Privacy Policy
This policy explains what personal information the Blazeshield Site Pro app collects, why, who it is shared with, how long it is kept, and the rights you have over it. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
The app is provided by {{LEGAL_NAME}} ({{LEGAL_STATUS}}), {{LEGAL_ADDRESS}}.
For anything about your data, email {{PRIVACY_EMAIL}}. We are not required to appoint a Data Protection Officer and have not done so. We are registered with the Information Commissioner's Office (ICO), registration number {{ICO_NUMBER}}.
In this policy "we", "us" and "our" mean {{LEGAL_NAME}}. "You" means anyone who uses the app.
2. Our two roles
We handle two different kinds of information, and our responsibility is different for each.
- Your account. Your name, email, company details and subscription. We decide how this is used, so we are the controller.
- What you record in certificates, RAMS and other paperwork. Your clients' names, site addresses, contacts, photos, signatures and notes. You (or the company you work for) decide what goes in, so you are the controller and we are your processor. We only store and handle it to provide the app to you, following your instructions.
3. What we collect
| Information | Examples | Where it comes from |
|---|---|---|
| Account details | Your name, email address, password (stored scrambled by our login provider; we never see it), company name | You, when you create an account |
| Company details | Company logo, address, phone, email, website, accreditation numbers, certificate number prefix | You, on the Company details screen |
| Team details | Which engineers and office staff belong to a company account and their role | The account owner and engineers joining with a code |
| Subscription and purchase records | Plan, status, renewal date, number of engineer places and office logins, past guide purchases, Stripe customer reference | Stripe, when you pay |
| Error reports | If something goes wrong in the app: the error message, the screen you were on, the app version, your device and browser type, and your account ID. Never the content of your certificates. | Sent automatically by the app, so we can fix faults |
| Certificate content | Client and site details, alarm receiving centre (ARC) details including site passwords, test results, notes, photos, signatures, defects | You and your engineers |
| Technical information | IP address, device and browser type, and the date and time you used the service, in our providers' security logs | Your device, automatically |
| Change history | Who created, edited, issued, unlocked, deleted or restored each certificate, asset list or quote, when, and a copy of each earlier version | Recorded automatically when paperwork is backed up (paid plans) |
| Quotes, invoices and price book | Client and site details on quotes and invoices (including billing address and accounts email), your item prices, markup and labour rates, payment status, and the bank details you print on invoices | You and your company owner. Invoices are only visible to the account owner |
| Jobs | Jobs scheduled for your company: date, time, site, type of job, notes, which engineer it's for, and updates engineers make (done, no access, notes) | Everyone in your company |
| Company hub: timesheet, mileage and vehicle checks | Start and finish times you tap in, odometer readings and private miles you enter, vehicle registration, vehicle check answers, notes and photos. Nothing is recorded automatically and the app never tracks your location | You and your company owner only. Other engineers can't see them |
| Company hub: expenses | Receipt photos, date, category, description, amount, VAT and how you paid, and whether it was approved | You and your company owner only |
| Company documents | Procedures and files your company owner adds, and when you confirmed you'd read each one | Everyone in your company can see the documents. Only you and your company owner see your confirmations |
| Site panel access codes | Level 2 and level 3 panel codes you record against a site | Everyone in your company. Never printed on certificates |
| Panel configuration files | Files you upload against a site, their name, size, note and who uploaded them | Everyone in your company |
| Panel Library files (paid plans) | Manuals, wiring diagrams and datasheets you back up, with their name, manufacturer, size and who added them | Everyone in your company |
| Defects, test equipment and service contracts | Defects found on certificates and what happened to them, test instruments with serial numbers and calibration dates, contract frequencies and values on sites | Everyone in your company (contract values: the account owner manages them) |
| Client links (paid plans) | Documents you choose to send to a client by link (certificates to sign, quotes, invoices), a summary used to check a certificate is genuine, the client's reply (name, position, signature, comments, order number, when they replied and their browser type), and the emails sent for overdue invoice and service due reminders you switch on | Anyone with the link sees that one document. Replies: everyone in your company (invoice links: the account owner only) |
| False alarm log | False alarms recorded for a site: date, time, cause, device and what was done | Everyone in your company |
| Cards and training | The cards, qualifications and training you add, with numbers and expiry dates | Only you and your company's account owner |
| Digital site logbook | Tests recorded by building staff when they scan a QR label: date and time, which device, pass or fail, notes and the name they type. Staff don't need an account | The service company that set up the logbook, and anyone with the site's logbook QR code (it's the building's logbook) |
| EM Light Finder | Photos of emergency light labels you scan, and codes you type. Photos are sent to our AI provider (Anthropic) to read the label and search the web. We don't keep them, and the provider deletes them within 30 days (longer only if needed for safety or legal reasons). The fitting details found (maker, code, links) are saved without any link to you and shared with all users, along with whether engineers confirmed them | Photos: only used for that scan. Fitting details: everyone using the app |
| RAMS and dynamic risk assessments | Site and job details, hazards, risk scores, method steps, permits, emergency contacts, the author's name and signature, the names of engineers who confirm they have read a RAMS and when, and on-arrival checks with the engineer's name, time, notes and signature | You, your engineers and office staff. Everyone in your company can see them |
| Electrical certificates: photo and voice reading (paid plans) | If you use them: photos of a consumer unit or a tester's screen, and the words you say when entering test results. Speech is turned into text on your phone first; only what your phone can't read itself is sent to our AI provider (Anthropic) to fill in the boxes. We don't keep the photos or the words. The provider doesn't use them to train its models and deletes them within 30 days (longer only if needed for safety or legal reasons). Results are shown to you to check before they're saved | You |
| Voice commands | The words you say when you use the microphone button | You (see section 11) |
| Video competition entries | If you enter: your first name, the clip you upload or the link you send, your caption, and the date. Only you and we can see your entries. With your agreement when you enter, we may use your clip and first name in our marketing | You, if you choose to enter |
| Messages | Anything you send us by email | You |
Card details are entered on Stripe's secure checkout page and go straight to Stripe. We never see or store your full card number.
We do not use advertising, tracking or analytics tools in the app.
4. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, signing you in, backing up and syncing your certificates, sharing certificates within your company | Contract: we need it to provide the service you signed up for |
| Taking payments, managing subscriptions, sending receipts and invoices | Contract |
| Sending essential service emails (confirming your email, password resets, payment problems) | Contract |
| Keeping the service secure, preventing misuse and fixing faults | Legitimate interests: running a safe, reliable service |
| Keeping a change history so a company can see who changed or deleted its paperwork, and restore it | Legitimate interests: protecting the accuracy and integrity of safety records |
| Keeping accounting and tax records | Legal obligation |
| Answering your questions | Legitimate interests |
| Running the video competition and using winning or shortlisted clips in our marketing | Consent: you agree when you enter, and can withdraw it at any time |
We will not send you marketing emails unless you have opted in, and you can opt out at any time.
What you must give us. To create an account we need your name and email address, and to take a subscription we need billing details through Stripe. Without them we can't provide an account or a paid plan, but you can still use the Free plan's features on your own device.
Automated decisions. We don't make decisions about you by automated means that have legal or similarly significant effects. The photo and voice reading features only suggest values for you to check.
5. Information about your clients (certificate content)
When you record client and site information, photos and signatures in a certificate, we process it for you as your processor. This means:
- we only use it to store, back up, sync and produce your certificates and reports;
- we do not use it for our own purposes, and we never sell it or use it for marketing;
- only people in your own company account can see it in the app. On Team and Business plans, engineers can view the company's paperwork but only change their own, and only the account owner can see the change history. We only look at it if you ask us to, or to fix a technical problem;
- you are responsible for having a lawful reason to record it and for telling your clients how their information is used (for example, in your own privacy notice).
Please photograph equipment and defects, not people. If a person is caught in a photo by accident, retake it or remove it.
On the Free plan, certificates, photos and signatures stay on your own device and are not sent to us. On paid plans (Solo, Team and Business) they are also backed up to our servers.
6. Who we share it with
We never sell personal information. We only share it with the service providers we use to run the app. Each one is contractually bound to protect it and to use it only on our instructions.
| Provider | What they do | Where the data is held |
|---|---|---|
| Supabase | Sign-in, database and photo storage | United Kingdom (London) |
| Stripe | Payments, subscriptions, receipts and invoices | UK, EU and USA |
| Netlify | Hosting the app and running its server functions | Worldwide network, including the USA |
| Anthropic | AI that reads emergency light labels and searches the web for the EM Light Finder, and reads board and tester photos and spoken test results for electrical certificates (not used to train its models) | USA |
| {{EMAIL_PROVIDER}} | Sending account emails such as confirmations and password resets, alerts to your company (failed logbook tests, client replies), and the reminders you choose to send to your clients | {{EMAIL_PROVIDER_LOCATION}} |
We may also share information with our professional advisers (such as an accountant), or where the law requires it, for example with HMRC or in response to a court order.
7. Transfers outside the UK
Your certificates and photos are stored in the UK. Some of our providers (Stripe, Netlify and Anthropic) may handle account, payment or technical information in the USA or elsewhere. When that happens, the transfer is protected by the safeguards UK law requires, such as the UK–US Data Bridge, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
8. How long we keep it
| Information | How long |
|---|---|
| Your account and company details | Until you delete your account |
| Backed-up certificates, photos and signatures | While your company has an active subscription. If the subscription ends, they are deleted from our servers automatically 90 days later, unless you subscribe again before then. |
| Anything you delete in the app | Kept in your recycle bin for 90 days so it can be restored, then removed for good. The account owner can delete it permanently sooner. Copies in our encrypted daily backups are overwritten within 7 days after that. |
| Change history | For as long as the certificate, asset list or quote it belongs to is kept. It is deleted with it. |
| Payment and invoice records | As long as tax law requires, usually six years |
| Error reports | 90 days, then deleted automatically |
| Video competition entries | Entries that aren't used: deleted within 6 months of the closing date. Clips we use in our marketing: for as long as we use them. You can ask us to stop using yours at any time |
| Security logs held by our providers | Usually no more than 90 days |
| Information stored on your own device | Until you delete it, sign out and clear it, or remove the app |
We may delete accounts that have not been used for two years. We will email you before we do.
9. Your rights
You have the right to:
- see the personal information we hold about you and get a copy;
- correct it if it is wrong;
- delete it;
- restrict or object to how we use it;
- take it with you in a format you can use elsewhere (data portability).
You can do most of this yourself in the app, under Account → Privacy & your data:
- Download my data saves a copy of your account details and certificates as a file;
- Delete my account removes your account. If you own the account, it also removes your company's backed-up certificates and photos, and cancels any subscription.
For anything else, email {{PRIVACY_EMAIL}}. We will reply within one month. There is normally no charge.
If your request is about information a company recorded in its certificates (for example, you are one of its clients), we will pass it to that company, because it is the controller of that information.
10. Keeping it secure
- All information is encrypted while travelling between your device and our servers (HTTPS), and our providers encrypt it where it is stored.
- Strict access rules in our database mean each company can only ever see its own certificates and photos.
- Only an account's owner can change its billing or company details.
- Our own administrator accounts are protected with two-step sign-in, and we limit who can access them.
No system is perfectly secure. If a data breach puts your rights at risk, we will tell you and the ICO as the law requires, normally within 72 hours of finding out.
11. Cookies and storage on your device
The app does not use advertising or tracking cookies. It stores information on your device only to work: keeping you signed in, saving your certificates, photos and any manuals you save to your Panel Library so they are available without signal, and remembering your settings and favourites. This storage is strictly necessary for the service you asked for, so it does not need your consent. You can clear it at any time by signing out and removing the app or clearing your browser's site data.
Voice commands. If you use the microphone button, your phone or browser turns your speech into text using its own speech service (for example Apple on iPhone, or Google in Chrome), under that company's privacy terms. We don't receive or keep any recordings: the app only uses the text to carry out the command on your phone. The first time, your phone asks for permission to use the microphone, and you can turn this off at any time in your phone's settings.
12. Children
The app is for tradespeople and businesses. It is not intended for anyone under 18.
13. Changes to this policy
We may update this policy, for example if we add features or change providers. The date at the top shows when it was last changed. If the changes are significant, we will tell you in the app or by email.
14. Complaints
If you are unhappy with how we have handled your information, please contact us first at {{PRIVACY_EMAIL}} so we can try to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk, helpline 0303 123 1113.