Privacy Policy

This policy explains what personal data Sitestack collects, why, and what your rights are. It applies to everyone who uses Sitestack — whether your company subscribes to it ("Customer"), or you were invited into a project by one ("User"), including staff, subcontractors, and clients.

Who's responsible for your data

Sitestack is provided by [Sitestack legal entity name and company number to be confirmed], registered at [registered office address] ("Sitestack", "we", "us").

For most of the data in Sitestack — project photos, documents, tasks, site diaries, client details — your employer or the company that invited you (the "Customer") is the data controller. They decide what to record and who can see it. Sitestack acts as their data processor, storing and processing that data on their instructions to provide the service. If you have a question about data held about you inside a specific project, your first point of contact should usually be that company, not us.

Sitestack is the data controller for account and billing information about the Customer itself, and for this website.

What we collect

• Account information: name, email address, role (admin, manager, operative, or client), and which organization and projects you belong to.
• Project content: photos, documents, tasks, milestones, site diary entries, progress updates, and messages that you or others upload or write within a project.
• Location data: where a project has switched on mandatory photo geotagging (for Part P electrical work evidence) or Part L thermal-performance tracking, the GPS coordinates and accuracy of where a photo was taken are recorded alongside it.
• Variations and e-signatures: if you sign or decline a variation (a request for additional work), we record your typed name, drawn signature image, IP address, device/browser information, GPS location (where available), and timestamp. This record is designed to be tamper-evident and is not editable once created — it is retained as a permanent audit trail of that agreement.
• AI feature usage: questions you ask Sitestack's AI search, and the project photos, documents, and tasks it retrieves to answer them.
• Technical data: IP address, browser and device type, and basic usage logs, collected automatically to keep the service secure and working.
• Support communications: anything you send us directly, e.g. by emailing support.

How we use it

• To provide the core service — storing and displaying your projects, photos, documents, and tasks.
• To generate the reports you request, including progress reports, handover packs, and compliance evidence reports (e.g. Part L / BREL thermal evidence, Part P photo records).
• To power the AI search and photo-captioning features (see below for how this works).
• To send transactional emails: invites, password resets, and notifications you've asked for.
• To keep the service secure, prevent abuse, and enforce our Terms of Service.
• To meet legal and regulatory obligations, including retaining compliance evidence where required.

AI features

Sitestack's AI search and photo captioning are powered by Anthropic's Claude models and Voyage AI's embedding models, used as sub-processors under our agreements with them. When you use these features, the relevant project content (e.g. the photos, documents, or task text needed to answer your question) is sent to these providers to generate a response. As of the date of this policy, Anthropic does not use data submitted through its commercial API to train its models. AI-generated answers and captions can be wrong — always use your own judgement, especially for anything safety- or compliance-related.

Who we share data with

We don't sell personal data. We share it only with the following categories of service provider, strictly to run Sitestack:

• Supabase — our database, authentication, and file storage provider.
• Vercel — hosts the application.
• Anthropic and Voyage AI — power the AI search and captioning features.
• Microsoft 365 / GoDaddy — sends transactional email (invites, password resets).

We may also disclose data if required by law, to protect Sitestack's or others' rights and safety, or as part of a merger, acquisition, or sale of assets (with notice to affected Customers).

International transfers

Some of the providers above may process data outside the UK and European Economic Area, including in the United States. Where that happens, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

How long we keep it

We retain project data for as long as the Customer's subscription is active, and for a reasonable period afterwards for backup and legal purposes. Signed variation records and compliance evidence (Part L / Part P) are retained for longer, reflecting the fact that building-related records commonly need to be produced years after the work was done. A Customer can request deletion of their account data at any time, subject to any legal retention obligations that apply to specific records.

Security

Data is encrypted in transit and at rest. Access within a project is controlled by role (admin, manager, operative, client) and enforced at the database level, not just in the app's interface. Signed variation records are protected against modification by a database-level rule, not just application logic.

Your rights

If UK GDPR or EU GDPR applies to you, you have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. If your data sits inside a project run by a Customer (your employer or the company that invited you), please contact them first, since they control that data — we'll assist them in responding to your request. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Cookies

Sitestack uses only essential cookies needed to keep you signed in and to remember your session. We don't use third-party advertising or tracking cookies.

Children

Sitestack is a business tool and isn't directed at, or knowingly used by, children.

Changes to this policy

We'll update the "Last updated" date above when we make changes, and let Customers know of any significant ones.

Contact us

Questions about this policy: info@sitestack.build. For support: support@sitestack.build.