Privacy Policy

1. Who we are

Apex Build Systems Ltd ("we", "us"), trading as Coupler, operates the coupler. scaffolding business management platform.

We act as the data controller for the account data of registered users (people who log in to coupler.). For the business data that subscribing companies enter about their own clients, staff and projects, we act as the data processor on behalf of those companies, who are themselves the data controllers of that information. This policy explains what data we collect, why, and how you can exercise your rights under UK GDPR and the Data Protection Act 2018.

2. Data we collect

3. Why we process your data

• Contract performance — to provide and maintain the coupler. service
• Legitimate interests — to improve the platform, prevent fraud, and ensure security
• Legal obligation — to comply with UK tax, accounting, and legal requirements
• Consent — for marketing communications (you can withdraw at any time)

4. Sub-processors we use

We do not sell your data. We rely on the following sub-processors to operate the service. Each is bound by GDPR-compliant data processing terms and is located in the UK or EEA, or transfers data under appropriate safeguards:

• Supabase — database, authentication and file storage. Data stored in Ireland (eu-west-1).
• Vercel — application hosting and CDN.
• Resend (via AWS SES) — outbound email delivery. Emails routed via Ireland (eu-west-1).
• Google Places API — address autocomplete. Only the partial address you type is sent to Google to retrieve suggestions; we do not associate it with your account on Google's side.
• Cloudflare Turnstile — bot protection on sign-in. Sets a strictly-necessary challenge cookie; no personal data is collected.
• Legal authorities — where compelled by court order or other legal obligation.

Connected mailboxes (Microsoft 365 and Google)

A company director can choose to connect the company's own Microsoft 365 or Google (Gmail / Google Workspace) mailbox under Settings → Integrations, so that quotes, invoices and certificates are sent from that mailbox instead of from coupler.'s own sending address. This is optional and can be disconnected at any time.

• What we ask for: permission to send email on the mailbox's behalf, plus the mailbox's email address and name. For Google this is the gmail.send permission only; for Microsoft it is Mail.Send. We cannot read, search, delete or change any email in the mailbox.
• How we use it: only to send the emails a user of your company chooses to send from coupler. (or that your company has switched on as automated client emails), to the recipients shown, with the content and attachments you see in coupler. We use it for nothing else.
• What we store: the access tokens Microsoft or Google issue, encrypted at rest, and the mailbox address. A record of each email sent (recipient, subject, time, status) is kept in the email send log described in Section 5. We do not store any other content from the mailbox.
• Sharing: we do not sell, transfer or share data obtained from a connected mailbox with anyone, do not use it for advertising, and do not use it to train AI or machine-learning models. No person at coupler. reads it except where you ask us to for support, where needed for security, or where the law requires.
• Disconnecting: when a director disconnects the mailbox, we delete the stored tokens immediately. You can also remove coupler.'s access from your Google account (myaccount.google.com/permissions) or your Microsoft account at any time.

coupler.'s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data retention

We retain account data for the duration of your subscription plus 2 years, or as required by law. Business data (quotes, invoices etc.) is retained for 7 years to meet HMRC requirements. You may request deletion of personal data at any time, subject to legal obligations — or use the self-serve "Delete company" tool under Settings → Account & Password.

Email send logs: we keep an audit record (recipient address, subject line, sent timestamp, Resend message ID, delivery status) for 7 years to support tax and dispute investigations. The 500-character body preview captured at send time is automatically nulled after 90 days.

6. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Restrict or object to processing
• Data portability — receive your data in a machine-readable format
• Withdraw consent at any time (where processing is consent-based)

To exercise any right, email us at privacy@coupler.software. We will respond within 30 days.

7. Cookies

We use strictly necessary cookies for authentication (session tokens) and a strictly necessary challenge cookie set by Cloudflare Turnstile on the sign-in page. We use anonymous analytics via Vercel Analytics which does not use cookies or collect personal data. We do not use advertising or tracking cookies.

8. Security and tenant isolation

All data is encrypted in transit (TLS 1.2+) and at rest. Authentication is handled by Supabase with passwordless magic links. coupler. is multi-tenant: every record is tagged with a company identifier and access is enforced at the database level using PostgreSQL Row-Level Security policies, so users of one company cannot access another company's data. We follow industry-standard security practices and conduct regular reviews.

9. International transfers

Data is primarily stored in the EU (Supabase eu-west-1, Ireland) and outbound email is routed via Resend / AWS SES eu-west-1 (Ireland). Any transfers outside the UK/EEA are made under appropriate safeguards (Standard Contractual Clauses or UK Adequacy decisions).

10. Complaints

If you have concerns about how we handle your data, please contact us first at privacy@coupler.software. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Changes to this policy

We may update this policy from time to time. We will notify you by email of any material changes at least 14 days before they take effect.

5 October 2026: Added “Connected mailboxes” under Section 4 — what Microsoft 365 and Google mailbox connection can and cannot do, what we store, and our Google API Limited Use commitment.

27 June 2026: Updated operating entity to Apex Build Systems Ltd. Added Resend, Google Places, and Cloudflare Turnstile to the sub-processor list. Removed Stripe (not yet in use). Clarified our role as data processor for tenant-entered business data. Added tenant isolation detail under Section 8.