Privacy policy
PinMap is operated by AH AI Automation ("we", "us"). Contact: alex@ahaiautomation.com. Postal address: [registered or trading address]. [If a limited company: "AH AI Automation Ltd, registered in England and Wales, company number 00000000, registered office …". If a sole trader: "Alex Hewitt trading as AH AI Automation".]
1. Who this covers
PinMap is a business tool. Two groups of people are covered:
- Account holders and crews: people whose employer or contractor (the "Customer company") has set them up in PinMap. For your day-to-day work data, the Customer company decides why and how it is used. It is the controller and we process that data on its instructions (see section 7). Ask your office first about anything on your own record.
- Prospective and paying customers: the people who email us, create a company, and pay. For that data we are the controller.
2. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Name, work email, role, company | Typed in at sign-up or added by your office | To run your account and control who sees which job (contract; legitimate interests) |
| Password | Chosen by you | Stored only as a salted hash by our authentication provider. We never see it. |
| Job records: pins, photos, notes, mark-ups, QA checks, RFIs, variations, orders, drawings | Created by the crew on site | The work itself. Photos may show people; please avoid photographing people where you can. |
| Clock-in and clock-out time, a photo, and GPS location (PinClock only) | Your phone, when you tap Clock in or Clock out, and only if your company has PinClock switched on | Time sheets and confirming the job site. Location is taken at the moment you tap, not tracked continuously. |
| Email sign-off text, order text you type | Typed by you | Sent to your wholesaler in quote emails (Orders module only) |
| Technical logs: IP address, browser type, timestamps, errors | Automatic | Security and keeping the service running (legitimate interests). Kept short-term by our hosting and database providers. |
| Billing contact and invoices | From the person who pays | Getting paid and tax records (contract; legal obligation) |
We do not collect anything for advertising. There is no ad tracking, no analytics tags and no profiling on this website or in the app.
3. How we use it
- To provide PinMap to your company and keep it secure.
- To send emails you or your office ask us to send: quote requests to your wholesaler, SI notices to your office, RFI drafts. Wholesaler quote emails carry the name and email address of the person who raised the order so replies reach them.
- To read wholesaler quote emails and order text with an AI model so lines and prices can be matched automatically (Orders module). Only the order text and the quote are sent; not your login details.
- To answer support requests and tell you about changes to the service. We do not send marketing email unless you have asked for it, and you can stop it at any time.
4. Who we share it with (our processors)
| Provider | What they do | Where |
|---|---|---|
| Supabase, Inc. | Database, file storage, login. All customer data is stored in the London (eu-west-2) region. | UK data centre; US company |
| Higgsfield | Hosts the app's web files | [Alex to confirm Higgsfield's hosting region and data processing terms] |
| Anthropic, PBC | AI reading of order lists and wholesaler quotes (Orders module only) | USA. Data submitted through the API is not used to train their models. |
| Zapier, Inc. | Sends and receives the Orders module's emails through the Customer company's own Gmail account | USA |
| Google (Gmail) | The mailbox the Customer company uses for orders | Customer's own account |
| Cloudflare (cdnjs), jsDelivr, unpkg | Serve the app's script libraries. They see your IP address when the app loads. | Global CDNs |
| OpenStreetMap, Esri | Map tiles for PinClock job sites. They see your IP address and the map area viewed. | Global |
Transfers outside the UK rely on the UK International Data Transfer Addendum or the provider's UK-approved terms. We do not sell personal data.
5. How long we keep it
- Job records: for as long as your company's account is open. Construction records are often needed for years afterwards, so deletion is your office's decision, not automatic.
- When a company account closes: the office can export its data first. We delete the company's data 30 days after closure unless the law requires us to keep it longer.
- A self-serve company that is never activated is deleted automatically 48 hours after sign-up.
- Logs: up to 90 days.
- Invoices and tax records: 6 years.
6. Your rights
Under UK GDPR you can ask for a copy of your data, ask for it to be corrected or deleted, object to or restrict processing, and ask for it in a portable format. If your data is held for a Customer company, contact your office first, since they control it; we will help them respond. Otherwise email alex@ahaiautomation.com. We respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
7. For Customer companies: your responsibilities
Your company is the controller of your crew's data. That means you must tell your staff what PinMap records about them, especially the PinClock location and photo clock-in, and have a lawful basis for it (usually your legitimate interests as their employer, or the employment contract). The ICO's guidance on monitoring workers applies. Our data processing terms set out what we do on your behalf.
8. Security
Data is encrypted in transit (HTTPS) and at rest. Each company's data is separated by database-level access rules, so a member of one company cannot read another's. Photos and drawings are only reachable through short-lived signed links. Only approved email addresses can sign in.
9. Children
PinMap is for people at work. You must be 16 or over to have an account.
10. Changes
We will post changes here and, if they matter, email the office admin of each company.