Privacy

This notice explains what personal data Mortar holds, why, who processes it, how long it is kept, and the rights you have over it. Last updated 20 July 2026.

Who is responsible

Mortar is built and run by Andy Quinn, based in Ireland, who is the data controller for the personal data described here. For anything about your data (questions, corrections, copies, deletion), email andy@quinn.ie.

What Mortar holds, and why

Your account: your email address and name, received from Google when you sign in. If someone adds you to their project by email, Mortar may hold your email address from that moment, before your first sign-in. Used to run your account and control who can see what. Legal basis: providing you the service (contract).

Your project: whatever you put in it. Typically that means the property address and details, BER information, work items, decisions, budgets, expenses and quotes, uploaded documents, and notes. Used only to run your project: showing it back to you, and generating the suggestions you ask for. Legal basis: contract.

People in your project: names, companies, phone numbers and emails of builders, engineers, assessors and other contacts you add, and the content of correspondence you paste in for Mortar to read. Used to help you track who is doing what and draft messages to them. Legal basis: legitimate interest (yours, in running your renovation). More on what this means for those people below.

Usage records: a log of your AI-feature usage (which feature, when, and its cost, used for rate limiting and keeping the service sustainable) and a per-project stamp of when you last looked (used to show you what changed since). Legal basis: legitimate interest in operating the service. There is no analytics or advertising tracking of any kind.

AI processing

Some features send relevant excerpts of your project data to an external AI model provider, solely to produce the result you asked for: generating next steps, drafting replies, reading a pasted email thread, analysing an uploaded PDF. Nothing is sent without you triggering it, and Mortar does not store raw prompts or model responses beyond what the feature needs.

One deliberate limit worth knowing: when Mortar drafts a message to someone on your project, the draft is built only from points you have explicitly confirmed, that person's name and role, and the note you typed, never from your wider project. Your budget, grant position, and other quotes stay out of messages to the other side. This is enforced in code and pinned by tests, not just policy.

Who processes data for Mortar

Mortar does not sell or share personal data with anyone for their own use. These processors handle it on Mortar's behalf:

• Supabase: database, sign-in, and file storage. Mortar's data is stored in Supabase's Ireland region.
• Vercel: hosting the application and its server logs.
• An AI model provider: the AI processing described above, only when you trigger it. The provider can change as the service evolves; this page is updated when it does.
• Google: sign-in only. Mortar receives your name and email from Google and sends nothing back.
• Postmark (by ActiveCampaign, in the US): receiving emails you forward to your project's Mortar email address and passing them to the app so they can land in your Review queue. Only mail forwarded by you or your collaborators is processed; Postmark retains forwarded message content for up to 45 days.

How long data is kept

For as long as your account exists, and no longer. Deleting an item, document, contact or expense removes it immediately, and deleting a document also removes the uploaded file. Deleting a project, or your whole account, permanently removes everything in scope, including uploaded files, usage records, and your access records; both are self-serve in Settings and neither can be undone. Short-lived infrastructure backups at our providers expire automatically on their schedules.

Your rights

Under the GDPR you can ask for a copy of your data (and a portable export), have mistakes corrected, have data deleted, and object to or restrict processing. Most of this you can do directly: everything in Mortar is editable in place, and deletion is self-serve as above. For a copy or export of your data, or anything you cannot do in the app, email andy@quinn.ie and it will be handled within a month, usually much faster.

If you are unhappy with how your data is handled, you have the right to complain to the Irish Data Protection Commission at dataprotection.ie.

If someone put your details into Mortar

Mortar users record the tradespeople and professionals on their renovation, so your name, contact details, or correspondence may be in a user's project without you having signed up to anything. That data is visible only to the people on that project, is never used to contact you, market to you, or build any profile of you, and is deleted with the project. If you want to know what a project holds about you, or want it removed, email andy@quinn.ie.

Cookies

Mortar sets only the cookies needed to keep you signed in and remember which project you are looking at. There are no analytics, advertising, or third-party cookies, which is why there is no cookie banner.