Privacy & GDPR Policy
ShareDraw (sharedraw.co.uk) takes privacy seriously. This policy explains what personal data we hold, why, and your rights under UK GDPR. The data controller is Share Draw Limited (trading as ShareDraw), registered in England and Wales, company no. 17367750, registered office 152 Whitworth Road, Swindon, SN25 3BJ, contactable at info@sharedraw.co.uk.
The short version
We do not share or sell your details to anyone. Everything is hosted on secure, encrypted infrastructure — encrypted in transit (TLS) and at rest. We collect the minimum we need to run the service, and card details never touch our systems.
1. What we collect and why
Account holders (contractors and sole-trade firms): name, work email and company name — to run your login and your account. Billing status and subscription details are held so the service knows what you've paid for.
Enquiries: if you use the contact form we keep the name, company, email, phone number and message you send us, so we can respond.
Trades on site: subbies do not create accounts. Site access uses a site code and a trade access code only, and drawing activity is logged by trade package (e.g. "Groundworks viewed drawing A-100"), not by individual. However, some optional site features do involve limited personal data about people on site, entered at the time of use:
Names: when someone claims a plot, records day-work, or raises items such as snags or QA records, they may enter their name so the office knows who did it. A name entered on the site drawings page is also remembered in that device's own browser storage for convenience.
Sign-in and sign-out: where a contractor uses site sign-in, we record who signed in and out and when (with an automatic sign-out at end of day). This exists so the contractor knows who is on site, including for fire and safety purposes.
Signatures: day-work sheets are signed on screen by a named member of the contractor's site team. We store the signature image, the signer's name and the time of signing as part of that day-work record, as evidence the work was verified.
Location: if — and only if — the contractor has turned on location checking for a site, the device's approximate GPS position is captured at the moment of scanning, to confirm the scan happened at the site. If the device declines or can't provide a location, the feature simply proceeds without one. We do not track location at any other time.
For this on-site data, the subscribing contractor decides which features are enabled and why the data is collected; we store and process it on the contractor's behalf to run those features. Requests about this data can come to us or to the contractor running the site.
Drawings: drawings and related project information are uploaded at the discretion and under the control of the subscribing contractor's technical department. The contractor is responsible for ensuring they have the right to upload them; we store and distribute them on the contractor's instructions.
Payments: handled entirely by Stripe. We never see or store card numbers; we hold only your subscription status and Stripe's reference IDs.
2. What we don't do
We do not sell personal data, share it with advertisers, or use it for anything beyond running ShareDraw. No marketing lists, no third-party tracking, no advertising cookies.
3. Where your data lives
Data is processed by a small number of service providers acting under our instructions: Supabase (database, file storage and authentication), Netlify (website hosting), Stripe (payments), Proton (email) and Resend (sending service emails such as the weekly account summary). All connections are encrypted with TLS and stored data is encrypted at rest. Some providers may process data outside the UK/EEA under recognised safeguards (such as standard contractual clauses).
4. Cookies and device storage
We use only essential browser storage: keeping you signed in, remembering your preferences, and — on the site drawings page — storing drawings you've chosen to save for offline use and, if you've entered one, your name, on your own device. No analytics or advertising cookies.
5. How long we keep things
Account data is kept while your account is active and deleted within a reasonable period after closure, except where the law requires longer (e.g. invoicing records). Enquiries are kept only as long as needed to deal with them. Drawings are removed when the contractor deletes them or their account closes. Site records such as day-work sheets, signatures, sign-in logs, QA records and claims form part of the contractor's project records and are kept for the life of the account (contractors can export them), then deleted on closure on the same basis as above.
6. Your rights
Under UK GDPR you can ask us for a copy of your personal data, ask us to correct or delete it, restrict or object to processing, and request portability. Email info@sharedraw.co.uk and we'll respond within one month. If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk).
7. Security
Access to client data is restricted by per-company security rules enforced at the database level — one client can never see another's sites or drawings. Trade access requires the correct site and access codes, and codes can be rotated at any time. If we ever became aware of a breach involving your personal data we would notify you and the ICO as required by law.
8. Changes
If we make material changes to this policy we'll flag them to account holders by email or in the app.