Privacy Policy — KaelSite

KaelSite is a trading style of Finodax Ltd, a company registered in England and Wales [company number], with its registered office at [registered address] ("we", "us" or "our"). We are the data controller for the personal data described in this policy, such as your account details. For personal data about your own staff, contractors and site personnel that you or your organisation upload to your projects, you (or your organisation) are the controller and we act as your processor under our Data Processing Agreement (kaelsite.com/legal/additional-legal-compliance/). This policy covers the KaelSite website (kaelsite.com), the KaelSite mobile app for iOS and Android, and related services. We are committed to protecting your privacy.

1. Information We Collect

Personal Information

Your name, email address, phone number, job title, company name and login credentials.
Billing details are entered and processed by our payment provider on our website. We do not store your full card details.

Site & Project Data

Projects, work items, inspections, checklists and reports that you create.
Photos, videos, voice notes, documents, signatures, notes, diary entries, issues and communication records that you add.
Location data. If you use your current location to pin a project or work item, or to record where an inspection took place, we receive your precise location. The app only asks for location while you are using it.

Calendar Data (Google Calendar Integration)

If you connect your Google Calendar, we receive the details of the calendar events needed to create and show inspection reminders. We request only the calendar.events permission. See Section 4.

AI Assistant (Kael) Data

When you use Kael, our built-in AI assistant, we collect the messages you send, Kael's replies, and the information retrieved to answer you (for example, help articles and, where relevant to your question, your own project records and documents). Your chat history is stored in your account.

Usage & Technical Data

Device information (such as device model, operating system, registration date and last-used date), which powers the Mobile Devices page in your account.
IP address and log data created when you use our services.
On our website only, cookies and similar technologies (see Section 8).

Device permissions in the mobile app

The app asks for permission before using your camera, microphone, photo library or location, and only when you use the feature that needs it. If you turn on Face ID or Touch ID to unlock the app, this is handled by your device. We do not receive your biometric data. Reminders are scheduled on your device.

2. How We Use Your Information

We use your information to:

provide and run KaelSite, including creating your account and keeping your projects, inspections and reports (legal basis: contract);
send verification codes, service messages and reminders (contract);
generate reports and provide the Kael assistant (contract);
let you share projects with team members you invite, according to the permissions you set (contract);
process payments and keep billing records (contract and legal obligation);
keep the service secure, prevent fraud and fix problems (legitimate interests);
improve and develop the service (legitimate interests);
send newsletters or marketing, where you have chosen to receive them (consent, which you can withdraw at any time);
meet our legal obligations (legal obligation).

[Choose one of the two options below and delete the other.]

(A) We do not use your content to train AI models.
(B) We may use anonymised and aggregated data to improve our own AI features. We do not use identifiable content for this.

3. How We Share Your Information

We do not sell your personal data. We share it only as follows:

Team members you invite. Records you add to a project are shared with the members of that project, according to the permissions the project owner sets.
Service providers. Companies that help us run KaelSite, bound by data protection agreements: server hosting, file storage, email delivery, SMS delivery (for one-time verification codes), payment processing on our website, and web security and delivery. On our website only, we also use analytics providers (see Section 8).
AI service providers. Kael is powered by third-party AI providers: OpenAI, Anthropic, xAI, Groq and Google. When you use Kael, we send them your messages and the information needed to answer them, such as [the parts of your project records or documents relevant to your question, and recent messages in the same chat]. They process this on our behalf to produce the reply. [We do not allow them to use your data to train their models or for advertising.] These providers may process data outside the UK and EEA (see Section 9). Using Kael is optional, and the rest of KaelSite works without it.
Legal authorities when required by law.

4. Google User Data

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only the calendar.events scope. We use Google data only to provide inspection reminders in your calendar. We do not use it for advertising, we do not sell it, and we do not use it to train generalised AI models. You can disconnect Google Calendar at any time in your account settings, and you can also remove KaelSite's access from your Google Account.

5. Data Security

We use technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls and secure hosting. No system is completely secure, so we cannot guarantee absolute security. Please keep your login details private.

6. Data Retention and Account Deletion

We keep your data while your account is active. To delete your account, use the "delete account" option on the Profile screen of the app, or go to kaelsite.com/settings/delete-account/. You confirm the request with a code sent by SMS. You can also email [email protected] from your registered address with the subject "Account deletion request".

When you request deletion:

your account is deactivated and you are logged out everywhere straight away;
your subscription is set to cancel at the end of the current period, so you are not charged again;
you have a grace period that ends on the later of your subscription end date or 14 days after the request. During it you can reactivate your account and restore everything. We email you the exact permanent-deletion date and send a reminder a few days before it;
when the grace period ends, we permanently delete your account and your projects, files, notes, inspections and AI chats, including files stored in cloud storage.

We keep billing records (invoices, payment history and payment-provider identifiers) for as long as UK law requires, separated from your account. We also record that a deletion took place, without any personal data.

7. Your Rights (GDPR & UK Data Protection Act)

You have the right to:

access the personal data we hold about you;
correct inaccurate data;
delete your data;
restrict or object to our processing;
receive your data in a portable format;
withdraw consent at any time, where we rely on consent.

To use any of these rights, contact us using the details in Section 12. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies and Tracking

Our website uses essential cookies and, with your consent, analytics cookies (Google Analytics through Google Tag Manager) to measure how the site is used, and marketing cookies (Google Ads through Google Tag Manager) to measure the effectiveness of our advertising and show more relevant ads. We only set analytics and marketing cookies if you allow them.

You can change or withdraw your choices at any time using the Cookie settings link at the bottom of every page, or through your browser settings. For details of the cookies we use, what they do and how long they last, see our Cookie Policy.

The mobile app does not contain advertising trackers or third-party analytics tools.

9. International Data Transfers

[Our file storage and email services are hosted in the UK (London). Our application servers are in [country].] Some providers, including our AI providers and payment provider, may process data outside the UK and EEA, including in the United States. Where this happens, we make sure appropriate safeguards are in place, such as an adequacy decision, the UK International Data Transfer Agreement or Addendum, or standard contractual clauses.

10. Children

KaelSite is a work tool for the building industry. It is not designed for or marketed to children, and we do not knowingly collect personal data from children under 13. If you think a child under 13 has given us personal data, contact us and we will delete it.

11. Changes to This Privacy Policy

We may update this policy from time to time. We will post the new version on this page with a new "last updated" date, and where a change is significant we will tell you by email or in the app.

12. Contact Us

Finodax Ltd (trading as KaelSite) [71-75, Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ] Email: [[email protected]] Phone: 0330 520 4998