Effective 2026-10-28

Privacy notice

This notice explains how Sitation Ltd, trading as Sitation Apps handles personal information when providing its apps, websites, account services, portals and related reporting services. It covers Sitation: Construction Diary and customer-branded editions that identify Sitation Ltd as their provider and link to this notice. A different app name, logo or colour scheme does not by itself change the provider.

Features vary between apps, organisations and plans. The information in your app and at the point of use explains which features apply. References below to advertising, cloud sync, purchases, AI, report delivery or external connections apply only where that feature is available and used.

1. Who is responsible for your information

Sitation Ltd is responsible for the personal information it uses for its own account administration, customer relationships, billing records, support, security, marketing preferences and legal obligations.

Where an employer or another organisation determines why and how personal information in its project records is used, it is the controller of that information. Sitation processes those records on its behalf under the applicable service and data-processing arrangements. The organisation's privacy information explains its purposes, lawful bases and retention decisions. The same distinction can apply to a business using an individually purchased account.

Organisation and project administrators can manage access and records within their assigned permissions. Sharing common policies does not give one customer access to another customer's data. Contact us if you are unsure which organisation is responsible; we will help route your request.

2. Information we handle

• Accounts: email address, account ID, verification status, optional display name, account creation and sign-in timestamps, organisation membership, invitations, roles and access entitlements. Passwords and authentication credentials are handled through Firebase Authentication; our staff do not have access to your readable password.
• Project records: project names and locations, diaries, activities, notes, workers and staff, employers, labour and plant allocations, materials, deliveries, quantities, hours, weather, photographs, captions and record metadata. What is included depends on the information users enter and the features they use.
• Media and location: selected or captured media, timestamps, project coordinates and, where available, location metadata captured with permission or contained in an imported photograph. Importing an image can supply existing location metadata even if current location capture is disabled.
• Devices and service operation: device identifiers and labels, platform information, session activity, security and integrity checks, network information such as IP addresses, technical errors, sync activity, usage limits and diagnostic records. Some diagnostic records stay on the device unless shared for support; hosting and service providers also maintain operational logs.
• Purchases: product and transaction references, purchase-verification data, subscription status and entitlement history. The relevant app store or payment provider handles payment details. The app's store-purchase flow does not send us your full payment-card number or card security code.
• Communications: support correspondence, rights requests, complaints, contact details, marketing choices and records of the relevant permissions or legal-document acceptance.
• Optional services: selected AI inputs and outputs, report recipients and delivery records, and authorisation and usage records for external connections. Advertising is described separately in our Advertising Notice.

Information can come from you, your device, your employer, project administrators, other contributors, invited contacts, app stores and the service providers described below. A person named or photographed in a project record may not have a Sitation account.

3. Sensitive information and other people

Project notes and media can contain health, accident, injury or other sensitive information. We do not ask for it merely to create an account. Include it in project records only where necessary and where the responsible organisation has established the required legal basis, any additional condition for special-category or criminal-offence data, and appropriate access controls. Avoid unnecessary medical detail, identification documents and unrelated private information.

Users and organisations must have lawful authority to record and share information about others and provide appropriate privacy information. This does not mean consent is the correct basis for every workplace record. If unnecessary sensitive information has been uploaded, contact the responsible organisation or us so it can be assessed.

4. Why information is used

For processing where Sitation is the controller, the purposes and applicable bases are set out below. Where we process project information on an organisation's behalf, its documented instructions and own lawful basis govern that processing.

Necessary verification, password-reset, security and service messages are separate from marketing. An operating-system permission, acceptance of the Terms or a connection authorisation is not blanket consent to unrelated processing.

5. Local use, cloud sync and sharing

Records can be held in a local device database and media folders. When cloud access is enabled and you have the necessary entitlement and permissions, supported records are synchronised with Cloud Firestore and uploaded media is stored in Google Cloud Storage for Firebase. Offline changes may wait for connectivity. Not every local setting, file or record is necessarily synchronised.

Authorised members can access shared project information according to their roles. Administrators may manage invitations, access, reports and project records. Information already contributed to a shared project can remain after a contributor leaves or closes their account, subject to lawful retention and individual rights.

Media saved to the device gallery, downloaded reports, exported files and copies shared with other people may exist independently of the service. Removing cloud access cannot recall those copies or instantly erase data on an offline device. Sync is not a guarantee that every record has been backed up.

6. Service providers and optional features

• Google Firebase and Google Cloud: authentication, databases, file storage, server processing, security checks, logs and recovery services. See Firebase privacy information.
• App stores: purchases, subscription administration and purchase verification for apps that offer store billing.
• Netlify: website delivery, routing requests for supported authentication connections, and processing of website forms. A form submission can include your contact details and the request you enter. Authentication connection requests can include the technical information needed to route and secure the requested connection.
• Open-Meteo: weather requests send the relevant project coordinates and date. The provider also receives the network information needed to answer the request. See Open-Meteo's terms and privacy information.
• Google AI services: where AI reporting is enabled, selected report information is sent to the configured Google Gemini service, which may be provided through Vertex AI. Mobile summary features can include selected photographs; server report-summary features may use a limited text extract instead. The feature explanation identifies the material being submitted. Free-text records can contain personal information. AI output is returned for review and may form part of a saved or exported report.
• Report delivery: where an authorised user enables or requests email reporting, recipient addresses, report attachments and delivery information are processed through the configured email service, including Resend, and recipients' email providers. Recipients may be outside the project membership where an authorised administrator selects them. A sent report cannot be recalled by deleting it in the app.
• External connections: where you authorise a supported connection, such as ChatGPT, the selected service can receive the records described on the authorisation screen within the permitted scope. Access is subject to account and project permissions. Disconnecting or expiry prevents future authorised retrieval but does not delete information already returned to that service; its own terms and privacy controls govern that copy.
• Advertising: Google AdMob and any providers shown in the relevant consent message, only in editions that enable advertising. See the separate Advertising Notice.

We may also disclose information where required by law, necessary to protect rights or investigate misuse, to professional advisers subject to appropriate duties, or in connection with a business restructuring or transfer with applicable protections. We do not make private project records publicly available merely because they are uploaded.

7. Processing locations and safeguards

Services use Google Cloud/Firebase infrastructure and other providers. Some project infrastructure is configured in London, but this is not a promise that all information stays in the UK. Authentication, global website delivery, support, logs, AI and email services can involve other countries. For example, some server AI summaries use an EU endpoint, and report-email processing can involve the United States.

Where a restricted international transfer is made, the applicable safeguards must be used, such as an adequacy arrangement or approved contractual safeguards with any required additional protections. Contact us for information about the arrangements relevant to your service and how to obtain a copy of applicable safeguards.

Safeguards include authenticated access, project permissions, encrypted network connections and provider security controls. Authorised support or administrative access is limited to legitimate service purposes. No service or device can be guaranteed secure. Secure your device and exported records, keep software updated and protect your credentials.

8. Retention and account deletion

We retain personal information only for a continuing service purpose, a lawful organisational instruction or a justified legal, security or dispute requirement. The relevant criteria are:

You can start account deletion in the app's account settings or through our data request page. We may verify your identity and clarify whether the request concerns your account, your personal information in a shared project, or an organisational workspace. Shared-record retention is not a blanket exemption from erasure rights. We assess the request and explain any justified limits. Uninstalling the app does not close a cloud account, and closing an account does not by itself cancel a subscription with an app store.

9. Your rights and choices

Depending on the law and the processing concerned, you may request access, correction, erasure, restriction or portability of your personal information. You can object to processing based on legitimate interests, and you can object to direct marketing at any time. Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing.

Use Data requests and complaints or email support@sitation.app. You do not need to use a particular form or have an active account. We normally respond to UK data-rights requests without undue delay and within one calendar month, subject to the lawful rules on identity checks, clarification and extensions; we will explain any extension. Where an organisation controls the records, we assist it and help route the request appropriately.

For a data protection complaint, contact us using the same routes. We acknowledge complaints within 30 days, investigate appropriately, keep you informed and provide an outcome without undue delay. You can also complain to the Information Commissioner's Office or the relevant authority where you live.

You can change device permissions in your device settings, marketing choices in the app where offered, and advertising choices through the applicable privacy controls. Missing necessary account information can prevent account access; refusing an optional permission can affect that feature. AI summaries support human review and are not intended to make employment, safety or other significant decisions about people automatically.

10. Age and changes

The service is intended for professional use by adults aged 18 or over. Project records may nevertheless refer to younger people, for example where an organisation lawfully records site personnel; that organisation remains responsible for the need and safeguards. Contact us if an underage person has created an account.

We update this notice as services and requirements change, show the effective date, and bring material changes to your attention as appropriate. We obtain a new choice where the law requires it; a revised notice does not itself supply consent.

11. Contact

Sitation Ltd trading as Sitation Apps
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
support@sitation.app