and the API key used. This is necessary for credit deduction, abuse prevention, and providing usage analytics in your dashboard.

Third-Party Data Sources

Address data is sourced from the Royal Mail Postcode Address File (PAF). Geolocation data (latitude and longitude) is sourced from the Office for National Statistics (ONS) Postcode Directory and contains OS data © Crown copyright and database right 2025, licensed under the Open Government Licence v.3.0. These datasets do not contain personal data.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process your account registration and manage your profile
• Process credit purchases and manage your credit balance
• Track API usage and deduct credits accurately
• Send transactional emails (verification, purchase confirmations, low-credit alerts)
• Detect and prevent fraud, abuse, or security issues
• Comply with legal obligations

We do not use your information for marketing purposes without your explicit consent.

4. Legal Basis (UK GDPR)

Our processing of your personal data relies on:

• Contractual necessity — to provide the Service you have signed up for
• Legitimate interests — fraud prevention, service improvement, and security
• Legal compliance — to meet our legal and regulatory obligations
• Consent — where applicable, which you may withdraw at any time

5. Data Sharing

We do not sell your personal information. We may share data with:

• Stripe — for payment processing (subject to Stripe's privacy policy)
• Amazon Web Services (AWS) — for email delivery (SES) and hosting infrastructure
• Legal authorities — when required by law or to protect our rights

We do not share data with any other third parties except during a business transfer or merger, in which case you would be notified.

6. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing (bcrypt)
• API key hashing (keys are never stored in plain text)
• Two-factor authentication (2FA) option for your account
• Access controls and authentication for our systems

While we implement industry-standard safeguards, no electronic transmission over the internet can be guaranteed to be 100% secure.

7. Cookies

We use essential cookies only to maintain your authenticated session. We do not use third-party advertising or tracking cookies. We use Fathom Analytics for privacy-friendly, cookieless website analytics that does not track personal data.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you services. Specifically:

• Account data is retained while your account exists
• Transaction records are retained for a minimum of 6 years for tax and legal compliance
• API usage logs are retained for up to 24 months
• If you delete your account, personal data will be deleted or anonymised within 30 days, unless retention is legally required

9. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Request restriction of processing
• Data portability (receive your data in a structured format)
• Object to certain types of processing
• Withdraw consent at any time
• Lodge a complaint with the Information Commissioner's Office (ICO)

To exercise these rights, please contact us at [email protected].

10. Children's Privacy

Addresso is not intended for users under the age of 18. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of Addresso after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

[email protected]

Segura IT Solutions Ltd, 4 Swallowood Ct, Rotherham, S63 6HS, United Kingdom.