Privacy Policy

VCG Site Records ("the Service") is provided by Valkyrie Consultants Group Ltd ("we", "us"). We are the data controller for account and billing data. Where a company uses the Service to record its own site information, that company is the controller of the diary content and we act as its processor.

Contact: tomwilkin@valkyrieconsultantsgroup.com

• Account and staff data: name, email address, sign-in details, the projects and company you belong to, and your role (admin, editor or viewer).
• Diary entries: dates, weather, shift times, works carried out, delays, notes, operatives (trade, head count, hours, employer), plant, equipment and materials deliveries. Diaries may name individual operatives or subcontractors.
• Photos: images you take or upload, with captions and the time they were added. Photos may show people, vehicles or registration plates.
• Location: map pins you place on a diary. We only use your device location when you choose to add a pin.
• Voice notes: audio you record for the AI assistant (see section 5).
• Billing data: subscription plan, seats, status and renewal dates. Card details are handled by Stripe; we never see or store full card numbers.
• Technical data: device and browser information, error logs, and drafts stored on your device while offline.

• To provide the Service, keep site records and share them with your project team — performance of a contract.
• To take payments and keep financial records — contract and legal obligation.
• To send project invitation and service emails — legitimate interests.
• To keep the Service secure, fix faults and prevent misuse — legitimate interests.

We do not sell personal data or use it for advertising.

Diaries, photos and pins are visible only to members of that project. Project admins control who is invited and what role they hold. Company owners can see which staff use their company code. Names are only shown to people who share a project or company with you.

Optional AI features can tidy written notes, turn voice notes into diary entries, caption photos and answer questions about past diaries. When you use them, the relevant text, audio, photo or diary content is sent securely to our AI provider (via the Lovable AI Gateway, using models from providers such as OpenAI and Google) to produce a result.

• Only content you choose to send, and diaries you already have access to, is used.
• Voice recordings are used to create a transcript and are not stored by us afterwards.
• Your data is not used by us to train AI models.
• AI output can be wrong — please check it before relying on it as a site record.

We use trusted processors under written agreements: Lovable (hosting, database, file storage, AI gateway and email sending), Stripe (payments), and Google (maps). Some providers may process data outside the UK; where they do, we rely on UK adequacy regulations or the UK International Data Transfer Addendum.

To work without signal, the app stores recent diaries and unsent drafts and photos on your device. These are removed once synced or when you clear the app's data. Anyone with access to an unlocked device may see them, so please keep devices secured.

Diary records are kept for as long as the project's company holds an account, as construction records often need to be retained for many years. Account data is deleted within 90 days of account closure on request. Billing records are kept for 6 years to meet UK tax law.

Data is encrypted in transit, photos are stored in private storage, and access is enforced on our servers by project role, not only in the app.

Under UK GDPR you can ask to access, correct, delete, restrict or move your data, and object to certain uses. For diary content owned by your employer, we may pass your request to them. Email tomwilkin@valkyrieconsultantsgroup.com. You can also complain to the Information Commissioner's Office (ico.org.uk).

We will post any changes here and update the date above. Significant changes will be notified in the app or by email.