Privacy Policy — Site Audit & Plan

Introduction

This Privacy Policy explains how Woodbridge Software (“we”, “us”, “our”), collects, uses, stores, shares, and deletes personal data in connection with the Site Audit & Plan mobile application and web dashboard (the “Service”).

This policy applies to data processed in the Service, including on-device project data, cloud-hosted data in Supabase, subscription data processed through Stripe, payment and billing information, report generation in Google Cloud Run, and advertising identifiers used for third-party ad delivery through Google AdMob.

By creating an account, using the Service, or accepting the app’s consent screen, you confirm that you have read, understood, and agree to this Privacy Policy.

1. Who is the controller?

We are the controller of the personal data we process in connection with the Service, except where a third party is independently responsible for its own processing, for example Stripe, Supabase, Google Cloud Run, and Google AdMob.

2. What personal data we collect

We may collect and process the following categories of personal data:

• Account and profile data: name, email address, display name, password hash, authentication tokens, and account status.
• Project and report content: report titles, descriptions, dates, client details, reference numbers, issue text, annotation data, uploaded photo metadata, report access settings, and collaboration data.
• Media and file data: photos, annotated images, plan PDFs, generated PDF/XLSX reports, and exported files stored locally or in cloud storage.
• Cloud and collaboration data: project membership records, report collaborator records, invite metadata, share status, notification payloads, and related project access history.
• Billing and membership data: Stripe customer ID, subscription ID, price ID, plan tier, billing status, payment status, and related subscription history.
• Device and technical data: device type, operating system version, app version, browser user-agent (for web), IP address, log information, crash reports, and session data needed to keep the Service running securely.
• Communication and support data: messages sent to us, support requests, bug reports, and contact information used to respond to you.
• Advertising identifiers: advertising IDs or device identifiers used by Google AdMob for the delivery of ads and basic measurement.

3. How we use your data

We use your personal data to:

• Create and maintain your account, sign you in, and manage your profile.
• Provide the Service, including project creation, issue tracking, report generation, plan handling, collaboration, and shared access.
• Store and display reports, photos, annotations, project metadata, and settings in the app or web dashboard.
• Process report exports, PDFs, XLSX files, and sharing features.
• Manage collaboration invitations, project membership, and access control.
• Process Pro membership and payments through Stripe.
• Detect, prevent, and investigate fraud, abuse, unauthorised access, or misuse of the Service.
• Provide customer support and respond to your requests.
• Maintain the security, reliability, and performance of the Service.
• Display third-party advertising in the mobile app where applicable.

4. Lawful basis for processing

We process personal data only where we have a valid lawful basis under UK data protection law, including:

• Contract: to provide the Service and meet our obligations under the Terms of Use.
• Legitimate interests: account security, anti-abuse measures, service administration, debugging, support, and fraud prevention.
• Consent: where required for optional uses, such as consenting to the Privacy Policy and Terms of Use before using the Service, or where a third party requires consent for non-essential tracking or advertising.
• Legal obligation: to comply with legal or regulatory obligations, including payment and fraud-related recordkeeping where required.
• Vital interests: where necessary to protect life or safety.

Where we rely on consent, you may withdraw that consent at any time, subject to the applicable functionality and your rights.

5. Third-party services and data sharing

We may share personal data with the following categories of service providers where this is necessary to operate the Service:

• Supabase: authentication, database, storage, collaboration notifications, and remote project/report data hosting.
• Google Cloud Run: generation of PDF reports and related processing jobs.
• Stripe: payment processing and subscription management for Pro membership.
• Google AdMob: ad delivery, measurement, and related advertising operations.
• Cloud hosting and infrastructure providers used to host the Service, support functionality, or maintain backups.

We do not sell personal data. We may also disclose personal data where required by law, court order, or lawful authority, or to protect the rights and safety of users or third parties.

Where data is transferred outside the United Kingdom, we will ensure appropriate safeguards are in place under UK data protection law, including where required by the UK GDPR and the UK International Data Transfer Addendum.

6. Local storage and cloud storage

The Service may store data:

• On your device, in the app’s local database and files, as part of offline functionality.
• In Supabase, where you use online projects, remote reports, collaboration features, account data, or cloud sync features.
• In Stripe, for subscription and payment records.
• In Google Cloud Run or related infrastructure during PDF generation or secure report rendering.

Local device data remains under your control until you delete it from the app or uninstall the app. Cloud data is retained while the project, report, account, or subscription remains active, or as long as required by law or the Service’s business needs.

7. Retention

We keep personal data only for as long as necessary for the purposes described in this policy, or as required by law.

Typical retention periods are:

• Account and profile data: while your account remains active and for a reasonable period after closure, unless a longer period is required by law.
• Project and report data: while the project or report exists, or until you delete it, or until the related records are removed through the app or service.
• Collaboration invite data: typically up to 30 days for pending invites, or as long as necessary to process accepted or rejected invitations.
• Membership and billing records: as required for subscription management, accounting, tax, and fraud prevention.
• Support and ticket data: for the period reasonably necessary to respond to the issue and manage any related follow-up.
• Log and security data: for a limited period needed for operational security and troubleshooting.

When data is no longer needed, we will delete or anonymise it securely where practical.

8. Your rights

You have rights under UK data protection law, including:

• The right to access your personal data.
• The right to rectification if data is inaccurate or incomplete.
• The right to erasure, subject to legal exceptions.
• The right to restrict processing in certain circumstances.
• The right to object to processing based on legitimate interests or direct marketing/advertising.
• The right to data portability where applicable.
• The right to withdraw consent where consent is the basis for processing.
• The right to complain to the Information Commissioner’s Office (ICO) if you think your data rights have been infringed.

To exercise a right, or to request deletion of account data, contact us at siteauditplan@outlook.com. We will respond in accordance with applicable law.

9. Consent and optional features

The Service may ask you to agree to the Privacy Policy and Terms of Use before account creation or sign-in. This consent is required for the Service to operate in a lawful and transparent way.

The web dashboard may also use browser session storage and local storage to maintain application state and keep authenticated sessions active. We do not use non-essential tracking cookies for marketing or profiling by default. Advertising identifiers may still be used by Google AdMob for advertising and measurement as required by its policies and the relevant consent or device settings.

10. Children

The Service is not intended for children under 13 years of age. We do not knowingly collect personal data from children under 13. If you are under 13, please do not use the Service.

11. Security

We use reasonable technical and organisational safeguards to protect personal data from unauthorised access, loss, or misuse. However, no system can be completely secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the Effective date above and, where appropriate, notify you in the app or web dashboard. Continued use of the Service after the updated policy is published will constitute acceptance of the revised policy.

13. Contact

If you have any questions about this Privacy Policy, data requests, or concerns about your personal data, please contact:

Woodbridge Software
Email: siteauditplan@outlook.com

This Privacy Policy is governed by the laws of England and Wales, and is intended to operate consistently with the UK GDPR and the Data Protection Act 2018.