Privacy policy

Siteproof is operated by Wolsten Studios LTD, a company registered in the Republic of Cyprus (registration number ΗΕ 485976) and based in Larnaca. In this policy "we" means Wolsten Studios LTD.

For privacy questions or to exercise your rights, email hello@siteproof.dev.

• People who visit siteproof.dev, including anyone who uses the demo map or sends a demo request.
• People with an account on the Siteproof platform, such as office staff and field users at our customers.
• People whose details our customers record in the platform, such as someone named in a safety record or who completes a public form link.

We are the controller for personal data about website visitors, demo requests, and the accounts we provide to our customers' staff.

We are a processor for the records our customers create in the platform: jobs and assets, photos, signatures, form answers, locations, safety records and anything entered through their form or request links. Our customer, usually the contractor employing the people involved, decides what is recorded and why, and we handle those records on their instructions under our agreement with them. If your details are in a customer's records, please contact that organisation first; we will help them respond.

On siteproof.dev

• Analytics, only if you agree. If you choose "Accept analytics", Google Analytics records how the website is used: the pages you view, how you arrived, your device and browser type, and an approximate location worked out from your IP address. If you reject, or do not choose, the website sets no cookies and runs no analytics.
• Our hosting provider keeps short-lived server logs, including IP address and browser details, for security and to keep the site running.
• If you send a demo request: your name, work email, company, the network you work on if you tell us, and your message.
• If you start the demo map: see section 7.

Platform accounts

• Name, work email, role and organisation membership.
• Sign-in and session data, handled by Clerk.
• Activity records that show who did what and when, kept so work can be audited.

Records our customers create (as processor)

• Job, asset, rate and commercial records, and the people assigned to them.
• Photos, documents and signatures captured as evidence.
• Location data: GPS positions recorded when a field user changes status (for example on site or work started), with form answers and photos that ask for a location, and with safety records. These are used as evidence and for journey reports.
• Safety records, including competency cards and risk assessments. Incident records can include the name of an injured person, the type of injury and the treatment given. That is health data, which the law treats as special category data; our customers record it to meet their own health and safety duties.
• Submissions through a customer's public form or request links, such as a name, contact details, an address and a message.

In-app help assistant

• Questions typed into the assistant are sent to Anthropic to generate an answer. The assistant cannot see any records, uploads or locations.

• Providing the platform to our customers and their users: performance of our contract with the customer (Article 6(1)(b)), and our legitimate interest in running the service for their staff (Article 6(1)(f)).
• Security, preventing misuse and fixing faults: our legitimate interests (Article 6(1)(f)).
• Understanding how the website is used with Google Analytics: your consent (Article 6(1)(a)). You can withdraw it at any time with "Cookie settings" at the bottom of every page.
• Replying to demo requests and arranging demos: steps you ask us to take before a possible contract (Article 6(1)(b)) and our legitimate interest in replying to enquiries (Article 6(1)(f)).
• Meeting legal obligations, such as tax and company records: legal obligation (Article 6(1)(c)).
• Records we handle as a processor: our customer decides the purpose and relies on its own legal basis, for example its employment and health and safety obligations for incident records.

We do not sell personal data, use it for advertising, or make decisions about people by automated means alone.

The platform's database and files are stored by Supabase on Amazon Web Services in the eu-west-1 region, Ireland. Its application servers run on Vercel in Dublin. We use these service providers, each under a data processing agreement:

Supabase

Database and file storage for the platform. AWS eu-west-1, Ireland.

Vercel

Hosting for the website and the platform's application servers. Application servers in Dublin; Vercel Inc. is based in the United States.

Clerk

Sign-in, sessions and organisation membership. United States.

MapTiler

Base maps and address search in the platform. Switzerland.

Anthropic

Answers to questions typed into the in-app help assistant. United States.

Resend

Sending emails, including form notifications and demo requests. United States.

Google

Website usage statistics (Google Analytics), only if you accept analytics cookies. Data may be processed in the United States.

Within your organisation, people see records according to the roles and assignments your organisation sets. We may disclose data where the law requires it, or to a successor if the business is sold, with notice to customers.

The demo map on our homepage only loads when you start it or open a link to it. Your browser then fetches the map style, map images and fonts from OpenFreeMap (tiles.openfreemap.org, served through Cloudflare), which receives your IP address and browser details as part of those requests. The map sets no cookies, and nothing you do in the demo is sent to us. If you have accepted analytics, Google Analytics can record the visit and any link you follow, as on every other page.

Some providers are based in the United States or Switzerland. Where personal data leaves the EEA or the UK, it is protected by an adequacy decision (Switzerland), by the EU-US Data Privacy Framework and its UK extension where the provider is certified, or by the European Commission's Standard Contractual Clauses with the UK Addendum.

• Demo requests and enquiries: up to 24 months after our last contact, unless you become a customer.
• Account data: for as long as your organisation uses Siteproof. It is deleted or anonymised within 90 days after the service ends, unless the law requires us to keep it.
• Records our customers create: for as long as the customer instructs under our agreement, which may be up to 7 years for audit and contractual records, then deleted or returned.
• Support correspondence: 2 years after it is resolved.
• Google Analytics: data linked to an analytics cookie is deleted automatically after 14 months at most. The reports we keep are summaries that do not identify you.

• All traffic uses HTTPS, and browsers are told to use HTTPS only.
• Data is encrypted at rest by our database and storage provider.
• Every signed-in request is checked against your organisation and your role on the server before any record is read or written.
• Photos, signatures and documents are kept in private storage, reachable only through links that expire within minutes.
• Key records, such as accepted quantities and issued commercial documents, cannot be edited once recorded; corrections are added as new records.
• Sign-in and sessions are handled by Clerk.
• The field app keeps downloaded Project data in the browser on the device so work can continue offline. It is cleared when the user signs out or loses access. It is not encrypted separately by Siteproof, so devices should use a passcode.

If a personal data breach is likely to put people at risk, we will tell the Office of the Commissioner for Personal Data Protection within 72 hours of becoming aware of it, and tell affected customers promptly. Where the risk is high, we will also tell the people affected.

Under the GDPR and the UK GDPR you can ask us to:

• give you a copy of your personal data;
• correct data that is wrong or incomplete;
• delete data we no longer have a reason to keep;
• restrict how we use it, or object to uses based on our legitimate interests;
• give you data you provided in a portable format.

Email hello@siteproof.dev. We reply within one month and may need to confirm who you are. For records a customer created, we pass your request to that organisation and help them answer it.

• siteproof.dev sets no cookies unless you choose "Accept analytics". Google Analytics then sets two cookies: _ga, which tells visits from the same browser apart, and _ga_J07BJ94GD3, which keeps track of the current visit. Both last about 13 months. We do not use them for advertising, and Google signals and ad personalisation are switched off.
• We remember your choice in your browser's local storage, so we do not ask on every page. It is used for nothing else.
• To change your mind, use "Cookie settings" at the bottom of any page. If you withdraw, we stop Google Analytics and delete its cookies from your browser.
• The platform (app.siteproof.dev) uses essential cookies from Clerk to keep you signed in, and browser storage for offline field work. Neither is used for advertising or tracking.

Please contact us first. You can also complain to our lead supervisory authority, the Office of the Commissioner for Personal Data Protection, 1 Iasonos Street, 1082 Nicosia, Cyprus (dataprotection.gov.cy, commissioner@dataprotection.gov.cy). If you are in the UK, you can complain to the Information Commissioner's Office (ico.org.uk).

We will update this page when our practices change. We will tell account administrators by email at least 14 days before a material change takes effect. The date at the top shows when it was last updated.