Privacy policy

Last updated: August 2026

MoveGenie — Privacy Policy

Last updated: 6 August 2026
Effective date: 6 August 2026
Data controller: Brdge Ltd, a company registered in England and Wales, United Kingdom. Registered-office details are available on request from support@movegenie.ai.
Contact: privacy@movegenie.ai
Applies to: the MoveGenie mobile app, the Estate Agency portal (agency.movegenie.ai), the Service Provider portal (serviceprovider.movegenie.ai), the Admin console, and the MoveGenie API at movegenie.ai.

  1. Who we are

MoveGenie helps people moving home in the United Kingdom plan their move, discover local services, chat with an AI assistant ("the Genie"), track contracts and documents, and get council/neighbourhood information
for their new address. This Policy explains what personal data we collect when you use MoveGenie, why we collect it, and the rights you have over it.

For the purposes of the UK GDPR and the Data Protection Act 2018, Brdge Ltd is the data controller for the personal data described below.

  1. Personal data we collect

We only collect data needed to run the features you use.

2.1 Account & identity

  • Full name and email address — you provide at sign-up; email verified by OTP.

  • Password — stored only as a bcrypt hash; we never see your password.

  • Mobile phone number — optional; verified by SMS OTP.

  • Social sign-in identifier — if you sign in with Google, we receive your name and email from Google. We do not receive your Google password.

  • Agency referral code — optional; captured if you sign up through an estate agent's link; used to link your account to the referring agency.

2.2 Move journey profile
Collected during onboarding and editable from your profile:

  • Current address, new address, and their postcodes.

  • Latitude/longitude for current and new address (used to compute distances to service providers and nearby places).

  • Planned move date.

  • Tenure ("renting" or "buying").

  • Household composition (adults, children, ages), pets, lifestyle tags (e.g. "gym-goer", "coffee-lover") — used to personalise your checklist.

  • Priority services you want help with (e.g. broadband, cleaning).

2.3 Content you create

  • Documents you upload to the Document Vault (tenancy agreements, mortgage papers, insurance, etc.).

  • Contract records you add for tracking (broadband, DTH, insurance, mobile, streaming, etc.), including renewal cost and expiry date.

  • Chat messages with the Genie (chat sessions and every message are persisted).

  • Photos / images you upload.

  • Saved items — services and places you save.

  • Task status — which move-plan tasks you have completed or skipped.

2.4 Device & technical data

  • Firebase Cloud Messaging (FCM) token(s) for push notifications.

  • Device identifier(s) for multi-device session management.

  • IP address (visible to our server on each request).

  • Approximate location derived from postcodes.io lookups of your postcode, and, if you grant permission, precise device location from your operating system's location services (used for the "nearby places"
    feature).

2.5 Usage & activity data

  • Last-active timestamp (upserted on each authenticated request for retention analytics).

  • Clicks on service listings and partner offers (aggregated to power analytics dashboards and to compute agency referral commissions).

  • Chat routing metadata (which intent branch handled your message, cache hits).

2.6 Data about estate agencies, service providers and admins
If you use one of the portal apps as an agency, service provider or admin, we additionally process: your business name, logo, website URL, bio, phone number, service listings (name, description, images, location,
pricing), and — for agencies — your referral code and commission ledger.

2.7 What we do NOT collect

  • We do not collect payment card details directly. If and when payments are processed, they will be handled by a PCI-compliant payment provider named in an updated version of this Policy.

  • We do not collect government IDs, biometrics, or health data.

  • We do not knowingly collect data from children under 13. See §11.

  1. How we use your data (lawful bases)

  • Create and secure your account; authenticate you; issue JWT and refresh tokens; manage multi-device sessions — Contract (UK GDPR Art. 6(1)(b)).

  • Send OTP codes by email and SMS — Contract.

  • Personalise your move checklist and recommendations — Contract.

  • Show provider results, distances and "nearby places" — Contract.

  • Store the documents, contracts, saved items and chat messages you create — Contract.

  • Send push, email and SMS notifications about your move (task reminders, contract expiries, bin days, GP registration, etc.) — Contract; Legitimate interests (Art. 6(1)(f)) for service-related messages you would
    reasonably expect.

  • Marketing messages (if any) — Consent (Art. 6(1)(a)); you can withdraw at any time.

  • Fraud, abuse and rate-limit monitoring; audit logs — Legitimate interests.

  • Aggregate analytics for the admin dashboard (signup trends, retention, funnel, revenue) — Legitimate interests.

  • Calculate and record estate-agency referral commissions — Contract (with the agency); Legitimate interests (for the user).

  • Comply with law (e.g. tax records, responding to lawful requests) — Legal obligation (Art. 6(1)(c)).

  1. Third-party subprocessors

MoveGenie relies on the following third parties to run the service. Each has its own privacy policy; we share only the minimum data needed for the feature.

  • Google Firebase (Google LLC) — Push notifications (FCM), background app messaging. Data shared: FCM token, notification title/body, deep-link data. Location: global (Google infrastructure).

  • Google Sign-In — Optional social sign-up / sign-in. Data shared: email, name from your Google account. Location: US / EEA.

  • Google Maps / Places API — Nearby-places discovery, place details, geocoding. Data shared: lat/lng, search radius, place type keywords. Location: global.

  • postcodes.io — UK postcode → council / lat-lng lookup. Data shared: postcode. Location: UK.

  • Firecrawl — Scrape UK council pages for bin collection, council tax and similar local info. Data shared: council name + topic query. Location: US.

  • OpenAI — Powers the Genie chat assistant, intent router, chat-title generation and council-info summarisation. Data shared: your chat message and a summary of your profile/journey context on each turn.
    Location: US.

  • Cloudinary — Hosts images and documents you upload (logos, service images, vault docs). Data shared: the file plus a URL/path. Location: global (US/EU).

  • Brevo (Sendinblue) — Transactional email (OTPs, agency invites, service approvals). Data shared: email address, template variables. Location: EEA.

  • Apify (Google Places actor) — Enriches admin-side "Google business leads". Data shared: business search terms. Location: EU.

  • MySQL database hosting (self-managed) — Primary application data store. Data shared: all personal data described in §2. Location: United Kingdom / European Economic Area.

  • App server hosting (self-managed) — Runs the MoveGenie API. Data shared: request/response data in memory. Location: United Kingdom / European Economic Area.

If a subprocessor changes, we will update this list before the new subprocessor goes live.

  1. International transfers

Some subprocessors (notably OpenAI, Firecrawl, Google, Cloudinary) may process data outside the UK/EEA, including in the United States. Where we do so, we rely on the UK International Data Transfer Agreement
(IDTA), the EU Standard Contractual Clauses (SCCs) with the UK addendum, or an adequacy decision. On request we will describe the safeguards in place for a specific transfer.

  1. How long we keep your data

  • Account and profile data — for as long as your account is active.

  • OTP codes and OTP tokens — 10 minutes.

  • JWT access tokens — 24 hours.

  • Refresh tokens — 30 days from issue, rotated on use.

  • Chat sessions and messages — until you delete the chat or your account.

  • Documents in the vault — until you delete the document or your account.

  • Contract records — until you delete them or your account.

  • Push tokens — until you sign out on that device, uninstall the app, or the token becomes stale (in which case we clear it automatically).

  • Council/local-info cache — 24 hours in-memory.

  • Aggregated analytics (e.g. monthly signups, revenue trend) — indefinitely, in aggregated form.

  • Agency commission ledger — retained for tax/audit periods required by law.

If you delete your account (§9), your account row and all cascaded data (chat sessions and messages, bookings, saved items, notifications, journey/task state) are permanently deleted. Backups may retain a copy
for a short rolling period before they roll off.

  1. Sharing your data

We do not sell your personal data. We share data only:

  • With the subprocessors in §4, strictly to run the features they power.

  • With the estate agency you were referred by, if any: we tell that agency that you signed up, when, and whether you have made a booking, so they can be credited for their referral. We do not share your address,
    documents, chat contents or lifestyle profile with the agency.

  • With service providers you engage with: if you click through to a provider's website or book a service, that provider will see the information you supply directly to them.

  • With authorities, if required by law, court order or valid legal process.

  • With a successor entity, in the event of a merger, acquisition or asset sale — we will notify you before your data becomes subject to a different privacy policy.

  1. Notifications and marketing

Service notifications — push, email or SMS about tasks, contract expiries, GP reminders, bin days and similar — are part of the product. You can turn off push notifications in your device settings, or sign out of
a device to stop push to that device (this also clears the FCM token for that device on our side).

Marketing messages, if we ever send any, will only be sent with your consent, and each message will have a one-tap unsubscribe.

  1. Your rights

Under the UK GDPR you have the right to:

  • Access the personal data we hold about you.

  • Rectify inaccurate data (most fields are editable in-app; contact us for the rest).

  • Erase your data — you can delete your account in-app (Settings → Delete account), which permanently removes your record and cascaded data. You can also email us.

  • Restrict or object to certain processing.

  • Data portability — receive your data in a machine-readable format.

  • Withdraw consent at any time, where processing is based on consent.

  • Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you think we've handled your data unlawfully.

We will respond to requests within one month. To exercise any right, email privacy@movegenie.ai.

  1. Security

  • Passwords are hashed with bcrypt; we never store or transmit them in plaintext.

  • Sessions use short-lived JWT access tokens with rotating refresh tokens.

  • All API traffic runs over HTTPS in production.

  • Stale push tokens are automatically cleared when Firebase reports them invalid.

  • Access to production infrastructure is limited to authorised personnel.

  • We follow the principle of least privilege internally.

No online service is 100% secure. If you believe your account has been compromised, please contact security@movegenie.ai.

  1. Children

MoveGenie is designed for adults arranging a home move. We do not knowingly collect personal data from children under 13. If you believe a child has provided us data, contact us and we will delete it.

Note: the onboarding profile lets adults record that children (with ages) live in the household so the checklist can suggest relevant tasks (e.g. school enrolment). Children themselves are not users.

  1. Cookies and similar technologies

The MoveGenie mobile apps do not use browser cookies. Web portals (agency, service provider, admin) use only strictly necessary cookies for authentication (holding the session token) — no advertising or analytics
cookies.

  1. Automated decisions and AI

The Genie chat assistant and personalisation checklist use large-language-model (OpenAI) and rules-based processing to suggest tasks and services. These suggestions are advisory only and do not produce legal or
similarly significant effects on you. You can ignore any suggestion.

Your chat messages and a summary of your profile are sent to OpenAI on each chat turn so the assistant can respond. Per OpenAI's API terms, prompts and outputs are not used to train OpenAI's models.

  1. Changes to this Policy

We will update this Policy when we add or change features, add subprocessors, or in response to legal changes. When changes are material we will notify you in-app or by email. The "Last updated" date at the top
shows when the current version took effect.

  1. Contact