Skip to main content

Privacy Policy

Last updated: 24 August 2026

Who we are

LandSteward is operated as an independent software service for English farmers. We are the data controller for personal data collected through this website.

Contact us at hello@landsteward.co.uk for any data-related queries.

What data we collect

  • Account data: email address and password (hashed) when you register.
  • Farm data: land types, field areas, postcodes, SBI numbers, and scheme plan details you enter into the calculator or plan builder.
  • Contact and notification data: email address, optional postcode, selected action codes, and whether you subscribe to scheme, action-watchlist, or verified BNG updates.
  • Payment data: billing details are handled entirely by Stripe — we never see or store card numbers.
  • Usage data: pages visited, actions taken, and events logged via Ahoy analytics (stored in our own database — no third-party tracking pixels).
  • Evidence capture data: photographs, notes, GPS coordinates, and timestamps uploaded via the mobile capture feature.

For an anonymous SFI Action Checker watchlist, parcel and farm-area measurements are not saved with your subscription. BNG readiness answers and postcode are not saved when you subscribe to verified BNG updates.

Lawful basis for processing

  • Contract performance — processing your account and farm data to provide the service you signed up for.
  • Legitimate interests (Article 6(1)(f) UK GDPR) — in-app analytics to improve the service and the minimal postcode lookup needed to provide a location check requested by a visitor. For the lookup, we balance this against privacy by transmitting only the postcode and not retaining the BNG postcode in LandSteward.
  • Consent — email notifications for scheme, action-watchlist, or verified BNG updates (you can unsubscribe at any time).
  • Providing the service you requested — the purpose of sending the postcode to Postcodes.io is solely to obtain the country and postcode coordinates needed for the location check.

Third-party processors

We share data only with the following processors, under data processing agreements:

  • Postmark (ActiveCampaign) — transactional email delivery (account confirmations, password resets, scheme alerts).
  • Postcodes.io (Ideal Postcodes Ltd, UK) — receives only the postcode needed to return postcode coordinates and country for location-based checks. LandSteward does not retain the BNG postcode; Postcodes.io may process request logs under its own service practices.
  • Stripe — payment processing for Professional subscriptions. Governed by Stripe's own privacy policy.
  • Tigris / Fly.io — object storage for evidence photographs (Active Storage).
  • Hetzner / Kamal — application hosting infrastructure (EU-based servers).

We do not sell or rent your personal data, or share it with third parties other than the processors listed above. No Google Analytics, Meta Pixel, or third-party advertising trackers are used.

Cookies

We set only two cookies: a session cookie (essential — keeps you logged in) and an Ahoy visitor cookie (analytics — pseudonymous, stored in our own database). No third-party cookies are placed. No cookie consent banner is required under PECR because we do not use non-essential third-party cookies.

Data retention

  • Active accounts: retained until you request deletion.
  • Inactive accounts (no login in 24 months): deleted automatically.
  • Email subscribers (no account): retained for 12 months after last engagement, then deleted.
  • Ahoy events: retained for 24 months.

Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request erasure ("right to be forgotten")
  • Restrict or object to processing
  • Data portability (structured export)
  • Withdraw consent at any time (without affecting prior lawfulness)

Exercise any of these rights by emailing hello@landsteward.co.uk. We will respond within 30 days.

Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the ICO (Information Commissioner's Office) at ico.org.uk.