Privacy notice

Your firm decides what goes into its account and is the controller of that data. We process it on your firm's instructions and are the processor. For your own account details, and for people visiting this site, we are the controller.

• Account details: your name, your email address, and the phone number you choose to add.
• Firm details: the firm name and address you enter when you set the firm up.
• Job data: plots, stages, scope text, prices, shot lists, certificate requirements and reference photos.
• Uploaded files: photos, certificates and documents submitted against a stage.
• Sign-in data: the six-digit codes we send you, and the public key of any passkey you register. A passkey's private key never leaves your device and we never see it.
• Technical records: the append-only audit log of state changes, and server logs holding request details and IP addresses.
• Site analytics: page views on this site, with no cookies and no identifiers that follow anybody between sites.

We process this data to perform our contract with your firm, and, for security and fraud prevention, on our legitimate interests.

• To run the service your firm signed up for: setting up stages, inviting subcontractors, and keeping each piece of evidence against the stage it belongs to.
• To sign you in and keep the account secure.
• To answer support requests.
• To keep an accurate record of who did what, which is the point of the product.
• To bill a firm on a paid plan.

The API and the database run on managed hosting in the European Union. Uploaded photos, certificates and documents are held in object storage in the same region. The site and the console are served by a managed hosting provider. Your data is stored in the European Union. The UK recognises the EU as providing adequate protection, so no additional transfer safeguards are required. Email is sent through a transactional email provider. Errors are reported to an error monitoring service. Each of these is a processor acting on our instructions and none of them sells your data.

• The members of your firm: the owner and the managers invited to it.
• A subcontractor invited to a stage, for that stage only. They see no other plot and no other stage.
• Us, where support or a fault requires it. We do not look at a firm's photos out of interest and we do not use them to train anything.
• Nobody else. We do not sell data and we run no advertising.

While the account exists. If you ask us to delete your firm's data we do it within thirty days, and we confirm when it is done. Server logs are kept for a short period and then cleared.

This site sets no cookies and there is no cookie banner because there is nothing to consent to. Analytics counts page views without cookies and without identifiers that follow you between sites. The console sets a session cookie once you sign in, because it has to in order to keep you signed in.

You can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or object to how we are using it. Email hello@builtstraight.com and we will reply, usually within one working day, and act within thirty days. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk.

If this notice changes we update the date at the top, and we email account holders about any change that affects what we do with their data.