Privacy Policy

Sensa Systems Ltd is registered in England and Wales (company number 16958196). We are the data controller for the personal data described below and registered with the ICO (Reference:ZC201223). This policy explains how we handle personal data across all of our services. For any privacy question, contact us at [email protected].

What this policy covers

This single policy covers every Sensa service:

Each service has its own section below. Read the sections for the services you actually use.

Contents

The basics

• Cookies and browser storage
• Analytics
• Data collected when you visit
• Your Sensa account

Our services

• The shop: when you buy from us
• Affiliate referrals
• Sensa Studio
• Sensa Nomad
• Licences and households
• Sensa Radar
• Weather

Everything else

• When our staff act on your account
• When you email us
• Who we share data with
• How long we keep your data
• Your rights
• Changes to this policy
• Our lawful bases
• Where your data is processed

Cookies and browser storage

Analytics cookies

Our website and our configurator use cookies set by Google Analytics to help us understand how visitors use them. The cookies placed are:

We do not use advertising cookies, tracking pixels, or advertising networks.

On this website, analytics cookies are blocked until you accept the cookie banner shown on your first visit. Use this button if you clicked decline and want to change your mind.

Sensa Studio, our configurator, currently loads Google Analytics when the page opens rather than waiting for a banner. We are aware of this difference and are aligning it with the rest of our sites. In the meantime, the Google Analytics opt-out add-on linked in the next section blocks it.

Other things we store in your browser

Some of what we store is not a cookie but is still data kept on your device.

Referral records. If you reach our shop through a link shared by one of our affiliate partners, we store that partner’s referral code in your browser’s local storage so we can pay them commission if you buy. It lasts 30 days. It records the partner’s code, not who you are. This is stored in local storage rather than as a cookie, but it works the same way and we treat it the same way.

Your basket. Our shop gives your browser a random basket identifier and keeps it in local storage. The contents of your basket are held on our servers against that identifier, not in your browser. If you go on to check out, that basket becomes your order and is linked to your name and email address. The identifier itself does not tell us who you are until that happens.

Staying signed in. Signing in to the MySensa portal stores an authentication token in your browser’s session storage, which is erased when you close the tab. This is strictly necessary to keep you signed in, so no consent banner is shown. MySensa sets no cookies and runs no analytics.

Analytics

We use Google Analytics 4 to collect usage data, including pages visited, time on site, approximate geographic region, device type, and referral source. Google processes this data in accordance with Google’s privacy policy. You can opt out of Google Analytics everywhere by installing the Google Analytics Opt-out Browser Add-on.

Analytics do not run everywhere. This is the full picture:

Data collected when you visit

When you visit any page, your browser makes requests to the following external services:

Azure hosts our sites and our API. Microsoft’s infrastructure logs standard server data: your IP address, the pages you request, your browser type, and the date and time of your visit. These logs are retained and processed in accordance with Microsoft’s privacy policy. We do not have direct access to individual visitor logs.

Google Analytics receives usage data as described above, on the services listed above.

jsDelivr CDN serves the search library used on this site. When the search feature loads, your browser connects to jsDelivr’s servers, which may log your IP address. See jsDelivr’s privacy policy for details.

We do not combine data from these sources to build a profile of you.

Your Sensa account

Accounts are managed for us by Microsoft Entra External ID. When you register or sign in, we store your email address, your display name, and an identifier issued by Microsoft. We never see or store your password. Microsoft processes this in accordance with Microsoft’s privacy policy.

We record the role your account holds, which controls what you can see. If you are one of our trade dealers or affiliate partners, we record the link between your account and that organisation.

Sensa Radar keeps its own separate database (it is a separate product), but you sign in to it with the same Sensa account described above — see its own section below.

The shop: when you buy from us

Placing an order stores your name, email address, phone number if you give one, and your billing and delivery addresses. Each order also stores what you bought and what you paid, so that your order history stays accurate even if we later change our catalogue.

Payments are processed by Stripe. Payment happens on a page hosted by Stripe. We never see or store your card details. We keep only the reference identifiers Stripe gives us so we can reconcile the payment, issue refunds, and answer questions about your order.

Delivery. When we dispatch your order we send your name, delivery address, phone number and email address to Royal Mail so they can produce a shipping label and deliver to you. We keep a copy of the shipping label, which shows your name and address.

Order emails. We email you to confirm your order and tell you when it ships. These are sent through Azure Communication Services, a Microsoft service.

Affiliate referrals

Some of our partners share links to our shop. When you arrive through one of those links, we record that a visit happened so that we can pay the partner commission if you buy. We record:

• which partner referred you
• which page you landed on, without the rest of the web address
• the time
• a one-way hash of your IP address, mixed with the date

We do not store your IP address itself. We should be straightforward about the hash, though: it is a pseudonym rather than true anonymity. It cannot be read back directly, but it is not the same as having no record of you at all. We use it only to tell genuine visits apart from repeated clicks on the same link.

Sensa Studio

When you save a design, we store the design itself: the vehicle or vessel profile you entered, the devices you selected, and the name you gave it. Designs are linked to your account.

Sharing a design. You can share a design with someone else, either by entering their email address or by creating a share link.

• If you share by email, we store that person’s email address so we know who has access, and we email them to tell them.
• If you create a share link, that link contains a secret token. Anyone who has the link can open the design. The link does not expire on its own. It works until you revoke it or delete the design, so treat it like a password and only send it to people you trust.

You can see everyone who has access to a design, and remove their access, from the Designs page in MySensa.

Sensa Nomad

If you hold a Nomad licence, the software on your vehicle or vessel contacts us regularly. There are two separate things going on here, and only one of them is optional.

What is always sent

While your licence is in use, the software checks in with us about once an hour to confirm the licence is valid. This check-in sends:

• your licence key
• a hardware fingerprint of the unit. This is built from hashed values. The underlying serial numbers and network addresses stay on the box and are never sent to us.
• the software version, the release channel, and how the system was installed
• how many devices are connected to your system, and how many of them are currently unavailable
• the name you have given your system, if you have set one. This is a label you choose, for example a name for your van, and we send it so that our support staff can tell your unit apart from others. If you name it after a person or anything else you would rather we did not see, leave the name blank.

This is not optional while the licence is in use. We use it to check the licence, to support you, and to see which versions are in the field.

Diagnostics sharing, which is optional

Diagnostics sharing is off by default. It is not one switch but five, and you can turn each on or off independently: connected devices, unavailable devices, errors, resource usage, and uptime. While any of them is on, the software sends us an updated snapshot roughly every 15 minutes. We keep these snapshots for 180 days.

Please read this part before turning diagnostics on. The snapshot includes the names you have given your devices and entities, exactly as you typed them. If you have named something after a person, a place, or anything else you would not want us to see, that name will be sent to us as it is. If that matters to you, either rename those devices or leave diagnostics off. Your system works perfectly well with diagnostics off.

Error messages are the one part we scrub: we automatically strip out credentials and coordinates before they are sent. That scrub applies to the text of error messages only. It does not apply to device and entity names.

Registering a licence

Registering a licence sends us the customer name and contact email address given at registration.

Remote support

Remote support lets our staff sign in to your system to help you. There are two ways it can be switched on:

1. You switch it on from your own system.
2. We switch it on from our side. We can send an instruction to your system that opens a support session. This exists so that we can help when something is broken badly enough that you cannot reach the switch yourself.

However it is opened, the same rules apply. The session is time limited, lasting 24 hours by default and never more than 7 days. Your system generates a fresh, single-use password each time and reports that password to us, so that our staff can sign in. When the window closes, the account is deactivated and the password is destroyed. You can end a session yourself at any time.

If you would rather we could not do this, tell us and we will not open a session on your system without you asking us to first.

Dealer appliances

If you bought an appliance through one of our trade dealers, it may be reachable on a hostname belonging to that dealer, through a secure outbound tunnel operated by Cloudflare.

Licences and households

A licence belongs to a household, which is simply a named group of Sensa accounts. It exists so that more than one person, for example two people sharing a van, can each have their own account while the licence belongs to both of them.

We record which household owns each licence, which people are in that household, and which physical units are running it, including when each unit last checked in and which version it is running. Our staff can see this. We use it to support you and to work out what you are entitled to.

Sensa Radar

Radar helps you find places near you and route to them. It is inherently about where you are, so this is the section to read carefully.

Signing in to Radar

You sign in to Radar with your Sensa account — the same Microsoft-managed account as the rest of Sensa. Radar keeps its own record of your email address and display name (it runs on its own separate database), but it does not store a separate password. If you use Radar on a Nomad van, the van’s licence signs it in instead; either way, we pass your email address and account identifier from your Sensa account across to Radar so that it knows who you are and what you are entitled to.

Saved locations

Places you save are stored as exact coordinates plus whatever address or name you type. This includes places you mark as home and work. They stay until you delete them.

A record of your searches

Every search you make in Radar is recorded against your account. We record roughly where you searched, the postcode, the radius, the time, and how many results came back.

Two things about this deserve to be said plainly rather than buried:

• We round the location before we store it. We keep it to about a kilometre, which is enough to tell us which areas people search in and not enough to identify an address. We used to store the exact coordinates, and we no longer do.
• We keep these records indefinitely. There is currently no automatic deletion.
• If you run Radar on a Nomad unit in your vehicle, it searches on its own as you travel, roughly every couple of minutes once you have moved a few hundred metres, so that it can keep sensors like “nearest fuel” up to date. Each of those automatic searches is recorded in the same way, rounded in the same way.

This is separate from two other things, which are easy to confuse:

• Show my location in the Radar app, which centres the map on you. It is off unless you turn it on and needs your browser’s permission. Turning it off does not turn the search records off.
• Tracking, described below, which is a separate feature you have to switch on deliberately and which records your vehicle’s journeys.

If you do not want this, contact us at [email protected] and we will delete your search records and can discuss switching the automatic searches off on your unit.

Tracking: recording your van’s journeys

Tracking records where your Nomad van has been, so you can see your journeys on a map in the MySensa portal.

It is off until you turn it on. You turn it on with the Tracking switch on the van’s own dashboard (Settings → Vehicle). Turning that switch on is how you agree to your journeys being recorded; while it is off, the van sends us nothing at all.

What we record. Your van’s position, roughly once a minute while it is moving, and the time of each position. Nothing is recorded while the van is parked, apart from an occasional position so a journey can be shown to have ended where it ended. If you create a Location Sharing link (below), the van records more often while that link is live, so that the position someone sees is current.

Who can see it. Only you, in the MySensa portal, unless you deliberately share it using Location Sharing (below). Our staff do not have access to customer journeys, and there is no admin screen that shows them.

How long we keep it. You choose: one, two or three years, or forever. It is two years unless you change it. Anything older than your chosen period is deleted automatically.

Everyone in the van is recorded, not just you. We have no way to ask the other people travelling with you, so it is your responsibility to tell them. The van shows an indicator while Tracking is on.

Turning it off, and deleting your journeys. Turning the switch off stops recording straight away — while it is off the van sends us nothing. It does not delete what is already stored: that is kept for the retention period you chose, above. Separately, you can have your journeys deleted, or exported as a GPX or GeoJSON file, at any time — getting your data out and deleting it are your rights, and we do not charge for them.

Location Sharing: letting someone see where you are

Location Sharing lets you show your van’s current position to someone who is not a Sensa customer, so that a friend or relative can see where you are, or find you in an emergency.

It needs Tracking on, and you create each link yourself. You create a link in the MySensa app, under Control, Tracking. There is no way for us, or for anyone else, to create one on your behalf. You can stop a link at any time, and turning the Tracking switch off in the van stops every link at once.

What the other person sees. Your van’s position, updated while the link is live, on a map. They see nothing else: not your journey history, not your account, not any other part of your system. If you choose a reduced precision when you create the link, they see an approximate position rather than an exact one.

They need the link and a code. Each link comes with a six-digit code that we show you once, when you create it. Tell the person that code separately from the link, so that the link on its own is not enough for anyone it gets passed on to. We store the code only in a scrambled (hashed) form and cannot tell you what it was afterwards. Too many wrong attempts locks the link for a while.

How long it lasts, and stopping it. You choose one hour, eight hours, twenty-four hours, or until you turn it off. You can stop any link immediately, from the van or from the MySensa portal, and it stops working straight away.

You can see whether it has been used. For each link we show you how many times it has been opened and when it was last opened, so you can tell if it has been passed on further than you intended. We deliberately do not record who opened it or where from.

Anyone with the link and the code can see where the vehicle is, including anyone the link is forwarded to. That is what makes it useful in an emergency, and it is also its main risk. Only share a link with people you trust, and stop it when you no longer need it.

Everyone in the van is being shown, not just you. As with Tracking, we have no way to ask the other people travelling with you.

Community contributions

If you submit a place to the community map, we store the place details you submit along with your name and email address, so we can follow up on it.

Where your coordinates go

To answer a search, Radar contacts some providers live with the coordinates you searched, and reads others from copies it keeps on its own servers. It sends the location, not your name or your account.

Contacted live with your search coordinates:

Geocoding. When you type a postcode or place name, we send that text, not your coordinates, to postcodes.io for postcodes and Nominatim for place names. Nominatim also turns a saved location’s coordinates back into an address.

Routing runs on our own service, hosted by us. Your route coordinates are not sent to a third party.

Location Sharing sends your van’s position to whoever you gave a link and its code to. That is the whole purpose of the feature, and it only ever happens for a link you created yourself. It is not a provider we pass your data to; it is a person you chose. See the Location Sharing section above.

Searched from our own copy. For many amenities, such as fuel prices, MOT stations, cash machines, NHS services, parks, libraries, and Environment Agency and National Highways data, we hold a downloaded copy and search it ourselves, so your search coordinates are not sent to those providers.

One provider talks to your browser directly, which means it sees your IP address: Google Map Tiles, which draw the map for Premium users. Standard users get OpenStreetMap tiles instead.

Radar has no email service of its own. When it needs to email you, for example to tell you that a community contribution was approved, it hands the message to Sensa Hub, which sends it through Azure Communication Services, the same Microsoft service that sends our order emails.

Weather

When you use a weather or flood-warning feature, we send the coordinates you asked about to MET Norway and the UK Environment Agency, who provide the underlying data. We do not store those coordinates.

When our staff act on your account

When our staff carry out an action on your account, such as issuing a licence or refunding an order, we record who did it, what they did, and when. We keep these records to protect you and to investigate problems. They are visible only to our staff.

This log is deliberately permanent and cannot be edited. One consequence is worth being clear about: if we delete your account at your request, the record that we did so keeps your email address in it. The whole point of the log is that it cannot be quietly rewritten, and that has to include the record of a deletion.

When you email us

If you contact us by email, we will store your email address and message in order to respond. We do not share this with third parties. We keep email correspondence for up to two years unless you ask us to delete it sooner.

Who we share data with

We do not sell your personal data, and we do not share it for advertising. We share it only with the service providers we need in order to run our business:

How long we keep your data

Where a table row says indefinitely, that is a statement of what we currently do, not a claim that we need to. If you want any of it deleted, ask us and we will delete it.

Our lawful bases

UK GDPR requires us to have a lawful basis for everything we do with your personal data, and to tell you which one applies. There are four that we rely on:

• Contract: the processing is necessary to provide the service you signed up for.
• Consent: you switched something on, and you can switch it off again.
• Legal obligation: the law requires us to keep it.
• Legitimate interests: we need it to run our business properly, and we have judged that this does not override your rights. You can object to any of these, see Your rights.

This is how they map to what we actually do:

Where we rely on consent, withdrawing it is as easy as giving it: turn the switch off, or decline the banner. Where we rely on legitimate interests, you have the right to object, and we will stop unless we have a compelling reason to continue.

Where your data is processed

We are a UK company and our services run on Microsoft Azure in the UK. But several of the providers listed above are US companies, and using them means some of your data is processed in the United States:

UK law only allows personal data to leave the UK if it is properly protected when it gets there. For each of these transfers, one of the following applies:

• The country has an adequacy decision from the UK government, meaning the UK considers its data protection law good enough. Norway is covered this way.
• The US provider is certified under the UK–US Data Bridge, the UK extension to the EU–US Data Privacy Framework.
• Failing either of those, the transfer is covered by the UK International Data Transfer Agreement or Addendum — standard contractual terms approved by the ICO that bind the provider to UK-standard protections.

If you would like to know which mechanism covers a particular provider, ask us at [email protected] and we will tell you.

Your rights

Under UK GDPR, you have the right to access, correct, or request deletion of any personal data we hold about you. You can also object to or restrict our processing, and you have the right to complain to the Information Commissioner’s Office (ICO) if you believe we have mishandled your data.

To exercise any of these rights, contact us at [email protected]. We handle these requests by hand: there is no delete button in your account today. We will respond within one month.

Two things survive a deletion request, because the law or our own integrity controls require it:

• Order and payment records, which we must keep for tax purposes.
• The staff action log, as described above.

Changes to this policy

We may update this policy from time to time. The date below reflects when it was last revised.

Last updated: 2 August 2026