Privacy Policy

This Privacy Policy explains how Certisafe One ("we", "us") collects, uses, and protects your personal information when you use our platform (the "Service"). We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information We Collect

Account information: Your name, email address, role (Building Manager or Contractor), company name, company number, and registered address.

Building & compliance data: Building names, addresses, floor plans, defect reports, photographic evidence with capture timestamps, product information, operative accreditation details, and generated certificates.

Payment information: Subscription transactions are processed by Stripe. We do not store full card details — Stripe handles all payment data securely.

Usage data: How you interact with the Service, including login times, features used, and device information.

2. Legal Basis for Processing

We process your personal information under the following lawful bases: (a) Contract — to provide the Service you have subscribed to; (b) Legal obligation — to comply with fire safety and building regulations; (c) Legitimate interests — to improve and secure the Service; and (d) Consent — where you have provided explicit consent, which you may withdraw at any time.

3. How We Use Your Information

We use your information to: provide and maintain the Service; process subscription payments; generate FIRAS certificates and compliance records; facilitate building access sharing between Building Managers and Contractors; communicate with you about your account; improve the Service through AI-generated estimates and analytics; and comply with legal obligations.

4. Photographic Evidence & Timestamps

The Service captures device-generated timestamps when photographic evidence is uploaded. This data forms part of the compliance audit trail and may be included in certificates and reports. We do not alter these timestamps. Building Managers and their authorised contractors share responsibility for the accuracy of evidence submitted.

5. Data Sharing

We share your information with: (a) Stripe for payment processing; (b) Authorised users when a Building Manager shares building access with a Contractor; (c) AI service providers for generating estimates and processing uploaded content; and (d) Regulatory authorities where required by law. We do not sell your personal information.

6. Data Retention

We retain your personal information for as long as your account is active. Building safety records and compliance certificates may be retained for longer periods to meet regulatory requirements under the Building Safety Act 2022. Upon account termination, you may export your data for 30 days, after which personal data will be deleted, except where retention is required by law.

7. Data Security

We implement appropriate technical and organisational measures to protect your information, including encryption in transit and at rest, access controls, and regular security reviews. However, no method of internet transmission is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Under UK GDPR, you have the right to: access your personal data; rectify inaccurate data; erase your data (subject to legal retention requirements); restrict or object to processing; data portability; and withdraw consent. To exercise these rights, contact Base44 support through the platform.

Request account deletion: You can request deletion of your account and associated personal data at any time using our Account Deletion Request form.

9. International Transfers

Your information may be processed by service providers located outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to protect your data.

10. Children's Privacy

The Service is not directed at individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or in-app notice at least 30 days before they take effect.

12. Contact

For privacy questions or to exercise your data protection rights, please contact Base44 support through the platform.