Privacy Policy

1. Who we are

[Your Company Name Ltd] ("we") trading as SiteOS is the data controller for personal data processed through the SiteOS platform. Contact our privacy team at privacy@siteos.uk.

2. What we collect

• Account data: name, work email, password (hashed), role and organisation.
• Job-file content you or your team enter: site diary entries, photos, drawings, health & safety records, timesheets, subcontractor and client details, quotes, invoices and payments.
• Billing data: handled by Stripe on our behalf — we store a Stripe customer/subscription reference, not full card numbers.
• Technical data: IP address, device/browser type and basic usage logs, collected for security (e.g. rate limiting) and to fix bugs (via Sentry error monitoring).

3. Why we process it (legal basis)

• To provide the Service you've signed up for (contract).
• To process payments and comply with tax/accounting obligations, e.g. CIS and VAT records (legal obligation).
• To keep the Service secure and prevent abuse, e.g. login throttling (legitimate interest).
• To send you service emails (invites, receipts, alerts) and, only with consent, product updates.

4. Who we share it with

We use a small number of processors to run the Service: Vercel (hosting), our PostgreSQL database provider, Stripe (payments), Resend (transactional email), Upstash (rate limiting) and Sentry (error monitoring). Each only receives the data it needs to perform its function, under a data processing agreement. We don't sell personal data.

5. International transfers

Some processors above may store or process data outside the UK (e.g. the EU or US). Where that happens we rely on adequacy decisions or standard contractual clauses to keep your data protected.

6. How long we keep it

We keep job-file and financial data for as long as your account is active, plus a reasonable period after closure to allow export and meet legal retention requirements (e.g. UK tax records are typically kept 6 years). You can request earlier deletion — see below.

7. Your rights

Under UK GDPR you can ask us to: access a copy of your personal data, correct it, delete it, restrict or object to processing, or move it elsewhere (portability). You can export your own data or request account deletion from Settings, or email privacy@siteos.uk. You can also complain to the UK Information Commissioner's Office (ico.org.uk).

8. Cookies

We use a single essential session cookie to keep you signed in. We don't use third-party advertising or tracking cookies.

9. Changes

We may update this policy from time to time; material changes will be notified by email or in-app.