Privacy Policy

Last updated: 19 August 2026

This Privacy Policy explains how Site Reports Ltd ("SiteReports", "we", "us") collects, uses, shares and protects personal data when you use the SiteReports mobile app, the web app at app.sitereports.live, and this website.

Site Reports Ltd is the data controller for that personal data. We are registered in England and Wales under company number 17373890, with our registered office at 195 Wood Street, London, E17 3NU, United Kingdom. You can contact us at any time at support@sitereports.live.

What we collect

Your account details, the reports, tasks and photos you create, and basic device, log and usage data.

How we protect it

Encrypted in transit with TLS and at rest, with access restricted to staff who need it to run and support the service.

How to delete it

You can ask us to delete your account and associated data at any time. See Delete your account.

Information we collect

We collect the following categories of personal data:

Account information

Name and email address
Password, stored only as a salted hash — we never hold it in readable form
Company or organisation name, and your role or job title, where you provide it

Content you create

Site reports, tasks, comments and project or site details
Photos you capture in the app or select from your device
Drawings, documents and other files you upload

Photo and camera data

Photos taken through the app camera, or chosen from your device photo library, are uploaded to your account so they can appear in your reports
Photos may carry embedded metadata (EXIF) such as the time of capture and, if location tagging is enabled on your device, the coordinates where the photo was taken
We access your camera and photo library only when you use a feature that needs them. You can withdraw these permissions at any time in your device settings, though the related features will then stop working

Device and technical data

Device model, operating system and app version
IP address, and the approximate region derived from it
Diagnostic, crash and error logs

Usage data

Screens and pages viewed, features used, and dates and times of access
On this website only, aggregate analytics collected through Google Analytics — see our Cookie Policy

Communications

The content of emails and support requests you send us, and our replies

We do not knowingly collect special category data such as health or biometric data, and we ask that you do not upload it to the service.

How and why we use your information

We use personal data to:

Create and administer your account, and authenticate you when you sign in
Provide the core service — storing, syncing and sharing the reports, tasks, photos and files you create
Share your work with the other members of your team or organisation, as the service is designed to do
Provide customer support and respond to your enquiries
Maintain security, prevent fraud and abuse, and investigate incidents
Diagnose faults, monitor performance and improve the service
Send you service and administrative messages about your account
Meet our legal, accounting and regulatory obligations

We do not use your reports, photos or files for advertising, and we do not sell personal data.

Legal bases for processing

Under the UK GDPR we rely on the following legal bases:

Performance of a contract — to provide the service you signed up for
Legitimate interests — to secure the service, prevent abuse, diagnose faults and improve what we offer, balanced against your rights
Consent — for optional device permissions such as camera, photo library and notifications, and for non-essential cookies on this website. You can withdraw consent at any time
Legal obligation — to retain financial records and to respond to lawful requests

Who we share information with

We do not sell personal data, and we do not share it with third parties for their own marketing. We share it only in these circumstances:

Your team and organisation

Reports, tasks, photos and comments you create are visible to the other members of the team, project or organisation they belong to, and to that organisation's administrators

Service providers who process data on our behalf

Supabase — database, file storage, authentication and backend hosting
Google Analytics — aggregate website analytics, on this website only
Google reCAPTCHA — bot and abuse prevention on our web forms
Our email provider — delivery of account, support and service emails

Other disclosures

Professional advisers such as our accountants and lawyers, where necessary
Law enforcement, regulators or courts, where we are legally required to disclose
A buyer or successor, if we sell or reorganise the business — you will be told beforehand and this policy will continue to apply

Our service providers act on our instructions under written agreements, and may not use your data for their own purposes.

International transfers

Some of our service providers process data outside the United Kingdom. Where that happens we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate technical safeguards. You can ask us for details of the safeguards that apply.

How long we keep it

Account and profile data — for as long as your account is active
Reports, tasks, photos and files — for as long as your account is active, or until you or your organisation administrator delete them
Data following a deletion request — removed from live systems within 30 days, and purged from encrypted backups within a further 30 days
Billing and transaction records — six years from the end of the relevant financial year, as UK tax law requires
Diagnostic, crash and security logs — up to 12 months
Support correspondence — up to 24 months after the enquiry is closed

Deleting your account and data

You can ask us to delete your SiteReports account and its associated data at any time. Full instructions, including what is deleted, what we have to keep and how long it takes, are on our Delete your account page.

Where you created reports as a member of an employer's or client's organisation, that content may belong to the organisation and may be retained in its account after your personal account is deleted.

Your rights

Under UK data protection law you have the right to:

Access the personal data we hold about you, and receive a copy of it
Have inaccurate data corrected
Have your data erased — see Delete your account
Restrict or object to how we process your data
Receive your data in a portable, machine-readable format
Withdraw consent at any time, where we rely on consent

To exercise any of these rights, email support@sitereports.live. We will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.

Security

All traffic between your device and our servers is encrypted using TLS
Data and uploaded files are encrypted at rest by our hosting provider
Access to production systems is restricted to authorised personnel and protected by multi-factor authentication
Passwords are stored only as salted hashes
We keep automated backups and monitor systems for suspicious activity

No system can be guaranteed completely secure. If a breach affects your personal data and presents a risk to your rights, we will notify you and the Information Commissioner's Office as the law requires.

Children

SiteReports is a business tool intended for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact support@sitereports.live and we will delete it.

Cookies and similar technologies

This website and the web app use cookies and local storage to keep you signed in, remember your preferences and measure aggregate usage. The mobile app uses local device storage to keep you signed in and to cache your data for offline use; it does not use advertising identifiers. See our Cookie Policy for detail, and for how to control non-essential cookies.

Changes to this policy

We may update this policy as the service changes. The date at the top of this page shows when it was last revised. If we make a material change we will tell you by email or through the app before it takes effect.

Contact us

For any question about this policy, or about how we handle your personal data, contact:

Site Reports Ltd, 195 Wood Street, London, E17 3NU, United Kingdom — support@sitereports.live

SiteReports is a service of Site Reports Ltd, a company registered in England and Wales under company number 17373890. Registered office: 195 Wood Street, London, E17 3NU, United Kingdom. Contact: support@sitereports.live