ShareDraw (sharedraw.co.uk) takes privacy seriously. This policy explains what personal data we hold, why, and your rights under UK GDPR. The data controller is Share Draw Limited (trading as ShareDraw), registered in England and Wales, company no. 17367750, registered office 152 Whitworth Road, Swindon, SN25 3BJ, contactable at info@sharedraw.co.uk.
The short version
1. What we collect and why
Account holders (contractors and sole-trade firms): name, work email and company name — to run your login and your account. Billing status and subscription details are held so the service knows what you've paid for.
Enquiries: if you use the contact form we keep the name, company, email, phone number and message you send us, so we can respond.
Trades on site: subbies do not create accounts. Site access uses a site code and a trade access code only, and drawing activity is logged by trade package (e.g. "Groundworks viewed drawing A-100"), not by individual. However, some optional site features do involve limited personal data about people on site, entered at the time of use:
Names: when someone claims a plot, records day-work, or raises items such as snags or QA records, they may enter their name so the office knows who did it. A name entered on the site drawings page is also remembered in that device's own browser storage for convenience.
Sign-in and sign-out: where a contractor uses site sign-in, we record who signed in and out and when (with an automatic sign-out at end of day). This exists so the contractor knows who is on site, including for fire and safety purposes. If the contractor asks for a sign-in photo, the photo is deleted as soon as the office has checked it, and in any case no later than 14 days after it was taken; only the line saying who signed in and when is kept.
Signatures: day-work sheets are signed on screen by a named member of the contractor's site team. We store the signature image, the signer's name and the time of signing as part of that day-work record, as evidence the work was verified.
Location: if — and only if — the contractor has turned on location checking for a site, the device's approximate GPS position is captured at the moment of scanning, to confirm the scan happened at the site. If the device declines or can't provide a location, the feature simply proceeds without one. We do not track location at any other time.
For this on-site data, the subscribing contractor decides which features are enabled and why the data is collected; we store and process it on the contractor's behalf to run those features. Requests about this data can come to us or to the contractor running the site.
Drawings: drawings and related project information are uploaded at the discretion and under the control of the subscribing contractor's technical department. The contractor is responsible for ensuring they have the right to upload them; we store and distribute them on the contractor's instructions.
Payments: handled entirely by Stripe. We never see or store card numbers; we hold only your subscription status and Stripe's reference IDs.
2. What we don't do
We do not sell personal data, share it with advertisers, or use it for anything beyond running ShareDraw. No marketing lists, no third-party tracking, no advertising cookies.
3. Where your data lives
Data is processed by a small number of service providers acting under our instructions: Supabase (database, file storage and authentication), Netlify (website hosting), Stripe (payments), Proton (email), Resend (sending service emails such as the weekly account summary) and Anthropic (the AI reader, which reads fire door labels, programmes and snag lists only when you choose to use it; Anthropic does not train its models on this data). All connections are encrypted with TLS and stored data is encrypted at rest. Some providers may process data outside the UK/EEA under recognised safeguards (such as standard contractual clauses).
4. Cookies and device storage
We use only essential browser storage: keeping you signed in, remembering your preferences, and — on the site drawings page — storing drawings you've chosen to save for offline use and, if you've entered one, your name, on your own device. No analytics or advertising cookies.
We keep a simple count of visits to our public pages (the home page, the demo and the CIS calculator): which page, when, the website the visitor came from, whether it was a phone, tablet or computer, and whether they stayed longer than half a minute. It uses no cookies and no device storage, and it does not record an IP address or anything else that identifies you. The count is kept for 90 days.
5. How long we keep things
Account data is kept while your account is active and deleted within a reasonable period after closure, except where the law requires longer (e.g. invoicing records). Enquiries are kept only as long as needed to deal with them. Drawings are removed when the contractor deletes them or their account closes. Site records such as day-work sheets, signatures, sign-in logs, QA records and claims form part of the contractor's project records and are kept for the life of the account (contractors can export them), then deleted on closure on the same basis as above. Sign-in photos are deleted within 14 days. When a contractor deletes a site, its photos and files are deleted from storage along with it.
Fire door photos. Where a contractor uses the fire door audit, the app stores a photograph of each door's certification label (and, for an inspection, the door assembly), the plot and location, the numbers read from the label, the inspection answers and the name of the person who took or inspected it. These are kept as fire safety records for the responsible person under the Regulatory Reform (Fire Safety) Order 2005, the Fire Safety (England) Regulations 2022 and, for higher-risk buildings, the Building Safety Act 2022. The camera guide asks for the label only — never people, post or the inside of a home. Photos are kept while the site is live and for a period the contractor sets (72 months by default) after it closes, then deleted; the written record and a fingerprint (hash) of each photo remain. The contractor holds a data protection impact assessment for these photos in the app; a resident can ask them to delete early a photo that has caught personal data.
6. Your rights
Under UK GDPR you can ask us for a copy of your personal data, ask us to correct or delete it, restrict or object to processing, and request portability. Email info@sharedraw.co.uk and we'll respond within one month. If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk).
7. Security
Access to client data is restricted by per-company security rules enforced at the database level — one client can never see another's sites or drawings. Trade access requires the correct site and access codes, and codes can be rotated at any time. If we ever became aware of a breach involving your personal data we would notify you and the ICO as required by law.
8. Changes
If we make material changes to this policy we'll flag them to account holders by email or in the app.