Privacy Policy

Who we are

[Your company legal name] ("we", "us") operates Scaffright, a workplace kiosk service for attendance, PPE, and related records. This policy explains how we handle personal data when you use the service.

Contact: support@example.com

What we collect

• Account data — name, email, password (stored securely), company name, and address.
• Billing data — subscription status and Stripe customer references. Card details are processed by Stripe, not stored on our servers.
• Kiosk & workforce data — employee names, attendance, PPE issues, vehicle inspections, and related operational records entered by your organisation.
• Technical data — IP address, device/browser information, and logs needed to secure and operate the service.

How we use your data

• To provide, maintain, and improve Scaffright.
• To process subscriptions, trials, and billing.
• To prevent fraud and abuse (including trial eligibility checks).
• To send service-related emails (e.g. password reset, account notices).
• To comply with legal obligations.

Legal bases (UK GDPR)

We rely on one or more of the following, depending on the processing:

• Contract — to deliver the service you sign up for.
• Legitimate interests — security, fraud prevention, and service improvement.
• Legal obligation — where the law requires us to keep or disclose data.
• Consent — where required (e.g. optional marketing, if offered).

Processors & sharing

We use trusted providers to run the service, including:

• Stripe — payments and subscriptions
• Supabase — authentication and database hosting
• Email and SMS providers — transactional messages where configured

We do not sell personal data. We may disclose data if required by law.

Retention

We keep data while your account is active and for a reasonable period afterwards for backups, billing records, and legal compliance. You may request deletion of your account from the kiosk settings; some records may be retained where the law requires.

Your rights

Under UK data protection law you may have the right to:

• Access, correct, or delete your personal data
• Object to or restrict certain processing
• Data portability, where applicable
• Withdraw consent where processing is based on consent
• Lodge a complaint with the ICO (ico.org.uk)

To exercise your rights, contact support@example.com.