Privacy policy
Last updated: 23 October 2026
1. Who we are
Site Log is a mobile app provided by UrProject Ltd, a company registered in England and Wales (company number 16336005), 20 Wenlock Road, London, N1 7GU ("we", "us"). We are the data controller for the personal data described here.
Questions about this policy or your data: contact@sitelog.app
2. What this policy covers
This policy explains what personal data the Site Log app and this website collect, why, who else handles it, and your rights. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
3. What we collect
Your account. Your email address and a password (stored only in scrambled form), and the name you give.
What you put on your reports. Your name, company name, the name shown as auditor, your company logo and your signature, if you add them.
Your site logs. Projects (name, reference, client, address), photos, the numbered marks you place on them, the items on each list with their trade, priority, status and who they are assigned to, any notes you type, and a written copy of what you said.
Voice recordings. When you record a walk, the recording is kept on your phone until you tap Generate. It is then sent to be turned into text and written up as your list. We do not keep the recording on our servers after that. The app asks for your permission the first time, and you can type the items yourself instead.
Subscription status. If you subscribe to Site Log Pro, Apple or Google takes the payment. We never see your card or bank details. We receive whether your subscription is active, what was bought and when.
How much you have used. A count of the walks written up for your account each month, so that plan limits can be applied.
Technical records. Our servers record the internet address and the time of each request for a short period, to keep the service secure and to find faults.
What we do not collect. The app does not ask for or store your location. It re-saves each photo before uploading it, which removes the location details a camera may add. In the rare case that a photo cannot be re-saved, it is uploaded as it is. The app has no advertising, no tracking and no analytics.
4. Why we use it, and the legal basis
| Data | Why | Legal basis |
|---|---|---|
| Account details | To create your account, sign you in and write to you about the service | Contract |
| Details on your reports | To put them on the PDF reports you create | Contract |
| Site logs and photos | To store your logs and build your reports | Contract |
| Voice recordings and typed notes | To write up your walk as a numbered list | Consent, which the app asks for before the first one is sent |
| Subscription status | To give you the plan you have paid for | Contract |
| Usage count | To apply plan limits and prevent misuse | Legitimate interests |
| Technical records | To keep the service secure and working | Legitimate interests |
The updated iOS app (version 2.0.0, build 21 onwards) shows a separate permission screen before the first AI request on each device. It names OpenAI and explains that your voice recordings and typed notes are sent through our server for transcription and report generation. Your photo, company logo and signature are not sent to OpenAI. Choosing Not now sends nothing to OpenAI; you can type report items yourself.
In that update, you can withdraw AI permission under Settings > AI processing > Withdraw AI permission. This stops new AI requests, including queued retries, until you agree again. Permission is stored separately for each account on each device, and updated disclosures may require a new choice. Earlier app releases may not have this withdrawal control: stop using Generate and update the app to use it. Turning off microphone access alone does not prevent typed notes from being processed. Withdrawal cannot recall data already sent.
5. Who else handles your data
We use the following companies to run the service. They act on our instructions and only handle what is needed. We require processors, including our AI provider, to protect personal data to the same or an equivalent standard as this policy through their data-processing terms, confidentiality and security obligations. They may process data only for the services and purposes described below.
Supabase hosts our database, sign-in and file storage. Your account, logs and photos are stored on its servers in London, United Kingdom.
OpenAI turns your voice recordings and typed notes into text and writes up the list. Your photos are not sent to OpenAI. OpenAI states that it does not use data sent this way to train its models, and that it may keep it for up to 30 days to check for misuse before deleting it. OpenAI is based in the United States.
RevenueCat tells the app whether your subscription is active. It receives an account number that we generate, your purchase records from Apple or Google, and basic details of your device and app version. It does not receive your name or email address from us. RevenueCat is based in the United States.
Resend sends our emails, such as the code that confirms your email address. It receives your email address. Resend is based in the United States.
Apple and Google process subscription payments under their own privacy policies.
GitHub hosts this website. It records the internet address of each visitor for security. It has no part in the app.
We do not sell your data, and we do not share it with advertisers.
6. Transfers outside the UK
OpenAI, RevenueCat and Resend process data in the United States, as does GitHub for visits to this website. Where data leaves the UK we rely on safeguards the law recognises, such as the UK's adequacy decisions and standard contractual clauses approved by the Information Commissioner's Office.
7. How long we keep it
| Data | How long |
|---|---|
| Account details, report details, site logs and photos | Until you delete them or delete your account |
| Voice recordings | On your phone until the walk is saved or discarded. Not kept on our servers |
| The written-up reply for a walk | Kept so that a retry gives the same answer. Cleared the next time you send a walk more than a day later, and when you delete your account |
| Usage count | Until you delete your account |
| Subscription records | For as long as RevenueCat, Apple and Google keep them under their own policies |
| Technical records | Up to 90 days |
When you delete your account, your logs, photos, profile, logo, signature and usage records are deleted from our live systems straight away. Copies in routine backups are overwritten within 30 days.
8. Deleting your account
You can delete your account and everything in it at any time:
- Open Site Log and go to Settings.
- Tap Delete account and confirm.
This cannot be undone. If you cannot use the app, email contact@sitelog.app from the address on the account and we will delete it within 30 days. Deleting your account does not cancel a subscription: cancel that in your Apple or Google account settings. See also sitelog.app/delete-account.
9. Security
Data is encrypted in transit and at rest, and each account can read only its own data. No system is completely secure, but we work to protect your data and will tell you and the regulator if a breach puts you at risk.
10. Your rights
Under UK GDPR you can ask us to: give you a copy of your data; correct it; delete it; limit how we use it; give it to you in a form you can move elsewhere; and stop using it where we rely on legitimate interests. Where we rely on consent you can withdraw it at any time.
Email contact@sitelog.app. We reply within one month.
11. Complaints
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
12. Children
Site Log is a work tool and is not intended for anyone under 16. We do not knowingly collect data from children. If we learn that we have, we will delete it.
13. Cookies
This website does not use cookies, advertising or analytics. The app does not use cookies.
14. Changes
We may update this policy. The date at the top shows the latest version. If a change is significant we will tell you in the app or by email.
15. Contact
UrProject Ltd, 20 Wenlock Road, London, N1 7GU. contact@sitelog.app