Privacy at Croft
What Croft collects, who can see it, and what it never records.
Our privacy promise
We never sell your data. Your trust is more valuable than any sale.
Your information, your family's information, and the data from your home monitoring system belongs to you. We never sell it or rent it, and your home monitoring data is never shared with marketers or data brokers. The only data we share for advertising is limited website usage data, sent to Meta so our adverts reach the families who would genuinely benefit from a system like this.
We only use your information to:
- Provide the service you've signed up for
- Alert the people in their circle through the Croft app if a fall is detected, until someone acknowledges it
- Improve our systems to better serve your family
- Communicate with you about your service and account
- Make sure our advertising reaches the people who are most likely to find Croft useful
What data we collect
Account information
When you sign up, we collect:
- Your name and contact information
- Your parent's name and address
- Contact details for the people in their trusted circle
- If you join the pilot, payment details will be handled by our payment processor and never stored by Croft.
Home sensor data
Croft's radar fall sensors and hub collect:
- Presence and movement in each room, measured by radar (no images or sound)
- Fall events, and when and by whom an alert was acknowledged
- Hub and sensor status, including signal and mobile data connection
What we do not collect
Privacy protected:
- Video or audio recordings
- GPS location tracking
- Biometric data
- Medical information
How we protect data
Encryption
Data is encrypted between the hub, our servers and the Croft app, and encrypted again when stored.
Where data is stored
Our website runs on Cloudflare. Hosting home data in the UK is planned; we will confirm where data is stored before the pilot starts.
Limited access
Only essential Croft staff can access your data, and only when necessary to provide support or resolve issues. All access is logged and audited.
Secure login
Croft app access requires strong passwords when accessing from outside the home to keep your account protected and private.
Who can see the data
You control who sees what.
- Your parent:
- Can see their home's status and decide who is in their circle.
- Their circle:
- You choose who gets alerts and access to the Croft app. Each person must be explicitly invited and can be removed at any time.
- Croft support team:
- Can access data only when troubleshooting issues or providing support, with your permission. All access is logged.
- Third parties:
- We never sell your data, and your home monitoring data is never shared with anyone. We share limited website usage data with Meta purely so our adverts are shown to people who are likely to be interested in a system like this. Names, addresses and anything from inside the home are never included.
Your rights under UK GDPR
Under UK data protection law, you have the right to:
Access your data
Request a copy of all data we hold about you. We'll provide it within 30 days, free of charge.
Correct your data
Update incorrect or incomplete information at any time through the Croft app or by contacting us.
Delete your data
Request deletion of your account and all associated data. We'll permanently delete it within 30 days of your request.
Export your data
Download all your data in a standard format to take to another service provider.
Withdraw consent
Object to how we use your data or withdraw consent at any time without affecting service quality.
Lodge a complaint
If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO).
To exercise any of these rights, contact our Data Protection Officer:
Or email directly: [email protected]
We will respond within 30 days of receiving your request.
Technical details and compliance
Technical details
For security professionals and compliance officers
• Data in transit: TLS 1.3 (Transport Layer Security)
• Data at rest: AES-256 encryption
• Website hosting: Cloudflare
• UK hosting for home data: planned
• GDPR-compliant data processing agreements in place
• DDoS protection and WAF (Web Application Firewall)
• Legal basis: Contract performance and legitimate interest
• Data minimisation: Only collect necessary information
• Purpose limitation: Data used only for stated purposes
• Accuracy: Regular data quality checks
• Storage limitation: Automatic deletion after retention period
• Email service: Resend (GDPR-compliant)
• Newsletter subscriptions: Mailjet (GDPR-compliant, EU-based)
• Analytics: Google Analytics 4 and Microsoft Clarity (privacy-focused)
• Advertising: Meta Pixel and Conversions API via Cloudflare Zaraz (website events only, never home monitoring data)
• All processors have signed GDPR Data Processing Agreements
• Right to access (Article 15 GDPR)
• Right to rectification (Article 16 GDPR)
• Right to erasure / "Right to be forgotten" (Article 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 20 GDPR)
• Right to object (Article 21 GDPR)
• Rights related to automated decision making (Article 22 GDPR)
• Notification to ICO within 72 hours of discovery
• Affected individuals notified without undue delay
• Documented breach response procedures
• Automated alerts for suspicious activity, reviewed by the founders
How long we keep data
We only keep your data as long as necessary to provide the service and meet legal requirements.
- Waitlist and pilot data
- Waitlist and needs assessment answers are kept until you ask us to remove them, or 24 months pass without contact. Pilot account data is kept for the subscription plus 12 months.
- After account deletion
- We permanently delete all personal data within 30 days of your deletion request. We can't recover it after that.
- Sensor data
- Home sensor data is kept for 90 days, then automatically deleted. You can delete it sooner anytime.
- Legal requirements
- If you become a customer, some financial records may be retained for up to 7 years to comply with UK tax and accounting laws.
Questions about privacy?
We know privacy is complicated. If you have any questions, we're here to help.
Contact usLast updated: 12 October 2026