Last updated: 26 July 2026
Who we are
Vulcan is operated by Home Energy Foundry Limited, a company registered in England and Wales (company number 14972259) at 85 Great Portland Street, London, England, W1W 7LT.
For the purposes of UK GDPR and the Data Protection Act 2018, Home Energy Foundry
Limited is the data controller for personal data collected through
usevulcan.app.
This policy covers the Vulcan website and the tools served from it. The Vulcan desktop application has its own telemetry notice.
What we collect
If you only browse the site
- Nothing that identifies you. We do not run third-party analytics and we set no analytics cookies. Our hosting provider keeps ordinary server logs, which include your IP address, for security and troubleshooting.
If you join the waitlist, request a trial, or open a gated tool
- Your name
- Your email address
- Your company or organisation
- Your professional role or accreditation, where you tell us
- Anything else you choose to write in a free-text field
If you hold a Vulcan account
- Account and authentication details
- Billing details, handled by our payment processor — we do not store your full card number
- Records of your use of the service, for support and billing
What we do not collect
We do not ask for special category data — health, ethnicity, political opinions and the like — and you should not send it to us.
Building models you run in the browser stay in your browser. The in-browser h3 tool runs entirely on your own device. The model files you load are never uploaded to us, and we never see them.
Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Reply to an enquiry or provide a trial you asked for | Contract, or steps taken at your request before entering a contract |
| Send you product updates and marketing email | Consent, which you can withdraw at any time |
| Provide, bill for and support a Vulcan account | Contract |
| Keep our systems secure and prevent abuse | Legitimate interests — protecting the service |
| Meet accounting and legal obligations | Legal obligation |
Where we rely on consent, you can withdraw it at any time — use the unsubscribe link in any marketing email, or contact us. Withdrawing consent does not affect processing already carried out.
Who we share it with
We do not sell your personal data. We share it with service providers who process it on our instructions:
| Provider | Purpose |
|---|---|
| Supabase | Database and authentication |
| Mailchimp | Marketing email and mailing lists |
| Stripe | Payment processing |
| Vercel | Website hosting |
We may also disclose personal data where we are required to by law, or to establish, exercise or defend legal claims.
How long we keep it
- Enquiries and waitlist entries — up to 24 months after your last contact with us, then deleted.
- Marketing contacts — until you unsubscribe or ask us to delete you. We also review the list for inactivity every 24 months.
- Support correspondence — three years.
- Account and billing records — for the life of the account, and then for six years, to meet our obligations under the Companies Act 2006.
- Server logs — 30 days.
You can ask us to delete your data sooner. See Your rights.
Cookies
We use cookies only for functions you have asked for — keeping you signed in, and remembering preferences such as your theme. We set no advertising or analytics cookies, and we use no third-party tracking, so there is nothing here for you to consent to and no banner to dismiss.
If you hold an account, we record your use of the service in our own database to provide, bill for and support it. That is described above; it is not third-party tracking.
You can control cookies through your browser settings, but blocking them may stop parts of the site working.
International transfers
Some of our providers process data outside the UK. Where they do, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, so that your data keeps an equivalent level of protection.
How we protect it
We use encryption in transit and at rest, restrict access to those who need it, authenticate access to our systems, and follow secure development practices. No system is perfectly secure, but we take these obligations seriously and review them.
Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you
- Rectify data that is inaccurate or incomplete
- Erase your data, where we have no overriding reason to keep it
- Restrict or object to our processing, including objecting to direct marketing at any time
- Portability — receive your data in a machine-readable form
- Withdraw consent at any time, where consent is the basis we rely on
To exercise any of these, email hello@usevulcan.app. We will respond within one month. We may ask you to confirm your identity first.
Children
Vulcan is a professional tool and is not intended for children. We do not knowingly collect personal data from anyone under 13.
Changes to this policy
We may update this policy. When we make a material change we will update the date at the top of this page, and where the change affects you directly we will tell you by email.
Complaints
If you are unhappy with how we have handled your personal data, please contact us first at hello@usevulcan.app so we can try to put it right.
You also have the right to complain to the UK's supervisory authority:
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF ico.org.uk/make-a-complaint Helpline: 0303 123 1113