Privacy Policy
- NE1 Electrical Ltd is responsible for your personal data on iZapp. We follow the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.
- We collect what we need to run your account and the features you use. We do not sell your data, show adverts, or use advertising or analytics cookies.
- If you link to a lecturer or college, they can see your learning progress. If you run a business on iZapp, your customers' data is yours — we just store and process it for you.
- Some features send data to trusted providers (for example, Stripe for payments and OpenAI/Anthropic for AI features). They are listed below.
- You can ask to see, correct, export or delete your data at any time by emailing hello@izapp.app.
1. Who we are
iZapp.app is operated by NE1 Electrical Ltd (company number 12082633, registered in England and Wales; registered office: 379 Stamfordham Road, Newcastle upon Tyne, NE5 2LH). For your iZapp account data we are the controller.
Contact us about privacy at hello@izapp.app or by post at the address above, marked "Data Protection". We are not required to appoint a Data Protection Officer; privacy questions are handled by the company's director.
2. Who this policy covers
- Users — apprentices, electricians, lecturers, education providers and team members with an iZapp account.
- Visitors to izapp.app who do not have an account.
- Customers and contacts of our business users — for example, people who receive a quote, invoice, certificate, booking confirmation, review request or WhatsApp message sent through iZapp, or who book through a business's iZapp booking page. See section 6.
3. What we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Account | Name (optional), email address, password (stored only as a one-way hash), account type, date joined, the version of our terms you accepted and when, confirmation that you are 16 or over, theme and notification preferences, two-factor authentication settings | You |
| Profile and company | Company name, logo, address, phone, registration/scheme details, signatures, test instrument details, payment terms | You |
| Learning | Quiz answers and scores, flashcard and revision history, simulator and game results, AM2 practice, portfolio/NVQ evidence, job logs, off-the-job hours, task submissions, CPD records | You, your use of the Service |
| Lecturer and college records | Cohort membership, marks and feedback, sign-offs, red/amber/green (RAG) progress ratings and "at risk" flags, announcements and messages | Your lecturer or college, and calculated by the Service (see section 5) |
| Business records | Customers, jobs, quotes, invoices, payments recorded, credit notes, certificates and test results, RAMS, photos, notes, price book, bookings, calendar | You (we process this on your behalf — see section 6) |
| Team records | Team members' names and roles, qualifications, timesheets, leave requests, expenses, mileage | Team owners and members |
| Community content | Message-board posts, "ZAPs" (likes), reports you make, cohort and lecturer messages | You and other users |
| Purchases | ZAPPs+ purchases, Stripe customer ID, payment status, ZAPPs balances and history, your agreement to immediate supply of digital content. We never receive or store your full card details. | You and Stripe |
| AI features | Questions you ask, photos you upload for scanning (for example consumer-unit labels or test-instrument screens), the AI's response, which feature was used and when | You |
| WhatsApp (optional) | Your WhatsApp Business connection details (access tokens are stored encrypted); messages exchanged with your customers and their phone numbers; opt-outs | You, your customers, Meta |
| Usage | Which sections of iZapp you use, how many pages you view there and how much active time you spend in them, stored as daily totals per section (for example "Quizzes: 12 minutes on 3 October"). We do not record what you type or the content of pages. | Your use of the Service |
| Technical and security | IP address, browser and device type, last time you were active, log-in and security events, push-notification subscription (only if you allow notifications), error logs, rate-limit records | Your device |
| Email delivery | Whether emails were sent or failed; if a business user switches on read receipts, when a quote or invoice email was opened | Our systems |
| Support | Messages you send us and our replies | You |
Sensitive information. We do not ask for health, ethnicity, religion or other "special category" information and you should not enter it (for example in notes, leave requests or community posts). If a team owner needs to record something like sickness absence, they are responsible for having a lawful reason to do so.
4. How we use your data and our legal reasons
Data protection law requires a lawful basis for each use. Ours are:
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, providing the features you use, and keeping your records | Contract |
| Selling ZAPPs+, taking payment, sending receipts and handling refunds | Contract; legal obligation (tax and accounting records) |
| Sending documents, reminders, booking confirmations and messages that you (or a business user) ask us to send | Contract; for recipients, the business user's legitimate interests or contract with them |
| Sending service emails and in-app notifications (security alerts, password resets, receipts, changes to terms) | Contract; legitimate interests |
| Push notifications to your device | Consent (you can switch them off at any time in your browser or notification settings) |
| Linking you to a lecturer or college and sharing your progress with them | Contract (you choose to link); for colleges, also their legitimate interests or public task in delivering your apprenticeship |
| Calculating RAG progress ratings and "at risk" flags for lecturers | Legitimate interests (helping lecturers support learners) |
| AI features | Contract (you choose to use them) |
| Running community features, moderating content, handling reports and keeping users safe | Legitimate interests; legal obligation (Online Safety Act 2023) |
| Security, fraud and abuse prevention, rate limiting, bot detection and keeping logs | Legitimate interests |
| Understanding which features are used and for how long, so we can fix problems and decide what to improve and invest in (our own first-party statistics — we do not use third-party analytics) | Legitimate interests |
| Responding to support requests, complaints and rights requests | Legitimate interests; legal obligation |
| Complying with the law and defending legal claims | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for more detail and you have the right to object (see section 11).
5. Lecturers, colleges and learner progress
- If you link your account to a lecturer or college (for example with a subscribe or invite code), they can see your name, email address, quiz and simulator results, task submissions, portfolio/NVQ evidence, off-the-job hours, progress and RAG rating, and can message you.
- The Service automatically suggests a red/amber/green rating and may flag a learner as "at risk" using recent activity, quiz performance and engagement. This is a form of profiling. It is only a prompt for your lecturer to offer support; it does not make any decision about you on its own and has no legal or similarly significant effect. Lecturers can review and override it. You can ask us how it works or object to it.
- Where a college or training provider uses iZapp under an agreement with us to deliver your apprenticeship, the college may also be a controller of your learning records. Its own privacy notice will explain how it uses them.
- You can ask your lecturer to remove you from their cohort, or ask us to remove the link.
6. If you are a customer of an iZapp business user
Electricians and other businesses use iZapp to manage their work. If a business has sent you a quote, invoice, certificate, booking confirmation, review request or WhatsApp message through iZapp, or you have booked with them through an iZapp booking page, that business is the controller of your information and decides how it is used. We store and process it on their behalf as their processor, under a contract that requires us to keep it secure and confidential and only use it to provide our service to them.
Please contact the business directly with questions or to exercise your rights. If you cannot reach them, contact us and we will pass your request on. Some emails sent through iZapp may contain a small "read receipt" image that tells the business when you opened the email, if the business has turned that feature on. You can stop this by not loading images in your email app.
7. AI features
- When you use an AI feature, the text you type or the image you upload is sent to our AI provider to produce a response: OpenAI (AI Tools and some text features) or Anthropic (consumer-unit and test-instrument photo scanning, the BS 7671 Regulations Assistant and the Scheme of Work generator). The provider used for each feature may change; this list will be kept up to date.
- Under their business API terms, these providers do not use data sent through their APIs to train their models, and may keep it for a limited period (normally up to 30 days) to detect misuse before deleting it.
- We keep a record of which AI feature you used, when, and how many ZAPPs+ it cost, and may store common questions and answers to speed up the Regulations Assistant. Our administrators are notified when AI features are used so we can monitor costs and misuse.
- Please avoid including personal data (customers' names, addresses or faces in photos) in AI requests unless it is needed.
- AI features do not make decisions about you.
8. Who we share data with
We do not sell personal data and we do not share it for advertising. We share it only as follows:
People you choose to share with
- Lecturers, colleges and cohort members you link to (section 5); your team owner or team members; customers you send documents or messages to; and other logged-in users who can see your message-board posts and display name.
Service providers (our processors / sub-processors)
| Provider | What for | Where |
|---|---|---|
| IONOS (IONOS Cloud Ltd / IONOS SE) | Hosting the servers that run iZapp and store its database, files and backups; sending email (account emails, notifications, and emails business users send to their customers) | UK / EU |
| Stripe Payments Europe Ltd / Stripe, Inc. | Payment processing, fraud prevention, receipts | EU / US |
| OpenAI, L.L.C. / OpenAI Ireland Ltd | AI features (see section 7) | US |
| Anthropic PBC | AI features (see section 7) | US |
| Meta Platforms (WhatsApp Business Platform) | Only if a business user connects WhatsApp: sending and receiving WhatsApp messages | EU / US |
| Browser push services (Google, Apple, Mozilla, Microsoft) | Only if you allow notifications: delivering push notifications to your device | US / EU |
| Content delivery networks (cdnjs / Cloudflare, unpkg, jsDelivr) | Delivering some open-source code libraries to your browser; they receive your IP address and browser details when files are downloaded | Global |
| YouTube (Google) / Vimeo | Tutorial thumbnails load from their image servers (they receive your IP address; no cookies are set). The video player itself only loads when you choose to play a video (see our Cookie Policy) | US / EU |
We will update this list before adding a new provider that handles personal data.
Other situations
- Professional advisers (such as accountants, lawyers and insurers) where needed.
- The police, regulators, courts or others where the law requires it, to protect someone from harm, or to establish or defend legal claims.
- A buyer or investor if the business or Service is sold or restructured, under confidentiality obligations. We would tell you if this happened.
9. International transfers
Some providers above process data outside the UK, mainly in the United States. When that happens we make sure the transfer is protected as UK law requires — either because the country or organisation is covered by UK "adequacy" regulations (for example, US organisations certified to the UK Extension to the EU–US Data Privacy Framework) or because we have the UK International Data Transfer Agreement or Addendum (standard contractual clauses) in place. Contact us for more information.
10. How long we keep data
| Data | How long |
|---|---|
| Your account and the content in it (including learning and business records) | While your account is open. When you close it, we delete or anonymise it within 30 days, and it drops out of rolling backups within a further 35 days. |
| Accounts that are never used | Accounts that never log in again after registering and contain no content may be deleted as part of removing bot and spam sign-ups. |
| Inactive accounts | We may close accounts inactive for more than 3 years, after emailing you at least 30 days beforehand. |
| Records of purchases, refunds and invoices we issue | 6 years from the end of the financial year they relate to, to meet HMRC and Companies Act requirements. |
| Record of the terms you accepted and your agreement to immediate supply of ZAPPs+ | For as long as your account is open and then 6 years, in case of a dispute. |
| Message-board posts | Until you or we delete them, or your account is closed. |
| Content reports and moderation decisions | Up to 2 years, or longer if needed for a legal claim or to report illegal content. |
| AI usage records | Up to 2 years (for billing and abuse monitoring). |
| Usage statistics (daily totals per section) | Up to 400 days, then deleted automatically. |
| Security and server logs | Up to 12 months, unless needed to investigate an incident. |
| Password-reset and email-verification links | Single-use and time-limited (a password-reset link expires after 60 minutes). |
| Support emails and complaints | Up to 2 years after the matter is closed. |
Business users: certificates and business records you create belong to you. Please download your own copies — you, not iZapp, are responsible for keeping them for as long as your scheme, insurer or the law requires.
11. Your rights
Under UK data protection law you have the right to:
- access your personal data and get a copy of it;
- have inaccurate data corrected (you can update most details yourself in Settings);
- have your data deleted;
- restrict how we use it;
- object to us using it on the basis of legitimate interests (including the RAG/at-risk profiling in section 5), and to direct marketing at any time;
- data portability — receive data you gave us in a commonly used, machine-readable format (many lists can also be exported as CSV directly from the app);
- withdraw consent where we rely on consent (for example push notifications), without affecting what we did before; and
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects (we do not make any such decisions).
To use any of these rights, email hello@izapp.app from the email address on your account. There is normally no charge. We will reply within one month (we may extend this by up to two further months for complex requests and will tell you if so). We may need to confirm your identity or ask what information you need, and the time limit pauses until we have it. Some rights have exceptions — for example, we may need to keep purchase records for tax law.
12. Complaints
If you are unhappy with how we have handled your personal data, please complain to us first at hello@izapp.app with "Data protection complaint" in the subject. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
If you are not satisfied with our response, you also have the right to complain to the UK data protection regulator (ico.org.uk), which will usually expect you to have raised it with us first.
13. Users aged 16 and 17
iZapp is not for anyone under 16. Many of our users are apprentices aged 16 or 17, so we follow the Age Appropriate Design Code (the Children's Code): we do not show adverts, do not use advertising or tracking cookies, do not sell or share data for marketing, do not collect precise location, and keep profiling limited to the learning support described in section 5. Community features are only open to logged-in users and we prioritise reports involving younger users. If you think someone under 16 has an account, tell us at hello@izapp.app and we will delete it.
14. Emails, notifications and marketing
- We send service emails you need to use iZapp (account verification, password resets, security alerts, receipts, important changes). You cannot opt out of these while you have an account.
- In-app and push notifications can be managed in your notification settings and your browser.
- We do not currently send marketing emails. If we do in future, we will only do so with your consent (or, for existing users, about similar iZapp features with a clear opt-out in every message), and you can unsubscribe at any time.
15. Cookies and similar technologies
We only use cookies and similar technologies that are strictly necessary for the Service or that you ask for (such as saving a draft or your preferences). We do not use advertising, cross-site tracking or third-party analytics cookies, so we do not need a cookie consent banner. Embedded videos from YouTube or Vimeo only load when you choose to play them. Full details are in our Cookie Policy.
16. Security
We protect data with HTTPS encryption in transit, one-way hashed passwords, optional two-factor authentication, HTTP-only session cookies, protection against cross-site request forgery, rate limiting, role-based access controls, encrypted storage of third-party access tokens, and regular backups. Access to personal data is limited to people who need it. No system is perfectly secure; if we suffer a breach that is likely to put you at risk, we will tell you and the relevant authorities as the law requires. Please report vulnerabilities to hello@izapp.app.
17. Changes to this policy
We will update this policy when our services or the law change. If changes are significant, we will tell you by email or in the app before they take effect. The date and version at the top show when it was last updated.