1. Who We Are
WhatOnSite ("we", "us", "our") is operated by WhatOnSite Ltd. We're a UK-based company; full registration and registered-office details will be added here once incorporation is complete. Until then, the fastest way to reach us for anything privacy-related is whatonsite@gmail.com.
This policy explains what information WhatOnSite collects when you use our building-management platform, why we collect it, and — most importantly — what rights you keep over it. The short version: your building data belongs entirely to you, not to us.
2. Information We Collect
2.1 Account Information
- Name, email address, and password (stored securely via Supabase Auth — we never see your plain-text password)
- Company/organisation name, if you add one
- Billing details, handled entirely by our payment processor (Lemon Squeezy) — we don't store card numbers
2.2 Building Content You Upload
This is the core of what WhatOnSite stores on your behalf. It always remains your content:
- Building information: addresses, floors, rooms, and their metadata
- Photos and 360° photos: room and equipment imagery, including panoramic captures
- Videos attached to rooms or equipment
- Drawings and CAD files: floor plans, PDF drawings, and native CAD formats (DWG, DXF, IFC, STEP, DGN, RVT, SKP)
- Documents: manuals, certificates, warranties, inspection and maintenance reports, invoices
- Records you create: equipment, problems, tasks, contractors, and any notes or annotations you add
2.3 AI Requests
When you ask the AI Assistant a question, we send that question — along with the specific building records needed to answer it — to our AI provider to generate a response. See our AI Policy for exactly how this works and what is (and isn't) done with that data.
2.4 Automatically Collected Information
- Authentication data: session tokens that keep you signed in
- Usage and analytics data: pages visited and features used, to help us improve the product
- Device information: browser type, operating system, and IP address, mainly for security and fraud prevention
- Cookies: see our Cookie Policy for the full breakdown
3. How We Use Your Information
- Operating and maintaining your account and the buildings you manage
- Storing and serving the files, photos, drawings, and records you upload
- Powering the AI Assistant so it can search, organise, and answer questions about your own data
- Processing subscription payments through Lemon Squeezy
- Sending essential service communications (e.g. security notices, billing receipts)
- Improving the platform through aggregated, non-identifying usage analytics
- Detecting and preventing fraud, abuse, or unauthorised access
- Meeting our legal and regulatory obligations
We do not sell your personal information or your building data to anyone, for any reason.
4. Legal Basis for Processing (GDPR & UK GDPR)
We're a UK company, so we comply with both the UK GDPR and, for any EU/EEA users, the EU GDPR. We process personal data under these legal bases:
- Contract: to provide the service you've signed up for
- Legitimate interests: to keep the platform secure, reliable, and improving
- Consent: for optional analytics and any marketing communication
- Legal obligation: where we're required to retain or disclose information by law
5. Who We Share Data With
We use a small number of trusted infrastructure providers to run WhatOnSite. None of them are permitted to use your building data for their own purposes:
- Supabase — database, file storage, and authentication
- Vercel — application hosting
- Lemon Squeezy — subscription billing and payment processing
- Our AI provider — generates responses for the AI Assistant, only from data you already have access to
- Analytics providers (e.g. Google Analytics / Firebase Analytics) — aggregated, anonymised usage patterns
Within your own organisation, building data is visible according to the roles and permissions you set — see our Security page for how access control works.
6. Data Retention
- Your building data is retained for as long as your account is active
- If you delete a file, room, or record, it's removed from active storage — deletions are never silently reversed
- If you close your account, your personal account data is deleted within 30 days, other than what we're legally required to retain (e.g. billing records, kept for 7 years for tax purposes)
- You can request full export or deletion of your building data at any time — see Section 8
7. Data Ownership
To be completely clear: you own every file, photo, drawing, and record you upload to WhatOnSite. We store and process it on your behalf so the platform can work — we never claim ownership of it, and we never use it to train public AI models. Read the full detail on our dedicated Data Ownership page.
8. Your Rights
Under UK GDPR and EU GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure ("right to be forgotten") — request deletion of your data
- Restrict processing — limit how we use your data
- Data portability — receive your data in a portable, machine-readable format, or export it directly from the platform yourself
- Object — object to processing based on legitimate interests
- Withdraw consent — at any time, where processing is based on consent
To exercise any of these rights, email whatonsite@gmail.com or use our contact page. We'll respond within one month, as required by law.
9. International Users
WhatOnSite is built for organisations anywhere in the world. If your data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses and working only with infrastructure providers who maintain equivalent data protection standards.
10. Data Security
All connections to WhatOnSite are encrypted (HTTPS/TLS), authentication is handled by Supabase Auth, and access to your buildings is controlled by the roles and permissions you assign. Full detail is on our Security page. No method of transmission over the internet is 100% secure, but we take reasonable, industry-standard steps to protect your information.
11. Children's Privacy
WhatOnSite is a business tool and is not directed at, or intended for use by, anyone under 16.
12. Changes to This Policy
We'll update the "Last updated" date above whenever this policy changes, and notify you directly for any significant change.
In short: your building data is yours. We store it securely, we never sell it, we never train public AI on it, and you can export or delete it whenever you choose.
