Privacy policy

Last updated: 8 October 2026

This policy explains what personal data Resurface collects, why, who we share it with, how long we keep it and what your rights are. It covers the website at tryresurface.co.uk, the Resurface visualiser that installers put on their own websites, and the hosted visualiser pages at tryresurface.co.uk/your-business-name.

Who we are

Resurface is a trading name of William March, a sole trader based in the UK. Business address: 4a Victoria Grove, Bridport, DT6 5AW.

We are the controller of the personal data described in this policy, except where we say we act for an installer (see "Photos uploaded to an installer's visualiser").

For any privacy question or request, email hello@tryresurface.co.uk or write to the address above. We have not appointed a Data Protection Officer because the law does not require one for our activities.

What we collect and why

When you sign up we collect your business name, email address and, if you give them, your phone number and website. Stripe collects your payment details on its own checkout page. We keep your Stripe customer and subscription IDs, your billing status and your invoices, and we create the visualiser's settings (your business name, logo, colour, quote-button link) and its embed key. We use this to run your subscription, send you your embed code, support you and keep accounting records. Lawful bases: contract, and legal obligation (tax and accounting records).

Photos uploaded to the visualiser

When someone uses the visualiser, on this website or on an installer's website, they upload a photo of a house. We send the photo to our GPU provider to find the roof or driveway and render the new material, and we store the original photo and the rendered images in our cloud storage so the result can be shown and downloaded. We do not use photos to identify anyone, and we do not use photos or renders to train AI models. Please only upload photos you have the right to use, and avoid photos where people can be recognised.

On tryresurface.co.uk (the demo) we are the controller. Lawful basis: legitimate interests, which are showing how the product works.
On an installer's website or hosted page we process the photo on behalf of that installer, to provide the visualiser they pay for. The installer decides how they use the service and is responsible for telling their visitors about it.

We keep uploaded photos and renders for [PHOTO RETENTION].

Visualiser usage records

For each visualiser we record anonymous usage events, such as the visualiser loading, a photo being added, a preview being rendered or an error, with a random session ID, the website and page it was used on, and the browser's user agent. We use them to count previews against the monthly allowance, to show installers how their visualiser is used, to find faults and to stop abuse. Lawful basis: legitimate interests, which are running, metering and protecting the service.

Messages you send us

If you use the chat, the contact form or email, we keep your name, email address, phone number and business name (where you give them), the page you sent it from, and the messages. Before the chat opens we ask for your name and email and for your agreement to keep them and to email you copies of our replies; we record that agreement with the time and the wording you agreed to. Replies to the chat and the contact form are shown on the site and also emailed to you. We also keep a scrambled (hashed) version of your IP address for a short time to stop spam. Chat and contact messages are forwarded to us through Telegram, an encrypted SimpleX Chat bridge we run ourselves, and email, so that we can reply quickly. Your browser keeps your chat in local storage so you can carry on the conversation. Lawful basis: consent for the chat (you can withdraw it at any time by emailing hello@tryresurface.co.uk, and we will stop emailing you); legitimate interests, which are answering enquiries, for the contact form and email; or contract, where the message is about your subscription.

Site statistics and session recordings

Our own site statistics record how visitors use tryresurface.co.uk: the pages you visit, the site or ad that brought you here, how long you stay active, and a recording of your visit made of pointer movements, clicks (with the label of what you clicked), scrolling and when you press keys (never which keys). Each record carries a random visitor ID (the lake_id cookie), your browser and device type, screen size, language, time zone, country, network (ASN) and IP address. When you check out, our server can link these records to your new account. We use this only to understand how the site is used, find and fix problems and see which of our ads lead to enquiries and sign-ups, never to show you advertising. Lawful basis: legitimate interests, which are improving the site and measuring our own marketing. It is on unless you turn it off: open Cookie settings at the bottom of any page and switch off Site statistics, or click Reject all. It stops straight away, and we delete its data in your browser and expire the lake_id cookie. These statistics run only on Resurface's own pages, never inside an installer's visualiser or hosted page.

If you accept advertising and analytics cookies, Google Ads and Google Analytics collect cookie identifiers, the pages you visit, ad click IDs and device and approximate location information. We use this to see which ads bring visitors and enquiries and how the site is used. We also keep a note of the ad or campaign that brought you here (the rs_attr cookie, 90 days); if you then contact us or subscribe, we store that note with your enquiry or account and in your Stripe checkout record, so we can tell which ads work.

If you have given consent and you contact us or subscribe, your browser also sends Google a scrambled (hashed) copy of your email address so it can match the enquiry or subscription to an ad ("enhanced conversions"). Lawful basis: consent. None of this happens unless you click Accept in our cookie banner, and none of it runs inside an installer's visualiser or hosted page.

Automated decisions

We do not make decisions about you by automated means alone that have legal or similarly significant effects on you. The monthly preview allowance and spam limits are automated, but they do not have that kind of effect.

We use the following service providers, called processors. They handle personal data on our behalf, under contracts that require them to protect it and use it only on our instructions.

Cloudflare, Inc. hosts the website, our database, the photo and render storage and our site statistics, and handles all the data described above. Its global network includes the US.
Runpod, Inc. provides the GPU servers that detect the roof or driveway and render the new material. It handles uploaded photos and renders, in datacentres in the US and the EU.
Stripe Payments Europe, Limited and Stripe, Inc. process payments and subscriptions. They handle your name, email, payment details and subscription data. Stripe also acts as a separate controller for some data it needs to prevent fraud and meet its own legal obligations, and its own privacy policy covers that data.
Resend (Plus Five Five, Inc.) sends our emails, such as your embed code, our replies to your chat or contact messages, and alerts of new messages to us. It handles email addresses and the content of those emails, in the US.
Telegram (Telegram Messenger Inc. and its affiliates) relays chat and contact messages to our phone so we can answer them. It handles the messages and the contact details in them.
Google Ireland Limited provides Google Ads and Google Analytics, only if you consent. It handles cookie identifiers, browsing activity on our site, ad click IDs and, for enhanced conversions, your hashed email address. Data may be processed in the US.

We may also share data:

with the installer whose visualiser you used, as described above;
with professional advisers, such as lawyers and accountants, under confidentiality;
with the police, regulators or courts when the law requires it;
with a buyer, if the business is sold. We would tell you first.

We do not sell your personal data.

International transfers

Some of our providers process data outside the UK, mainly in the US. When personal data leaves the UK, we rely on one of these safeguards:

the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified under it;
otherwise, the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses.

Transfers to EU countries, including Runpod's EU datacentres, are covered by UK adequacy regulations.

You can ask for a copy of the relevant safeguards by emailing hello@tryresurface.co.uk.

How long we keep data

Data	How long we keep it
Uploaded photos and renders	[PHOTO RETENTION]
Installer account and visualiser settings	While the subscription is active; deleted within 30 days after it ends, unless you ask us to keep it
Visualiser usage records	[USAGE RECORD RETENTION]
Chat and contact messages	2 years
Site statistics events	Up to 90 days
Session recordings	[RECORDING RETENTION]
Ad click note (`rs_attr`) stored with an enquiry or account	As long as the enquiry or account record
Stripe IDs, invoices and billing records	6 years, as HMRC requires
Google Analytics data	14 months

We may keep data for longer if we need it to deal with a legal claim, or if the law requires it.

Your rights

Under UK data protection law, you have the right to:

get a copy of the personal data we hold about you;
have data that is wrong or incomplete corrected;
have your data deleted, in some circumstances;
restrict how we use your data, in some circumstances;
receive the data you gave us in a machine-readable format, or have it sent to another provider;
object to our use of your data where we rely on legitimate interests;
withdraw your consent at any time where we rely on consent, for example for advertising cookies. Use the "Cookie settings" link in the footer. Withdrawing consent does not affect anything we did before you withdrew it.

To use any of these rights, email hello@tryresurface.co.uk. We may ask you to confirm your identity. We will reply within one month. If your request is complex, we can take up to two more months, and we will tell you if we need to. If you used an installer's visualiser, you can also ask the installer, and we will help them answer.

Cookies

We use a small number of cookies and similar browser storage. Necessary ones are always on. Our own site statistics are on unless you turn them off. Google's advertising and analytics cookies are only set if you click Accept. Our Cookie policy lists each one, what it does and how long it lasts, and the "Cookie settings" link in the footer lets you change your choice at any time.

Security

We protect your data with encrypted connections (HTTPS), access controls on our systems, HttpOnly and Secure cookies for the admin area, secret keys for our internal services, and rate limits against abuse. No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will report it to the ICO within 72 hours of becoming aware of it. If the risk to you is high, we will also tell you without undue delay.

Children

Resurface is a service for businesses and is not intended for children. You must be 18 or over to subscribe.

Changes to this policy

If we make significant changes, we will tell subscribers by email or with a notice on the site before the changes take effect. The date at the top shows when this policy last changed.

Complaints

Please contact us first at hello@tryresurface.co.uk so we can try to put things right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.