Privacy & Cookie Notice
Last updated: 25 October 2026
1. Who we are
CladGuard Analytics (12 Friars Street, King's Lynn, PE30 5AP, United Kingdom) is the controller of the personal data described in this notice, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For any privacy question or request, email j44806881@gmail.com.
2. What we collect and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Email address and password (stored hashed) | To create and secure your account | Contract |
| Company name, phone, VAT/registration number, address, signatory name, accreditations | To brand your quotes and RAMS documents | Contract |
| Job details, rates, saved tenders and drafts you enter (which may include client names and site addresses) | To provide the estimating, quoting and RAMS tools | Contract |
| Chosen plan, trial and billing details (card payments are handled by Stripe; we never see your full card number) | To manage your subscription and invoices | Contract; legal obligation (tax records) |
| Team members' email addresses and roles | To let a company share one account and control what each person can see | Contract |
| Company chat messages and photos | To let your team message each other | Contract |
| Site records: survey and snag photos, daily checks, briefing sign-on names, card numbers and signatures, walk-through notes, completion reports and construction drawings | To provide the site and compliance tools | Contract |
| Operative competency register: names, phone numbers, trades, training card numbers and expiry dates, employment type, hourly rate and an emergency contact | To check competence before work and cost labour | Contract (for the company entering it, legal obligation and legitimate interests) |
| Timesheets: who worked, when, on which job, and breaks taken | To record hours, approve timesheets and check working time limits | Contract (for the company entering it, legal obligation under the Working Time Regulations 1998) |
| Accident and near-miss reports, which may include details of an injury or ill health | To keep the company's accident book and meet RIDDOR 2013 duties | Legal obligation; for health details, UK GDPR Article 9(2)(b) (employment, social security and social protection law) and the Data Protection Act 2018, Schedule 1, paragraph 1 |
| Timesheet pay details: pay periods, CIS deduction rate and which hours have been paid | To produce wage sheets and avoid paying the same hours twice | Contract (for the company entering it, legal obligation for payroll and CIS records) |
| Operative worker profiles (name, trade, mobile, location, experience and training cards) and job applications | To let operatives apply for jobs on the jobs board. Your profile and message are shared only with the company whose job you apply for | Contract; consent each time you apply |
| Job posts (company name, trade, location, dates and pay) | Shown to every signed-in CladGuard user so operatives can find work | Contract |
| Live price check searches (the item and the job's town or postcode area) | To find current UK supplier prices with Google Search | Contract |
| Questions sent to the AI assistant, with the current job details | To generate AI answers and draft clauses | Contract |
| Sign-in times and technical logs | Security, preventing misuse and fixing faults | Legitimate interests |
Data your company enters about other people. When a company uses CladGuard to record its clients, operatives, timesheets or accident reports, that company is the controller of that data and CladGuard processes it on the company's behalf, under the data processing terms in our Terms of Service. The company is responsible for having a lawful basis and for telling the people concerned (for example in its staff privacy notice). Apart from the accident book, please don't enter health or other special category data. Accident reports are only visible to the person who made them and to the company's managers and supervisors. Site operatives with view-only logins never see prices, clients or other people's register details.
3. Who we share it with
We do not sell your data or use it for advertising. We use these service providers (processors) to run the service:
- Netlify, Inc. — website hosting, user accounts, database and file storage (photos, drawings, chat photos).
- Stripe Payments UK Ltd / Stripe, Inc. — subscription billing, card payments and invoices.
- Google (Gemini, via Netlify AI Gateway) — processes AI assistant questions and job details to produce answers, and searches the web for live price checks.
- Content delivery networks (Tailwind CSS CDN, cdnjs/Cloudflare, Google Fonts, esm.sh) — deliver styles, icons, fonts, the PDF viewer and sign-in code, and receive your IP address when the page loads.
- postcodes.io and Open-Meteo — receive the site postcode and its map location to provide the wind forecast.
Some of these providers process data in the United States. Where they do, transfers are protected by the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum to standard contractual clauses.
4. How long we keep it
We keep your account data while your account is open. When the account owner deletes their account, the company profile, tenders, drafts, plan, site records, photos, drawings, chat, timesheets, competency register and accident book are deleted immediately, and the login is removed. When a team member deletes their account, their login is removed and their chat messages are blanked. Billing records are kept by Stripe for as long as tax law requires. Server logs are kept for a short period by our hosting provider for security.
Companies should keep their own records for as long as the law requires before deleting them: accident book entries and RIDDOR records for at least 3 years, and working time records for at least 2 years. Download a CSV copy from the app before deleting.
5. Your rights
You have the right to access, correct, delete, restrict or object to the use of your personal data, and to data portability. Once signed in, you can download all your data or delete your account under Edit My Company → Your Data & Account. For anything else, email us and we will respond within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
6. Cookies
We only use cookies that are strictly necessary for the service to work, so under the Privacy and Electronic Communications Regulations (PECR) we don't need to ask for your consent. We do not use analytics, advertising or tracking cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| nf_jwt | Keeps you signed in to your account | Until you sign out or your session expires |
Storage on your device. So the app works without signal on site, it keeps a copy of the app's pages and of the data and drawings you have opened in your browser's storage (a service worker cache and IndexedDB). Changes made offline wait there until they can be sent. This is strictly necessary for the offline feature you use, so no consent is needed. Signing out deletes your saved data from the device. Please sign out of shared site tablets.
If we ever add non-essential cookies, we will ask for your consent first.
7. Changes
We will post any changes to this notice on this page and update the date above.
CladGuard Analytics, 12 Friars Street, King's Lynn, PE30 5AP, United Kingdom. Contact: Help & Contact or j44806881@gmail.com