Privacy notice
HeightFix is the trading name of Mikolaj Mis, a sole trader. 14 Hill Place, Dalkeith, Mayfield EH22 5QD. [email protected].
Last updated 5 November 2026.
Who we are
HeightFix is the trading name of Mikolaj Mis, a sole trader. Our address is 14 Hill Place, Dalkeith, Mayfield EH22 5QD. We decide how your personal information is used, which makes us the “controller” of it. For anything about your information, email [email protected] or call 07498 360605.
What we collect
- When you ask for an estimate: your name, phone number, email address, the address of the job, what needs doing and any photos you add. If you give us other contact numbers (for example a partner, or a neighbour who has a key), we keep those too, so please let those people know.
- When you create an account: your email address and password, your name, phone number, address and any other contact numbers. Your password is stored in scrambled form by our sign-in provider, and we can't see it. If you sign in with Google, Google shares your name and email address with us.
- When we quote for or carry out work: the details of the job, our quotes and invoices, your replies (for example accepting a quote or asking for changes), payments, notes that help us do the job (such as access or parking arrangements) and photos of the work. When you open the link to your quote or invoice, we note the date and time (the first time, then at most once a day), so we know you have seen it.
- If we record our conversation about a job: we only do this if you agree when we ask. The recording is written out as text by computer and then deleted straight away. The text is used to draft your quote, which we always check ourselves before sending. The text is deleted when the quote is made, or after 30 days if it isn't.
- When you pay: for bank transfers and cash we record the amount and the date. Card payments are handled by Stripe: we see that you paid, how much and when, but never your card details.
- When we contact you: we keep a record of the emails we send you (the address, the subject and the date). Texts are sent from our own phone; we note when we start one to you, but not what it says. These, with your enquiries, quotes, invoices, your answers to quotes, your payments and our own notes of calls and visits, make up the history we keep of our dealings with you, and are deleted with them.
- When you use the website: our hosting and sign-in providers keep short-term security logs, such as your IP address and the time of your visit. When you send an estimate request, we also keep a scrambled code made from your IP address for one day, so that one person can't send dozens of requests. The code can't be turned back into your address.
How we use it, and why we're allowed to
- To answer your enquiry and give you a quote, because you asked us to (steps before a contract).
- To carry out the work, arrange visits, send quotes, invoices and receipts, and take payment, to perform our contract with you.
- To keep accounts and tax records, because the law requires it.
- To keep a record of jobs in case of questions, guarantee claims or disputes, to keep our website and systems secure, and to show examples of our work. This is in our legitimate interests, and we make sure it doesn't override your rights.
Photos of our work: we may show photos of finished jobs on our website and social media, but never anything that shows who you are or the full address. If you'd rather we didn't use photos of your job, tell us and we'll take them down.
We don't sell your information, we don't send you marketing without your permission, and we don't make decisions about you by computer alone.
You don't have to give us your details, but without your contact details and the address of the job we can't give you a quote or carry out the work.
Who else handles it
We use a few trusted companies to run the business. They only use your information to provide their service to us, under contracts that require them to keep it safe:
- ForgeAxis, which builds and looks after our website and our enquiry, quote and invoice system.
- Supabase, which stores enquiries, customer records, quotes, invoices and photos on servers in London.
- Hostinger, which provides the server that runs our website (in the United States).
- Resend, which sends our emails, such as quotes, invoices, receipts and booking invitations.
- Cloudflare and GitHub, for backups: every night GitHub's computers make a copy of our records for ForgeAxis, encrypt it with a key only ForgeAxis holds, and store it with Cloudflare in the EU. Neither company can read the stored copy.
- Google, which provides our business email and, if you choose it, “Sign in with Google”.
- Stripe, which handles card payments when you pay by card.
- WhatsApp (Meta), if you choose to message us on WhatsApp: your messages and number are handled under WhatsApp's privacy policy.
- Deepgram, which writes out a recorded conversation as text (in the United States; it keeps the recording only while doing so, and doesn't use it to train its systems), and Anthropic, whose Claude service drafts the quote from that text (in the United States). Only if we recorded our conversation with you.
- Anthropic also marks up photos of the work for your quote: we may send it a photo and the description of that item so its Claude service can show where the work will be done (in the United States).
We may also share information with our accountant and our insurer, and with HMRC, the police or a court where the law requires it.
Some of these companies handle information outside the UK, for example in the United States. Where they do, it is protected by safeguards recognised under UK data protection law, such as the UK–US data bridge or approved contract terms.
How long we keep it
- Enquiries that don't lead to work, and the photos sent with them: deleted two years after you send them, unless a quote for the work is still open.
- Customer records, quotes, invoices, payment records, photos of the work and our record of the emails we sent: six years after the end of the tax year (6 April to 5 April) they belong to, because HMRC requires us to keep tax records. Then they are deleted automatically.
- Your account: until you ask us to close it. We then delete your account details, but keep job records for as long as stated above.
- Recordings of our conversations: deleted as soon as they are written out. The text: when the quote is made, or after 30 days.
- Security logs: kept by our providers for a short time, usually a few weeks.
- Backups: deleted information can stay in our encrypted backups until they expire, up to 31 days for the nightly copies and up to 13 months for one monthly copy. Backups are only used to recover from a fault.
Your rights
You can ask us for a copy of the information we hold about you, and ask us to correct it, delete it, limit how we use it or stop using it. You can also ask for a copy in a format you can take elsewhere. Email [email protected] and we'll reply within one month. Some information we must keep for a while (for example invoices, for tax), and we'll tell you if that applies.
If you're unhappy with how we've handled your information, please complain to us first by emailing [email protected], so we can put it right. We'll let you know we've received your complaint within 30 days and deal with it as quickly as we can. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.
Keeping it safe
Only we can see your records, and they always travel over secure, encrypted connections. The links we send you to view a quote or invoice are long and random. Anyone who has the link can view that document, so please don't share it. We can switch a link off at any time, and an invoice link stops working 30 days after the invoice is paid.
Children
Our services are for adults. We don't knowingly collect information about children.
Changes to this notice
If we change how we use your information, we'll update this page and the date at the top. Our terms and conditions explain how we work with you.