Privacy Policy

1. Who we are

1.1 This policy explains how James Wiles, trading as Roost Labs ("Roost Labs", "we", "us", "our"), handles personal data in connection with Arctic Air ("Software"). Arctic Air is business management software for heating, ventilation, air conditioning and refrigeration firms.

1.2 Contact details: 46 Compton Way, Farnham, Surrey, GU10 1QU, United Kingdom. Email: jwiles@roostlabs.co.uk. Phone: 07713664439.

1.3 This policy covers the Software only. Our website has its own privacy policy.

2. Our role

2.1 When we act as a processor. The businesses that use Arctic Air ("Customers") decide what data about their own customers, suppliers and staff goes into the Software. For that data, the Customer is the controller and we process it only on the Customer's instructions. If you are a customer of one of those businesses, please contact that business first about your data. We will help them respond.

2.2 When we act as a controller. We are the controller for the data we need to run our own relationship with Customers: the names, contact details and account information of the people who sign up for and use the Software, and our billing and support records.

3. The data we process

3.1 Account and user data: names, business email addresses, phone numbers, job titles, login and access records.

3.2 Customer business data: the information a Customer enters or receives in the Software. This may include the names, addresses, phone numbers and email addresses of the Customer's own customers and suppliers, site and job details, equipment records, appointments, quotes, orders, invoices, payment status, and messages exchanged through the Software.

3.3 Connected accounting data: if a Customer connects QuickBooks Online or Xero, we access the records needed to provide the Software's accounting features. These are customer contacts, invoices, payments, credit notes where the connected service supports them, and the organisation's account, product and tax settings. We also store the access credentials the accounting service issues for that connection.

3.4 Technical data: log records such as IP addresses, browser type, and the dates and times of requests, used to operate and secure the Software.

3.5 We do not intentionally collect special category data. We ask Customers not to enter it into the Software.

4. How we use data

We use personal data to:

• (a) provide, operate and maintain the Software;
• (b) create and update records in a Customer's connected accounting software, and read back the status of those records, at the Customer's request;
• (c) send messages and documents the Customer asks the Software to send;
• (d) provide support and respond to enquiries;
• (e) keep the Software secure, prevent misuse, and fix faults;
• (f) bill Customers and keep business records; and
• (g) comply with our legal obligations.

5. Our lawful bases

Where we are the controller, we rely on:

• contract, to provide the Software to the Customer we have an agreement with;
• legitimate interests, to support users, secure and improve the Software, and run our business; and
• legal obligation, to keep records the law requires.

Where we are a processor, the Customer is responsible for having a lawful basis for the data it puts into the Software.

6. Data from QuickBooks and Xero

6.1 We access a Customer's QuickBooks Online or Xero data only after an authorised person at that Customer has approved the connection. We access only the data needed for the Software's features.

6.2 We use that data only to provide the Software to that Customer. We do not sell it, share it with advertisers, use it for marketing, or combine it with other Customers' data.

6.3 A Customer can disconnect at any time: in QuickBooks Online, from the Apps section of their company; in Xero, from Connected Apps in their organisation settings; or by contacting us. Once a connection is withdrawn we can no longer access that service, and we delete the access credentials we hold for it on request.

6.4 Intuit Inc. and Xero Limited are independent controllers of the data held in their own products, and their own privacy policies apply to it.

7. Artificial intelligence

Some features of the Software use an artificial intelligence service to help read, sort or draft content. Data sent to that service is used only to produce the result the feature needs. Our agreement with the provider does not allow it to use that data to train its models.

8. Who we share data with

8.1 We never sell personal data.

8.2 We share personal data only with service providers that help us run the Software, under written terms that require them to protect it and use it only on our instructions:

• Netlify, Inc. — hosting the Software
• Supabase, Inc. — database and data storage
• Anthropic, PBC — artificial intelligence features
• Meta Platforms, Inc. (WhatsApp Business) — messaging, where a Customer enables it
• Postmark (ActiveCampaign, LLC) — sending and receiving email

8.3 We also send data to the accounting services a Customer chooses to connect, as described in section 6.

8.4 We may disclose data if the law requires it, to protect our rights or the safety of others, or to a successor if our business is transferred. In each case we will do so only as permitted by law.

9. International transfers

Some of our service providers store or process data outside the United Kingdom, including in the European Economic Area and the United States. Where data is transferred outside the UK, we make sure it is protected by an adequacy decision (including the UK Extension to the EU-US Data Privacy Framework, where the provider participates) or by the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

10. How we protect data

10.1 We use appropriate technical and organisational measures to protect personal data, including:

• encryption of data in transit using HTTPS;
• encryption of stored data by our hosting and database providers;
• access limited to the people who need it, with account sign-up disabled so accounts are created only by us, and sign-in rate-limited to resist guessing;
• keeping access credentials for connected services on our servers, never in a user's browser; and
• logging and monitoring to detect and investigate errors and misuse.

10.2 If a personal data breach affects a Customer's data, we will tell that Customer without undue delay. Where the law requires it, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach.

11. How long we keep data

11.1 We keep Customer business data for as long as the Customer uses the Software. When a Customer's agreement ends, we keep it for 30 days so the Customer can request an export, and then delete it, unless the law requires us to keep it.

11.2 We delete the access credentials for a connected accounting service on request once the connection has ended.

11.3 We keep billing and business records for six years after the end of the financial year they relate to, as UK law requires.

11.4 We keep technical logs for no longer than 90 days, unless we need them to investigate a security incident.

12. Your rights

12.1 Under UK data protection law you have the right to: access your personal data; have it corrected; have it erased; restrict or object to its processing; receive it in a portable format; and withdraw consent where we rely on consent.

12.2 To use these rights, email jwiles@roostlabs.co.uk. We will respond within one month. If we hold your data as a processor for one of our Customers, we will pass your request to that Customer and help them respond.

12.3 If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

13. Children

The Software is for businesses and is not directed at anyone under 18. We do not knowingly collect children's personal data.

14. Changes to this policy

We may update this policy from time to time. We will tell Customers about any material change by email or within the Software, and we will always show the date of the latest version at the top of this page.

15. WhatsApp Business, connected through Meta

15.1 How the connection works. A firm connects its own WhatsApp Business number to its own Arctic Air through Meta's Embedded Signup. Someone at the firm signs in with their own Meta login and chooses which WhatsApp Business Account and number to connect. The firm can then receive and reply to its customers' WhatsApp messages inside Arctic Air.

15.2 Two roles. For the person at the firm who completes Meta's login, we are the controller of what Meta gives us about them and their business: their name, the business account and asset IDs, and the permissions they granted. For the messages and contact details of the firm's own customers, the firm is the controller. We process those only on the firm's behalf, to provide the service. If you are a customer of one of these firms, please contact the firm first about your data.

15.3 What we receive from Meta.

• the firm's WhatsApp Business Account ID, phone number ID and business name;
• an access token that lets the firm's Arctic Air send and receive messages on that number; and
• the messages that pass through the firm's number, with the senders' phone numbers and names, delivery statuses, and the firm's message templates.

We receive nothing from anyone's personal Facebook profile beyond the basic login identity Meta uses to confirm who is connecting.

15.4 What it is used for. Only to show and send the firm's WhatsApp messages in its own Arctic Air system. It is never sold, never used for advertising, and never shared with other firms.

15.5 Where it is stored. Each firm has its own separate Arctic Air system with its own database, which no other firm can reach. The databases are hosted in London. The service providers involved are Meta (WhatsApp Business Platform), Supabase (database), Netlify (hosting), Anthropic (AI features), Postmark (email), and the firm's own accounting software if it connects Xero or QuickBooks. Some of these providers process data in the United States; section 9 explains how those transfers are protected.

15.6 How long we keep it. WhatsApp data is kept while the firm uses Arctic Air. It is deleted within 30 days of a deletion request, or within 30 days of the firm leaving.

15.7 Your rights. Under UK GDPR you have the right to access your personal data, to have it corrected, to have it deleted, and to object to how it is used. To exercise any of them, email jwiles@roostlabs.co.uk. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. To remove a firm's WhatsApp connection and have its data deleted, follow our data deletion instructions.

16. Contact

Roost Labs — James Wiles, sole trader
46 Compton Way, Farnham, GU10 1QU, United Kingdom
jwiles@roostlabs.co.uk · 07713664439

Arctic Air · Licence agreement · Data deletion · Last updated 22 September 2026