PRIVACY POLICY

1. Introduction

Site Samurai is a trading name of SKYLA'S CHOICE LTD ("we", "us", "our"). We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our construction management platform and services.

SKYLA'S CHOICE LTD is registered in England and Wales under company number 16059710.

For the purposes of UK data protection legislation (including the UK General Data Protection Regulation and the Data Protection Act 2018), we are the data controller.

2. Information We Collect

We collect and process the following categories of personal data:

2.1 Information You Provide

• Account Information: Name, email address, phone number, job title, company name
• Organisation Details: Company registration number, VAT number, business address
• Project Data: Project names, addresses, contract values, client information
• Financial Information: Payment details, invoicing information, application for payment data
• Health & Safety Records: RAMS, incident reports, training records
• Subcontractor Data: CIS verification details, UTR numbers, insurance information
• Communications: Correspondence with us, support tickets, feedback

2.2 Information Collected Automatically

• Technical Data: IP address, browser type, device information, operating system
• Usage Data: Pages visited, features used, time spent on platform, click patterns
• Location Data: General location based on IP address (not precise GPS)
• Analytics Data: We use Google Analytics to understand how visitors use our website. This includes information about your device, browser, pages viewed, and how you interact with our platform
• Website Visits: We count visits to our public website (page, referring site and any campaign tags such as those on our Google Ads). If you accept analytics cookies, a random visit identifier links your visits, and a later trial sign-up, to the page or advert that brought you to us. If you don't, each page view is counted on its own, with no identifier and no IP address stored
• Session Replay: How you use the platform and our website (page navigation, clicks, scrolling and timings), recorded with anything you type masked, and all on-screen text masked in the signed-in platform. See Section 3.5
• Cookies and Similar Technologies: See our Cookie Policy for full details on the cookies we use, including Google Analytics cookies (_ga, _gid)

3. How We Use Your Information

We use your personal data for the following purposes:

3.1 Contract Performance

• Providing and maintaining our platform and services
• Processing your subscription and payments
• Enabling project management and collaboration features
• Generating reports and analytics for your organisation

3.2 Legitimate Interests

• Improving and developing our platform
• Providing customer support
• Sending service-related communications
• Preventing fraud and ensuring security
• Analysing usage patterns to improve user experience
• Recording masked replays of how signed-in users use the platform, to find and fix problems and support you — see Section 3.5
• Operating internal AI-assisted tools (including our internal operations assistant, "Jarvis") that help us run, monitor and support the platform — see Section 4 for details

3.3 With Your Consent

• Sending marketing communications about our products and services
• Using cookies for analytics and advertising purposes, including measuring which Google Ads lead to trial sign-ups
• Recording masked replays of visits to our public website — see Section 3.5

3.4 Legal Obligations

• Compliance with tax and accounting requirements
• Responding to legal requests from authorities
• Maintaining health and safety records as required by law

3.5 Session Replay

We record how people use Site Samurai so that we can see where they get stuck, find and fix faults, and improve the product. We use OpenReplay, which we run ourselves on a server hosted by DigitalOcean in London. Recordings are not sent to OpenReplay or to any other third party.

A recording captures the layout of the pages you view, the pages you move between, where you click and scroll, how long things take, and technical information such as your browser and device, your approximate location (derived from your IP address) and the addresses of the requests the page makes (without their query details). Masking is applied in your browser before anything is sent to us:

• Anything you type into a form is replaced with asterisks, so its content is never recorded
• In the signed-in platform, all on-screen text (including names, figures and document contents) is replaced with asterisks
• Uploaded documents, drawings and images are not captured
• Links, labels and hidden page details that could contain personal data are stripped

Signed-in platform: we may record use of the platform by any signed-in user (all sessions or a sample). A recording is linked to your internal user ID and your organisation, not your name or email address. We do not record client, supplier, subcontractor or employee portal links, our platform administration pages, our sales demo account, or sessions where our support staff are viewing your account. To join recordings together, OpenReplay keeps identifiers in your browser's storage (see our Cookie Policy). Our lawful basis is our legitimate interests in supporting you and operating and improving the platform. If you object, contact [email protected] and we will stop recording you or your organisation.

Public website: visits to our website are only recorded if you accept analytics cookies. We do not attach your name, email address or account to these recordings, but if you later sign in to the platform on the same device, the two recordings may share the same device identifier. Public page text is visible in website recordings; anything you type is masked. You can withdraw consent at any time through "Cookie Settings", after which recording stops and the identifiers it stored in your browser are removed.

We honour your browser's "Do Not Track" setting. Recordings are deleted from the replay server after 30 days; copies can remain in that server's backups for up to a further 28 days until the backups expire. Only a small number of authorised Site Samurai staff can view recordings.

4. Data Sharing

We may share your personal data with:

• Service Providers: DigitalOcean (application hosting, database and file storage, London), Amazon Web Services (encrypted offsite database backups, London), Sentry (error monitoring, EU), Pusher (real-time messaging, EU), Stripe (billing), Resend (transactional email), OpenAI and Anthropic (AI-assisted document generation, transcription and internal operations tooling), Google Cloud Vision (document text recognition), Google Maps Platform (address lookup), Google Analytics and Google Ads (website analytics and measuring advert results, only if you accept analytics or marketing cookies), Slack (internal support alerts), GitHub (source hosting and backup job runner)
• Professional Advisers: Lawyers, accountants, auditors where necessary
• Regulatory Bodies: HMRC for CIS verification, HSE for health and safety matters
• Your Organisation: Other users within your organisation as permitted by your administrator
• Business Partners: Only with your explicit consent

We do not sell your personal data to third parties.

4.1 Internal AI-Assisted Operations Tooling ("Jarvis")

Skyla's Choice Ltd and other companies in the same corporate group under common ownership use an internal AI-assisted operations tool, known as Jarvis, to help us run, monitor and support the Site Samurai platform. Jarvis is built using models provided by our AI processors named above (OpenAI and Anthropic), and, where the underlying provider offers it, we use zero data retention arrangements for this processing.

Depending on the integration enabled for a given purpose, Jarvis may read account, project, contract and site record data (which can include client names and other project-related personal data) held on the platform, in order to help us operate the service — for example, to monitor project and support activity, service usage and platform health.

Data accessed by Jarvis:

• Stays within our own corporate group (Skyla's Choice Ltd and its affiliated group companies) and is never sold or shared with unaffiliated third parties
• Is never used to send you marketing, to train AI models, or to build profiles of you or your organisation
• Is used solely to operate, maintain, support and improve the platform
• Is retained no longer than the corresponding data described in Section 6

Our lawful basis for this processing is our legitimate interests in operating and improving the platform and, where the processing is necessary to provide the service to you, performance of our contract with you.

5. International Transfers

Your data is primarily stored and processed within the United Kingdom. Where we transfer data outside the UK, we ensure appropriate safeguards are in place, including:

• Transfers to countries with UK adequacy decisions
• Standard Contractual Clauses approved by the ICO
• Binding Corporate Rules where applicable

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected:

• Account Data: For the duration of your subscription plus 7 years
• Financial Records: 7 years as required by HMRC
• Health & Safety Records: 40 years for accident/incident records as per HSE guidance
• Project Data: For the duration of your subscription plus 6 years (limitation period)
• Marketing Preferences: Until you withdraw consent
• Session Replay Recordings: 30 days (plus up to 28 days in server backups)

7. Your Rights

Under UK data protection law, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data in certain circumstances
• Right to Restrict Processing: Request limitation of processing in certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for marketing
• Rights Related to Automated Decision-Making: Not be subject to solely automated decisions

To exercise any of these rights, please contact us at [email protected]

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Access controls and authentication measures
• Regular security assessments and penetration testing
• Staff training on data protection
• Incident response procedures

9. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the platform. The "Last updated" date at the top indicates when the policy was last revised.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.