Privacy Policy
Last reviewed: 2 August 2026
SafeSite AI Technology Ltd is committed to protecting personal data and handling it responsibly. This Privacy Policy explains what information we collect, how we use it, the legal basis for processing it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
SafeSite AI Technology Ltd · Company No. 17111651 · ICO Registration No. ZC160399 · Registered in England and Wales.
2. Our role
Depending on how the platform is used, SafeSite AI Technology may act as either a data controller or a data processor.
We act as a controller when processing information relating to your account, billing, support requests, website usage and platform administration.
We act as a processor when processing documents, incident records, audits, permits, RAMS, COSHH assessments and other operational records uploaded by our business customers. Where we act as a processor, the customer organisation remains responsible for determining why and how that information is processed.
3. Information we collect
Account information: name, email address, organisation, login details.
Compliance information: RAMS, risk assessments, method statements, COSHH assessments, permits, audit records, incident records, corrective actions, uploaded files, and AI prompts and generated outputs.
Some compliance records, including incident reports and COSHH assessments, may contain health-related information. Where SafeSite AI Technology processes this information on behalf of a customer organisation, the customer is responsible for identifying and documenting the applicable lawful basis and special-category condition. SafeSite AI Technology processes the information only in accordance with the customer's documented instructions and the applicable Data Processing Agreement.
Technical information: browser, device type, IP address, usage logs, authentication information, and security events.
Billing information: payments are processed securely by Stripe. SafeSite AI Technology does not store full payment card details.
4. How we use your information
- To provide access to the platform.
- To generate and review compliance documentation.
- To maintain audit trails and document history.
- To improve platform security and reliability.
- To provide customer support.
- To detect misuse, fraud and security incidents.
- To comply with legal obligations.
5. Our lawful basis
Depending on the circumstances, we process information because it is necessary to:
- perform a contract with you;
- comply with legal obligations;
- pursue legitimate business interests, provided these do not override your rights;
- obtain consent where required, for example for optional analytics cookies.
6. AI processing
SafeSite AI Technology uses AI to analyse, review and generate compliance documents. AI assists users by identifying potential evidence gaps, regulatory coverage and drafting suggestions. Customers remain responsible for reviewing outputs and ensuring documents are suitable for their specific work activities and legal obligations.
7. Third-party service providers
We use the following categories of service provider to operate the platform:
- Supabase - database and authentication.
- Upstash - caching and rate limiting.
- Anthropic - AI document generation and review.
- Stripe - payment processing.
- Vercel - hosting, and optional analytics/performance monitoring where you have consented.
Some service providers may process personal data outside the United Kingdom. Where this constitutes a restricted transfer, we use an appropriate transfer mechanism, which may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission Standard Contractual Clauses, or another lawful safeguard.
8. Data retention
We retain information only for as long as necessary to provide the service, comply with legal obligations, resolve disputes, maintain security, and protect legitimate business interests. As a general guide:
- Account data is deleted or anonymised within 30 days of a verified account deletion request.
- Billing records are retained for 6 years in line with UK tax record-keeping requirements.
- Customer compliance records are retained for the duration of the subscription and in accordance with the customer organisation's documented retention settings or instructions. Following termination, records are returned, exported, deleted or anonymised in accordance with the applicable Data Processing Agreement, subject to limited legal or backup-retention requirements.
9. Your rights
You may request:
- access to your personal data;
- correction of inaccurate information;
- deletion where legally appropriate;
- restriction of processing;
- objection to certain processing;
- data portability where applicable.
Where we rely on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
If you are dissatisfied with how we handle your personal data, please contact us first at privacy@safesiteaitechnology.com. You also have the right to complain to the Information Commissioner's Office.