Last updated 16 September 2026
Welcome to WhatTheMould. This Privacy Policy sets out how we look after your personal data when you use our app or visit whatthemould.com.
1. Who we are
WhatTheMould is a service provided by Project Alix Limited (“we”, “us”, “our”). We are a company registered in England and Wales (company number 15125580) with our registered office at 5 Buck Street, Camden, London NW1 8NJ.
We are the Data Controller for the personal data described in this policy.
We are registered with the UK Information Commissioner’s Office under registration number ZB625182. Please talk to us at ask@projectalix.com if you have any questions.
2. What we collect
When you use WhatTheMould we collect:
Your name, email address and password.
Your phone number, only if you opt in.
The address of the property you are reporting on. You can skip this.
The rooms you select and the voice recordings, photos and notes you make about them.
Your answers to the multiple-choice questions and any free-text you provide.
The report we generate for you (a damp condition summary and a landlord letter you can choose to send).
How you use the app — product analytics via Firebase Analytics (Google), tied to your account identifier and, unless you opt out, an advertising identifier.
Diagnostic data if the app crashes — via Sentry and Firebase Crashlytics.
Neither the app nor the website has any in-app purchases. We do not collect billing or payment data.
3. Why we use it and our legal basis
To provide the app to you and generate your report — legal basis: contract with you.
To email your report to you and to send you the WhatsApp reminders you opt in to — contract + consent.
To understand how the app is used and to improve it — legitimate interest.
To improve our AI models using anonymised content — our legitimate interest, which you can object to at any time via the opt-out toggle in your profile.
To share anonymised content with universities and independent researchers who are studying damp, mould, retrofit or related housing conditions — see Section 5.
To share content (and, if you separately opt in, your contact details) with third parties for lead-generation, affiliate and marketing purposes — your explicit consent, per Section 5.
To keep the service secure and prevent misuse — legitimate interest.
To meet legal and regulatory obligations.
4. Voice, photos and anonymisation
Voice recordings are captured only when you tap the mic button. We turn your voice into text on your device — on iPhone using Apple’s Speech Recognition, on Android using an open-source model that runs entirely on your phone. The on-device transcript is produced without uploading audio. Separately, the raw audio we upload may be transcribed by our server-side provider (OpenAI) to catch speech the on-device model missed. The raw audio is uploaded to our infrastructure so it can be reviewed against the report if needed, and the text produced on your device is used to write your report.
Photos are captured only when you tap the camera button and are attached to your report. For a damp / mould report, we may send photos to an image-analysis model to help write it. Photos are transmitted encrypted and are not retained by the analysis provider beyond the request itself.
Before any of your content is used for research or shared with third parties, we anonymise it. Anonymisation means:
Removing image metadata and GPS coordinates.
Removing or obscuring faces and other directly identifying features which may exist in photos.
Removing indicators that reveal personal, political or religious characteristics.
Removing or generalising address information so that a specific person cannot be identified from the record.
5. How we use your data for research and third-party sharing
We hold your data in two connected but separately governed layers.
Operational layer
Holds everything needed to give you the report — your account, your survey, your report, and the emails we have sent on your behalf. Retention rules are in Section 7.
Anonymised research and commercial layer
Holds content that has been through the anonymisation steps in Section 4. This is what we use to improve our AI models, to research damp and mould with universities and independent researchers, and — where you have opted in on your profile — to share with third parties.
Content only ever enters the anonymised layer after anonymisation.
Research use
We may share anonymised content with universities and independent researchers who are studying damp, mould, retrofit and related public-interest topics. Researchers agree in writing to use the content only for the agreed research purpose and to make no attempt to re-identify you.
Third-party sharing, lead generation and affiliate — opt-in only
You can choose from your profile whether or not to allow us to share your data for:
Third-party service providers who might help with the issues raised in your report (for example, contractors or specialists);
Advertising and marketing partners for the purpose of generating leads;
Affiliate partners whose products or services we recommend in the Tips section.
Each is a separate choice you can turn on or off at any time. If you leave them off, they are off. If you turn them on, we may share your report content (anonymised) and, where you have specifically consented, your contact details, with the relevant partner.
We do not share your content with your landlord, university or anyone else in a way that could identify you unless you send it yourself — for example, using the landlord letter feature.
6. Your rights
Under UK data protection law you have the right to:
See what personal data we hold about you.
Ask us to correct anything that is wrong.
Ask us to delete your data (“right to be forgotten”).
Restrict what we do with your data.
Object to processing based on legitimate interest.
Get your data in a machine-readable format.
Withdraw consent where you have given it.
You can delete your account from within the app. When you do, we soft-delete first and hard-delete after 30 days. If you change your mind in that 30-day window, email ask@projectalix.com.
If you want to exercise a right, email us at ask@projectalix.com. We will respond within a month.
7. How long we keep your data
Your account (name, email, phone) — for as long as your account is active, plus 30 days after you delete it.
Your report, voice, photos and answers — 3 years, or until you delete them, whichever is sooner.
Records of emails we have sent you — 2 years.
Product analytics — 2 years.
Sign-in and device logs — 90 days.
Backups — a rolling 30 days after the primary record is deleted.
8. Who we share your data with
We use a small number of trusted service providers to run WhatTheMould. The current list is at whatthemould.com/sub-processors and includes providers for hosting (Google Cloud, Supabase), report generation (OpenAI and Anthropic), image analysis on damp / mould reports (Anthropic Claude vision), analytics (Firebase Analytics, Google), error reporting (Sentry, Firebase Crashlytics), messaging (Twilio) and outbound email (Resend).
We do not sell your personal data. We do not share your report or contact details with anyone else, other than as described in Section 5 or if required by law or in the event of a change of control or sale of our business.
9. International transfers
Some of our providers are based in the United States (OpenAI, Anthropic, Firebase Crashlytics). Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses as recognised by the UK, and we have carried out a Transfer Risk Assessment for each such provider. You can request a copy by emailing us.
10. Cookies
We use a small number of cookies on whatthemould.com. Full detail is on our Cookie Notice.
In the app we use Firebase Analytics (Google) to understand how the app is used. It is tied to your account identifier and may use an advertising identifier. We do not use it to track you across other apps or websites.
11. Age
WhatTheMould is designed for adults. You should be at least 18 to use it. WhatTheMould is not intended for anyone under 18.
12. How we keep your data safe
We hold Cyber Essentials certification. We encrypt your data in transit and at rest, use multi-factor authentication for our staff, and have a documented breach response plan.
If we ever have a data breach that puts you at high risk, we will notify you and the ICO within 72 hours.
13. Changes to this policy
We may update this policy from time to time. When we make a significant change we will notify you in the app or by email. Where the change materially changes how we handle your data, we will ask for your consent before the change takes effect.
This version is dated 16 September 2026.
14. Contact us
Questions about this policy or about your data: ask@projectalix.com.