Last updated: 8 October 2026
Privacy Policy
This policy explains what personal data we collect through blox.ie and the blox software, why we collect it, who sees it, and your rights.
1. Who we are
We are Featherton Ltd ("we", "us"), a company registered in Ireland (CRO 586259), with its registered office at 1 The Mall, Lucan, Co. Dublin, K78 ET20, Ireland. We provide blox, software that managing agents use to run owners' management companies. Our privacy contact is Niall Hickey, data@blox.ie. We have not appointed a Data Protection Officer.
2. Our two roles
- Controller. For information about our customers (agencies and their staff), people who visit blox.ie, and people who contact us, we decide why and how the data is used.
- Processor. Managing agents enter information about owners, directors, tenants and suppliers into blox. The agent decides why that data is used, and we process it only on the agent's instructions under the data processing terms in our Agent Terms. If you are an owner, director, tenant or supplier and want to use your rights, contact the managing agent first; we will help them respond.
3. What we collect, why, and our legal basis
| Information | Examples | Why | Legal basis |
|---|---|---|---|
| Account and sign-in | Name, email, mobile number, role, sign-in times, one-time codes | Create and secure your login and run the service | Contract; our legitimate interest in security |
| Agency and billing | Agency name and address, contact person, company number, billing email, Stripe customer reference, invoices we issue. Card details are held by Stripe, not by us | Charge for the service and keep tax records | Contract; legal obligation |
| Support | Emails to support@blox.ie and what they contain | Answer your question and fix problems | Contract; legitimate interest |
| Website visits | IP address and browser details sent when a page loads; your cookie choice | Deliver and secure the site | Legitimate interest; consent for optional cookies |
| Security and audit records | Who did what and when, which record, which fields changed (not their contents); sign-in attempt counters | Keep the service secure and accountable; investigate problems | Legitimate interest |
| Marketing (only if you opt in) | Email address | Send product news | Consent, which you can withdraw at any time |
We do not ask for special category data (such as health information). Please ask your agents not to upload it unless they need to.
4. Information entered by agents (where we are the processor)
This can include owners', directors', tenants' and suppliers' names, email addresses, phone numbers, addresses, unit details, balances and payment history, supplier bank details, tasks and notes, messages sent through blox, and uploaded documents. We use it only to provide blox to the agent. The agent is responsible for having a lawful basis to enter it.
Bank feeds. An agent can connect a bank account of an owners' management company it manages. With the agent's consent, given through the bank's own secure sign-in, we receive through Enable Banking the account details (such as the IBAN and account name), balances and transactions (dates, amounts, descriptions and the names of payers and payees). We use them only to show the account in blox, to match payments to invoices and bills, and to keep the accounts. We never see or store the agent's online banking sign-in details. The connection lasts for the period the bank's consent allows (usually up to 180 days) and ends sooner if the agent disconnects it; the agent can renew it.
Messages. When an agent sends an email or text message through blox, we process the recipient's contact details and the message so that it can be delivered. The agent decides who receives messages and what they say.
Owner access. Where an agent gives an owner or director access to blox, we process their sign-in details and the information the agent chooses to show them.
5. How we use data
To provide, secure and support blox; to bill; to meet legal duties; and, with your consent, to send marketing. We do not sell personal data. blox includes AI-assisted features, for example helping agents draft messages, summarise documents and suggest how to categorise entries. When an agent uses one, the content the agent submits to it is sent to our AI service provider to produce the result and is not kept by us for any other purpose. An agent always reviews and confirms the result before it is used. We do not use customer data to train artificial intelligence. We do not make decisions about you by automated means that have legal or similarly significant effects. If we add new service providers, we will update this policy first.
6. Who we share it with
Service providers (sub-processors) that host, send, bill or secure blox, listed in section 14 below; professional advisers; and authorities when the law requires it (for example a court order, Revenue or An Garda Síochána). If our business is sold, the data may transfer to the buyer on the same terms.
7. Where data is stored and transfers outside the EEA
Our main database is hosted in Europe (Ireland). Our application code runs on Cloudflare's network, which can handle requests at locations worldwide. Some providers (for example Stripe, Cloudflare and our AI provider) are or are owned by US companies. Our bank feed provider, Enable Banking, is based in Finland. Where data goes outside the EEA we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. Ask us for a copy of the safeguards.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account and sign-in data | While the account is active, and deleted within 30 days after the agency closes, unless the law requires otherwise |
| Records an agent enters (owners, units, ledger, documents) | While the account is active. Documents and accounting records cannot be deleted by users for seven years. Deleted within 30 days after closure; agents should ask for a copy first |
| Our invoices and payment records for the agency | Six years after the end of the financial year (tax law) |
| Security and audit records | Up to seven years |
| Bank connection details | Until the agent disconnects the bank or the bank's consent expires, then deleted within 30 days. Bank transactions already recorded in the accounts are accounting records and are kept as set out above |
| Sign-in codes, attempt counters, invitations | Short periods; invitations expire after 14 days |
| Support emails | Two years after the matter closes |
9. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, move it to another provider, and withdraw consent at any time. Email data@blox.ie. We reply within one month (extendable by two months for complex requests) and may ask you to prove who you are. If we hold your data on behalf of an agent, we will tell you and pass the request to them. You can complain to the Data Protection Commission at www.dataprotection.ie.
10. Security
We use: sign-in by text-message code, with optional authenticator-app two-factor sign-in; encryption in transit (HTTPS); database rules that keep each agency's data separate and restrict what each role can see; Admin and Staff roles; an audit log; limits on repeated sign-in attempts; bot protection on sign-up; private file storage with short-lived access links; and bank connections made only through the bank's own consent flow, so we never hold your online banking sign-in details. No system is perfectly secure, and we cannot guarantee absolute security.
11. Support access
To give support and fix problems, authorised members of our team can view an agency's data. Each such access is recorded.
12. Breaches
If a personal data breach is likely to put people at risk, we will notify the Data Protection Commission within 72 hours, and tell affected agencies without undue delay.
13. Cookies and similar technologies
See our Cookie Policy. Our sign-up form uses Cloudflare Turnstile to block bots.
Parts of our app load fonts from Google Fonts, which receives your IP address and browser details when a page loads.
14. Our service providers (sub-processors)
These providers handle personal data for blox. We will give agencies 30 days' notice before adding or replacing a sub-processor.
| Provider | What it does for blox | Data it handles | Location and safeguard |
|---|---|---|---|
| Lovable and its infrastructure providers (Lovable Cloud) | Hosts the app, database, file storage and sign-in, and sends invitation, system and agent-sent emails | All data in blox | Main database in Europe (Ireland) |
| Cloudflare, Inc. | Runs application code, DNS, email forwarding, Turnstile bot protection | IP addresses, requests, and the content of requests while processed | Worldwide network; EU–US Data Privacy Framework or Standard Contractual Clauses |
| Stripe Payments Europe, Ltd and Stripe, Inc. | Card setup, monthly billing, invoices | Agency contact and billing details; card details (held by Stripe) | Ireland and USA; Stripe's data processing terms and Standard Contractual Clauses |
| Sendmode | Sends text messages (sign-in codes and messages agents send) | Mobile numbers, message text | Ireland |
| Enable Banking Oy | Connects blox to the bank accounts an agent chooses (bank feeds) | Account details, balances and transactions | Finland (EEA) |
| Lovable AI and the AI model providers it uses | Produces the results of AI-assisted features | Only the content an agent submits to an AI feature | EU–US Data Privacy Framework or Standard Contractual Clauses |
Others who may receive data. Our professional advisers, and authorities where the law requires disclosure.
15. Children
blox is for businesses and is not intended for anyone under 18.
16. Changes
We may update this policy. We will post the new version here, and give agencies 30 days' notice of material changes.
17. Contact
Featherton Ltd, 1 The Mall, Lucan, Co. Dublin, K78 ET20, Ireland. data@blox.ie. Support: support@blox.ie.