SiteWrite · Privacy Policy · v1.1
Privacy Policy
Version 1.1 · Last updated 15 June 2026
1. Who we are
1.1
This Privacy Policy is issued by SiteWrite Ltd, a company incorporated in England and Wales with company number 17177709 whose registered office is at 91 Princess Street, Manchester, M1 4HT (“SiteWrite”, “we”, “us” or “our”).
1.2
We are registered with the Information Commissioner’s Office under registration number ZC143074.
1.3
For any data protection enquiries, please contact hello@sitewrite.ai or write to SiteWrite Ltd, 91 Princess Street, Manchester, M1 4HT, marked “FAO Data Protection”.
2. Scope of this policy
2.1
This Privacy Policy applies when we act as a controller of your personal data. This includes:
- visitors to our marketing website at sitewrite.ai;
- prospective customers who request a demo, trial, or quotation;
- administrators and authorised users of customer firms, in respect of the account credentials, contact details and audit information we process to operate the service;
- individuals who correspond with us by email, telephone, contact form, or social media;
- recipients of our marketing communications, where they have opted in or where we have a legitimate basis to send them.
2.2
This Privacy Policy does not apply to personal data that customer firms upload, generate or process within the SiteWrite application about their own end-clients, properties, or third parties. In respect of that data we act as a processor on behalf of the customer firm; the firm’s own privacy notice applies, and the contractual terms governing our processing are set out in our Data Processing Addendum.
3. Personal data we collect
3.1
From visitors to our website. When you visit sitewrite.ai we collect limited technical information through our analytics provider (Plausible) and our hosting and CDN providers, including approximate geographic region, device type, browser type, referring page, and pages viewed. This information is not linked to a named individual and is not retained in identifiable form.
3.2
From prospective customers and demo requests. When you request a demo, trial or further information, we collect your name, business email address, telephone number (if you provide it), the name of the firm you represent, your role, and any information you choose to share about your inspection or reporting workflow.
3.3
From customer administrators and authorised users. When you are issued with a SiteWrite login by your firm or sign up directly, we process:
- your name, business email address, professional role and seat tier;
- authentication and security data (hashed password, multi-factor authentication tokens, session and refresh tokens, IP addresses, device fingerprints used for fraud and bot prevention);
- a record of your acceptance of our legal terms, including the date, the version accepted, and the IP address from which you accepted; that IP address is obtained at the time of acceptance via a third-party IP-lookup service and is visible to your firm’s administrators as part of the consent record;
- audit and operational logs that record when you signed in, which features you used, which records you accessed or modified, and the source of any AI-generated content you produced; and
- any preferences, profile details, or saved configurations you set up for your own use of the service.
3.4
From correspondence and support. When you contact us by email, telephone, contact form, or live chat, we collect your name, business contact details, the contents of the correspondence, and any further information you supply in connection with your enquiry or support request.
3.5
From recipients of marketing communications. Where you sign up to receive our newsletter or product updates, or where we send marketing communications to you in a B2B context on the basis of legitimate interest, we process your business name, email address, role, and engagement metrics (whether you opened or clicked an email).
3.6
Special category data. We do not knowingly collect or process special category personal data (such as data revealing health, racial or ethnic origin, political opinions, religious beliefs, or biometric data) about visitors, prospects, customer administrators or authorised users in connection with our marketing or account operations. You should not submit special category data to us through our contact channels.
4. How we use your personal data and our lawful bases
4.1
We process personal data for the purposes set out below, on the lawful bases shown.
| Purpose | What this involves | Lawful basis |
|---|---|---|
| Operating the website and applications | Hosting, security, performance monitoring, fraud and bot prevention. | Legitimate interests (running and protecting our business). |
| Responding to demo and sales enquiries | Replying to your enquiry, scheduling and conducting demos, providing pricing and proposals. | Steps taken at your request prior to entering into a contract; legitimate interests in our B2B sales activity. |
| Account creation and administration | Creating and maintaining your user account, authenticating you, applying access controls, allowing you to use the features of your firm’s subscription. | Performance of a contract with the customer firm; legitimate interests in operating a secure multi-tenant service. |
| Recording acceptance of our terms | Keeping a record of when, and from which IP address, an authorised user accepted our legal terms, so that the customer firm and we can evidence acceptance. | Legitimate interests in maintaining reliable consent and acceptance records; compliance with legal obligations. |
| Audit logging and security | Recording sign-in events, feature usage, AI-generated content sources, and administrative actions, to allow your firm to audit usage and to allow us to investigate misuse, abuse, or security incidents. | Legitimate interests in operating a secure, auditable service; compliance with legal obligations. |
| Customer support | Responding to your enquiries, troubleshooting issues, and improving our help materials. | Performance of a contract; legitimate interests in providing competent support. |
| Service improvement and analytics | Aggregated usage analytics, feature usage metrics, performance benchmarking, and product research. We do not use customer-uploaded report content for product analytics; aggregated analytics relate to feature use, not report content. | Legitimate interests in improving the service. |
| Direct marketing | Sending you product updates, release notes, and information about features that may interest you in your professional capacity. You can opt out at any time. | Consent (where required); legitimate interests in B2B marketing to existing or relevant prospective business contacts. |
| Compliance and protection of legal rights | Meeting legal obligations (including tax, accounting, and data protection records); responding to lawful requests; establishing, exercising and defending legal claims. | Compliance with legal obligations; legitimate interests in protecting our legal position. |
4.2
Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests, rights and freedoms, and we have concluded that they are not. You can ask us for further information about that assessment at any time.
4.3
We do not use your personal data to make solely automated decisions that produce legal or similarly significant effects on you.
5. AI features and your data
5.1
The SiteWrite application includes AI Write functionality powered by third-party large language models, including those provided by Anthropic PBC. When an authorised user invokes AI Write, structured inputs from that user (such as defect selections, condition ratings and descriptive phrases) are sent to the model provider, which returns generated text.
5.2
Under our model providers’ applicable commercial terms, the inputs submitted to their interfaces are not used to train their general models. Inputs and outputs are processed for the purpose of returning a response to the request and for short-term operational purposes (such as abuse monitoring) in accordance with the model provider’s applicable terms. This position is secured contractually; it does not rely on a technical zero-retention setting within the Service.
5.3
As described in our Terms of Service, AI-generated content is a drafting aid only and must be reviewed by an appropriately qualified professional before being relied on or delivered to an end-client.
5.4
Where AI Write is invoked in the course of a customer firm’s use of the application in respect of report content (which may incidentally include personal data of an end-client or third party), we act as a processor on behalf of the firm. The firm is responsible for the lawful basis of that processing and for any disclosure of AI use to its end-clients required by professional or regulatory frameworks.
5.5
For each AI Write request, we keep an operational log that records the source of the prompt used, a truncated snapshot of the input submitted, and token-usage counts. This log does not retain the generated text. The truncated input snapshot may contain free text entered by the authorised user. These logs are used for audit, troubleshooting and improvement of the Service.
5.6
Some features rely on your browser or on third-party services. If you use voice dictation in a supported browser, your browser captures your audio and sends it to its own speech-recognition provider (for example, Google) to convert it to text; this is a feature of your browser rather than a service we engage. In-app help videos are served by Loom, which receives your IP address and browser information when you play a video. These flows are described further at sitewrite.ai/subprocessors.
6. Sharing personal data
6.1
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.
6.2
We share personal data with the following categories of recipient, in each case under appropriate contractual safeguards:
- Sub-processors and infrastructure providers — our hosting, database, file storage, email, AI model, payment, analytics, and customer support providers. A current list of sub-processors is published at sitewrite.ai/subprocessors.
- Professional advisers — our accountants, auditors, lawyers, and insurers, where reasonably necessary.
- Authorities and law enforcement — where required by law, regulation, or court order, or where necessary to protect our rights, property, or safety, or those of others.
- Successors in business — in connection with a merger, acquisition, financing, or sale of all or substantially all of our business, in which case continuing protection of personal data will be a condition of the transaction.
6.3
Where we share personal data with a sub-processor or other recipient under our control, we put in place written terms that require the recipient to process personal data only on our instructions and to apply appropriate technical and organisational security measures.
7. International transfers
7.1
Some of our sub-processors are based outside the United Kingdom or the European Economic Area. Where personal data is transferred to such a sub-processor, we rely on a transfer mechanism recognised under UK GDPR, including:
- the UK’s adequacy regulations for transfers to countries the UK Government has determined provide an adequate level of protection;
- the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supplemented where appropriate by additional safeguards; or
- any other lawful transfer mechanism in force from time to time.
7.2
Details of the transfer mechanism applicable to each sub-processor are available on request to hello@sitewrite.ai.
7.3
The primary database in which account and service data is stored is located within the European Economic Area (Ireland), which benefits from UK adequacy. Some processing — including certain application functions — and some sub-processors operate elsewhere, including in the United States, under the mechanisms described above.
8. Retention
8.1
We retain personal data only for as long as necessary for the purposes for which it was collected, and in accordance with the following retention principles:
- Website analytics — retained in aggregated, non-identifying form by our analytics provider; no personal data is retained by us.
- Demo and sales enquiries — retained for as long as the enquiry is active and for up to 24 months thereafter to evaluate the prospect, unless you ask us to delete the record sooner.
- Account data — retained for the duration of the customer firm’s subscription. On termination of the subscription, account data is handled in accordance with clause 6.5 of the Terms of Service and the Data Processing Addendum.
- Acceptance and consent records — retained for the duration of the account and for a reasonable period afterwards to evidence acceptance of our terms, in line with our audit-log retention.
- Audit logs — retained for up to 24 months for security and audit purposes, after which they are deleted or anonymised.
- Correspondence and support tickets — retained for up to 36 months from the last interaction, after which they are deleted or anonymised.
- Marketing lists — retained until you unsubscribe or withdraw consent. Records of opt-in and opt-out are kept for compliance purposes.
- Records required by law — retained for the period required by applicable law (for example, six years for accounting records).
9. Security
9.1
We maintain administrative, technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. These include encryption of data in transit, encryption of data at rest in our database and file storage, row-level security at the database layer to enforce tenant isolation, multi-factor authentication for administrative accounts, audit logging, restricted access on a need-to-know basis, and regular review of our suppliers’ security practices.
9.2
No security measure is perfect. You are responsible for keeping your account credentials confidential and for notifying us promptly if you suspect any unauthorised use of your account.
10. Your rights
10.1
Subject to the conditions and limitations set out in UK data protection law, you have the following rights in relation to personal data we hold about you:
- Access — to be told whether we hold personal data about you, and to receive a copy of it.
- Rectification — to ask us to correct inaccurate or incomplete data.
- Erasure — to ask us to delete personal data, in the circumstances where the right applies.
- Restriction — to ask us to limit our processing of your data while a query is being resolved.
- Portability — to receive certain personal data in a structured, commonly used and machine-readable format, or to ask us to transmit it to another controller.
- Objection — to object to processing carried out on the basis of legitimate interests, including direct marketing, in which case we will stop processing your data for that purpose unless we have a compelling legitimate ground that overrides your interests.
- Withdrawal of consent — to withdraw any consent you have given for us to process your data, at any time.
10.2
To exercise any of these rights, please contact hello@sitewrite.ai. We may need to verify your identity before responding. We will respond within one calendar month, unless your request is complex or you have made a number of requests, in which case we may extend that period by up to a further two months and will tell you why.
10.3
Where we hold personal data on behalf of a customer firm (rather than as controller), please contact the firm directly. We will support the firm in responding to your request as required under our Data Processing Addendum.
10.4
If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ico.org.uk). We would appreciate the opportunity to address your concern first.
11. Cookies
11.1
Our use of cookies and similar technologies is described in our Cookie Policy.
12. Children
12.1
The SiteWrite service is intended for use by professional firms and authorised business users only. We do not knowingly collect personal data from children under 18. If you believe we have inadvertently collected such data, please contact hello@sitewrite.ai and we will take appropriate steps to delete it.
13. Changes to this policy
13.1
We may update this Privacy Policy from time to time. The version number and “Last updated” date at the top show the most recent revision. Where changes are material, we will give reasonable notice through the service or by email to account administrators before the changes take effect.
14. Contact
14.1
Questions, concerns or requests in relation to this Privacy Policy or your personal data should be sent to:
Email: hello@sitewrite.ai
Post: SiteWrite Ltd, 91 Princess Street, Manchester, M1 4HT, marked “FAO Data Protection”.