Privacy Policy

This policy explains what personal data Sitestack collects, why, and what your rights are. It applies to everyone who uses Sitestack, whether your company subscribes to it ("Customer"), or you were invited into a project by one ("User"), including staff, subcontractors, and clients.

Who's responsible for your data

Sitestack is provided by Sitestack Technologies Ltd, a company registered in England and Wales (company number 17455596), of 82A James Carter Road, Mildenhall, IP28 7DE ("Sitestack", "we", "us").

For most of the data in Sitestack (project photos, documents, tasks, site diaries, client details), your employer or the company that invited you (the "Customer") is the data controller. They decide what to record and who can see it. Sitestack acts as their data processor, storing and processing that data on their instructions to provide the service. If you have a question about data held about you inside a specific project, your first point of contact should usually be that company, not us.

Sitestack is the data controller for account and billing information about the Customer itself, and for this website.

What we collect

• Account information: name, email address, role (admin, manager, operative, or client), and which organization and projects you belong to.
• Project content: photos, documents, tasks, milestones, site diary entries, progress updates, and messages that you or others upload or write within a project.
• Location data: where a project has switched on mandatory photo geotagging (for Part P electrical work evidence) or Part L thermal-performance tracking, the GPS coordinates and accuracy of where a photo was taken are recorded alongside it.
• Variations and e-signatures: if you sign or decline a variation (a request for additional work), we record your typed name, drawn signature image, IP address, device/browser information, GPS location (where available), and timestamp. This record is designed to be tamper-evident and is not editable once created. It is retained as a permanent audit trail of that agreement.
• AI feature usage: questions you ask Sitestack's AI search, and the project photos, documents, and tasks it retrieves to answer them.
• Technical data: IP address, browser and device type, and basic usage logs, collected automatically to keep the service secure and working.
• Website analytics: if you accept analytics cookies on our marketing website, Google Analytics records pages viewed, approximate location, device and browser type, and how you arrived at the site.
• Support communications: anything you send us directly, e.g. by emailing support.

How we use it

• To provide the core service, storing and displaying your projects, photos, documents, and tasks.
• To generate the reports you request, including progress reports, handover packs, and compliance evidence reports (e.g. Part L / BREL thermal evidence, Part P photo records).
• To power the AI search, photo captioning and video transcription features (see below for how this works).
• To send transactional emails: invites, password resets, and notifications you've asked for.
• To keep the service secure, prevent abuse, and enforce our Terms of Service.
• To meet legal and regulatory obligations, including retaining compliance evidence where required.

Marketing emails

We sometimes email construction businesses about Sitestack using contact details published on their own websites, relying on legitimate interests for business-to-business marketing. Every such email includes an unsubscribe link, and replying with "unsubscribe" works too; we stop straight away and won't email that address again. These emails contain a small tracking image and tracked links so we can see whether an email was opened or a link was clicked. That tells us how the email was received, nothing more: we record the time and the browser or mail app type, not your location or anything you do on our site afterwards.

AI features

Sitestack's AI search and photo captioning are powered by Anthropic's Claude models and Voyage AI's embedding models, used as sub-processors under our agreements with them. When you use these features, the relevant project content (e.g. the photos, documents, or task text needed to answer your question) is sent to these providers to generate a response. When a video is uploaded, its sound is sent to OpenAI to produce a written transcript, which is kept with the video so it can be searched. As of the date of this policy, Anthropic does not use data submitted through its commercial API to train its models. AI-generated answers and captions can be wrong. Always use your own judgement, especially for anything safety- or compliance-related.

Who we share data with

We don't sell personal data. We share it only with the following categories of service provider, strictly to run Sitestack:

• Supabase is our database, authentication, and file storage provider.
• Vercel hosts the application and the marketing website, and provides cookie-free visit counts on the marketing website.
• Anthropic and Voyage AI power the AI search and captioning features.
• OpenAI transcribes the sound in uploaded videos.
• Resend sends the app's emails, such as invitations, notifications, and documents sent to people outside Sitestack.
• Stripe handles subscription billing and card payments. We never see or store full card numbers.
• Sentry receives error reports when something goes wrong in the app, so we can fix it.
• Apple delivers push notifications to the iPhone app.
• Cloudflare runs Turnstile, a check that a person rather than an automated program is using the sign-up form and the reply page opened from an emailed link. It looks at technical details of your browser and connection to do this.
• Google provides Google Analytics on our marketing website, only if you accept analytics cookies.
• Microsoft 365 / GoDaddy sends transactional email (invites, password resets).

We may also disclose data if required by law, to protect Sitestack's or others' rights and safety, or as part of a merger, acquisition, or sale of assets (with notice to affected Customers).

International transfers

Some of the providers above may process data outside the UK and European Economic Area, including in the United States. Where that happens, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

How long we keep it

We retain project data for as long as the Customer's subscription is active, and for a reasonable period afterwards for backup and legal purposes. Signed variation records and compliance evidence (Part L / Part P) are retained for longer, reflecting the fact that building-related records commonly need to be produced years after the work was done. A Customer can request deletion of their account data at any time, subject to any legal retention obligations that apply to specific records.

Security

Data is encrypted in transit and at rest. Access within a project is controlled by role (admin, manager, operative, client) and enforced at the database level, not just in the app's interface. Signed variation records are protected against modification by a database-level rule, not just application logic.

Your rights

If UK GDPR or EU GDPR applies to you, you have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. If your data sits inside a project run by a Customer (your employer or the company that invited you), please contact them first, since they control that data, and we'll assist them in responding to your request. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Cookies

The Sitestack app uses only essential cookies needed to keep you signed in and to remember your session.

Our marketing website (www.sitestack.build) also uses Google Analytics, provided by Google, to show us which pages are visited and how people find the site. Its cookies (named _ga and _ga_ followed by an identifier) are only set if you click Accept on the cookie banner. If you click Decline, or ignore the banner, Google Analytics does not load and no analytics cookies are set. We don't use advertising cookies or share this data for advertising. You can change your choice at any time using the "Cookie settings" link in the footer of the website. Our legal basis is your consent, and you can withdraw it whenever you like.

The marketing website also uses Vercel Web Analytics to count page visits. It doesn't set cookies or store anything on your device, and it doesn't identify you or follow you across other sites. It only gives us totals, such as how many people viewed a page and which site referred them.

Children

Sitestack is a business tool and isn't directed at, or knowingly used by, children.

Changes to this policy

We'll update the "Last updated" date above when we make changes, and let Customers know of any significant ones.

Contact us

Questions about this policy: info@sitestack.build. For support: support@sitestack.build.