Privacy notice

The contractor your landlord instructed carries out work in people’s homes on behalf of the landlords who own them. To do that it holds a name, a telephone number and notes about how to get in. This says exactly what that amounts to, why, and what you can ask for.

Who holds it

The contractor your landlord instructed.

This page cannot tell which contractor you are asking about, so it does not name one. Your landlord instructed the work and can say who carried it out; ask them, and they hold the same record.

Your landlord decides that the work happens and holds the resulting safety record; the contractor your landlord instructed carries it out and holds what it needs in order to. If you want a record removed and it is part of the safety history of your home, your landlord is the one who decides.

What is held

Every category, with the actual fields named. Nothing is held for advertising, nothing is sold, and nothing is used to make an automated decision about anybody.

The occupier of a dwelling
Erased on request
To arrange access, and to tell somebody an engineer is coming. An engineer stood outside a door that has not opened has nothing else to work with.
Kept
Until the tenancy ends or the landlord sends a correction, whichever is first.
Where
sites.tenant_name, sites.tenant_phone, sites.tenant_email
A telephone entry as it was before it was split
Erased on request
Where an imported property held two numbers in one box, SAM split them into the tenant’s number and a contact number, and keeps the original so the split can be undone.
Kept
Until either number on that property is changed again, or the tenant’s details are erased, when it is deleted at once. Nobody signed in can read it.
Where
site_phone_splits.tenant_phone_before, site_phone_splits.contact_phone_before
The appointment emails sent to the occupier
Erased on request
A record of each email about a visit — the notice when it is booked, the reminder the day before, and the notice if that booking is cancelled or moved — with a copy of the address it went to, so the office can see who was told, and so the same email is never sent twice. To stop these emails, contact the firm by telephone or email and ask; the office ticks "Do not email the tenant about visits" on the property, and nothing more is sent there.
Kept
With the job the email was about, for as long as the job is kept — there is no shorter limit. Erasing the tenant replaces the address on every one of these records.
Where
tenant_messages.to_email
The occupier’s answer to an appointment email
Reviewed on request
An appointment email can carry a link where the occupier says they will be in, or that they cannot be. The office sees the answer and when it was given, and can rearrange before an engineer goes to a door nobody will open.
Kept
With the job it was about, for as long as the job is kept. The link stops working at the end of the visit day; only a scrambled form of it is held, never the link itself.
Where
booking_links.answer, booking_links.answered_at
How to get into the property
Erased on request
A note from the landlord or from a previous visit — a key safe, a side gate, a dog in the garden, the hours somebody is in.
Kept
Until it stops being true. It is replaced rather than added to.
Where
sites.access_notes
The dwelling itself
Kept — see below
It is where the work is. The UPRN is the identity, because addresses get typed six different ways and a compliance history split in half across two spellings is worse than no history at all.
Kept
While the landlord holds the contract, and after it as compliance history.
Where
sites.address_line1, sites.address_line2, sites.postcode, sites.uprn, sites.lat, sites.lng
What was done at the property, and what was found
Kept — see below
The compliance record. This is the thing the landlord is legally obliged to hold, and the reason the work happened at all.
Kept
Until superseded by a later inspection, and then for as long as the landlord requires it. The report is retained and handed to the next tenant. A job’s history cannot be rewritten, so a telephone number typed into a note there is masked as it is written, leaving only its last three digits; history written before 23 October 2026 may still hold some. The note written when a visit is closed is cleared when a tenant’s details are erased.
Where
jobs.description, jobs.outcome_note, job_events.note, job_reports.work_done, job_reports.found, job_reports.recommend, job_reports.unsafe_note, job_observations.description, job_observations.location, job_results.notes, job_results.certificate_number
Photographs and filed documents
Reviewed on request
Evidence of the work. A written paragraph saying a consumer unit was replaced is worth a great deal less than the same paragraph with a picture of it.
Kept
With the job they belong to.
Where
job_photos.storage_path, job_photos.caption, job_documents.storage_path, job_documents.file_name
The people who work here
Reviewed on request
To run the diary, to pay them, and to greet them by the right name.
Kept
While they work here, and afterwards as far as employment records require. When somebody leaves, the office can clear their phone number, birthday and photograph; their name stays on certificates, job records and pay records.
Where
profiles.full_name, profiles.first_name, profiles.last_name, profiles.email, profiles.phone, profiles.birth_day, profiles.birth_month, engineers.payment_terms_days, engineers.employee_ref
Time off, and sickness
Kept — see below
So nobody is booked on a day they are away, and because an employer has to keep a record of sickness absence. A note can be added to any of it.
Kept
Holiday, training and other time off while the person works here, and afterwards as far as employment records require. A sickness record, and any note on it, is kept for six years after the person leaves and is then deleted automatically. Nothing is deleted while somebody still works here.
Where
time_off.kind, time_off.starts_at, time_off.ends_at, time_off.note
Thanks to the office
Reviewed on request
An engineer can thank whoever booked a job, from that job’s page, with one line of their own if they want. Only the person thanked and the engineer who sent it can see it; it is not counted or compared.
Kept
With the job it was about, for as long as the job is kept.
Where
office_thanks.from_profile, office_thanks.to_profile, office_thanks.note, office_thanks.created_at
Where an engineer was, and when they were working
Kept — see below
Everything here is asked for rather than taken, and every entry exists because a person pressed something. Pressing the safety button sends a position so the office can find somebody. Starting and finishing a round is a button an engineer presses. And a position is attached to the buttons an engineer already presses while working — starting the day, on my way, on site, closing a job, finishing — so the office can see where the round is up to; those fixes are kept for 48 hours and then deleted, and the engineer is told on the screen they press from. Nothing follows a location continuously, and nothing records one between presses. Where the firm has switched on lone-working checks, an engineer on site is asked "All OK?" after a set time; each answer, and each question left unanswered, is recorded with the job and the time.
Kept
A safety alert, with the location sent with it, is kept as a health-and-safety incident record. The start and finish of a day are kept with the day they belong to. The round positions for 48 hours only: they are deleted every morning and are left out of every backup. A lone-working check-in is kept with the job it was on.
Where
safety_alerts.lat, safety_alerts.lng, safety_alerts.located_at, engineer_day_marks.started_at, engineer_day_marks.finished_at, lone_work_checkins.kind, lone_work_checkins.at
Who changed what
Reviewed on request
A record of changes to properties, clients, rates, invoices and the people who work here — who made each change, when, and what it was before — so a wrong figure or a changed address can be traced to a person and put right.
Kept
Six years after the change, then deleted; it cannot be edited. A tenant’s details, a client’s contact email and telephone number and a member of staff’s email and telephone number are not written into it: it records that they changed, not to what. Entries written before 23 October 2026 may hold an earlier client or staff contact. Erasing a tenant removes the entries about their property.
Where
audit_log.changed_by_name, audit_log.before, audit_log.after
Wrong passwords
Erased on request
To slow down somebody guessing a password. Each refused sign-in is counted against a scrambled form of the email address, and of the address with the network address it came from — never either one itself.
Kept
A day at most, and cleared for an address the next time it signs in correctly.
Where
sign_in_failures.address_hash, sign_in_failures.pair_hash
Downloads
Kept — see below
A record of each file downloaded from SAM — who, which download, the filters in outline, how many rows and when — so the firm can say where its data went. The contents of the file are not kept.
Kept
Six years, then deleted; it cannot be edited.
Where
export_log.who_name, export_log.route, export_log.filters, export_log.row_count, export_log.at
Queries and complaints
Reviewed on request
A record of each query or complaint about a property or a job, from a tenant, a landlord or a contractor: who raised it, what it was about, and what was done.
Kept
With the property it is about. Erasing a tenant clears who raised it and what it said on every entry about their property, a landlord’s or contractor’s included; that an entry existed, and its dates, are kept for the firm’s complaint figures.
Where
contact_log.who, contact_log.summary, contact_log.detail

What can be erased, and what cannot

Your name, telephone number, email address and any note about how to get into the property are held so that somebody can arrange a visit and tell you they are coming. Ask, and they go. That takes effect the same day and the office can show it was done.

Copies made before the request — the nightly backups, and the email provider’s record of emails it delivered — are not edited. They age out within about 30 days. If a backup is ever restored, every erasure on record is applied again the same day; after a restore of the whole system that record comes from the most recent nightly copy, and any erasure made since that copy is checked and applied again by hand. A job’s history cannot be rewritten by anybody, so a telephone number typed into it is masked as it is written, leaving its last three digits; history written before 23 October 2026 may still hold some, and the office will look at it for you on request.

The record of the inspection itself does not go, and this is worth being clear about. An inspection report is a safety record your landlord is legally required to hold, to give to the next tenant, and to produce to the local authority on request. UK GDPR permits keeping personal information where it is needed to comply with a legal obligation, and that is what this is. The address stays, the result stays, and what an engineer found on the day stays.

Photographs and filed documents sit in between. They are evidence of the work, so they are not deleted automatically — but a photograph taken inside somebody’s home is not the same as a circuit reading, and any that name you or show your belongings are looked at by a person when a request comes in.

What you can ask for

A copy of what is held about youFree, and within one month.
A correctionA wrong telephone number is worth telling the office about anyway.
Erasure of your contact detailsDone on request. The safety record stays, for the reason above.
To object, or to restrict what is done with itSay so, and the office will explain what it can and cannot stop.
To complainTo the office first, and to the Information Commissioner (ico.org.uk) if that does not settle it.

If you work here

When you leave: your sign-in is closed straight away. The office can then clear your phone number, birthday and photograph, the phones set up to receive safety alerts, and the locations your phone sent while you were working. Your name stays on certificates, job records and pay records, because they are records of work done and of what you were paid.
Your copy of your data: on Your account, Download my data gives you one file of what SAM holds about you — your account, pay, time off and sickness, expense claims and their receipts, the jobs booked to you, your days, your safety alerts and the locations your phone sent.
Sickness records: a record of sickness absence, and any note on it, is kept while you work here and for six years after you leave, and is then deleted automatically.
Safety alerts: an alert you raise, and the location your phone sent with it, is kept as a health-and-safety incident record.

Who else sees it

The complete list. It is short because this software has no text message gateway, no analytics, no error reporting service and no advertising of any kind.

Who	What they do	Where
Supabase	The database, the sign-in accounts, and the uploaded files.	Ireland (eu-west-1).
Vercel	Runs the application. Every request passes through it, and it keeps a short-lived log of each one — the page or address asked for, when, and the network address it came from — and of the errors the application reports. Nothing else is stored there. What is typed into the office search is sent in the body of the request, not in its address, so it is not in that log. Vercel is a United States company.	Dublin (Ireland).
OpenStreetMap	Map tiles on the three map screens. The browser asks for a square of map by its coordinates, so it is told roughly where somebody is looking. No tenant detail leaves the application.	Europe.
Google Maps	Only when somebody presses a directions or map link: the address of the property, or the position sent with a safety alert, is opened in Google Maps in their own browser. Nothing is sent to Google until that link is pressed.	United States.
Cloudflare cdnjs	The firm’s report forms load standard script libraries from this public library when a form is opened. The browser fetching a script tells it the network address it came from; nothing typed into a form can be sent to it.	Worldwide.
jsDelivr	The same, for the libraries a form loads from jsDelivr: the network address of the browser fetching them, and nothing typed into the form.	Worldwide.
Microsoft OneDrive	Holds the nightly backup of the whole database and its files — every category on this page. The 30 most recent nights are kept and older ones deleted, so a backup ages out within about 30 days.	Set by the firm’s Microsoft 365 account.
Open-Meteo	The weather forecast. It is asked about the coordinates of the first job of the day, never about a person’s own position.	Germany.
The browser’s own push service	Google, Mozilla or Apple, depending on the browser the office uses. It carries the notification for a safety alert, and is told nothing except that there is one.	Set by the browser vendor.
Anthropic	Three things, each only when a person asks for it. Reword: the text of an engineer’s note, with telephone numbers and names taken out. Reading a certificate, where the firm has switched it on: the text of the certificate with the address, postcode, names, telephone numbers and emails taken out — but a scanned certificate is sent as pictures of up to six pages, and those cannot have anything taken out, so they include the address and any names on them. Suggesting an import’s columns, where the firm has switched it on: the column headings and up to three sample rows, with names, telephone numbers and emails taken out. The last two are off unless the firm switches them on. SAM keeps only a fingerprint of what was sent, never the text.	United States.
Resend	Sends the emails SAM sends: appointment notices and reminders to tenants (their name, email address, the property address and the appointment), work summaries and portal links to clients, and password-reset and sign-in emails to staff. It keeps a record of each email it delivers, which ages out within about 30 days.	United States.
postcodes.io	Turns a property’s postcode into map coordinates, so jobs can be placed on the map and grouped by distance. Only the postcode is sent, never a name or street address.	United Kingdom.
Companies House	When the office looks up a client company by name or number, the search is sent to Companies House. Only what the office types is sent; no tenant details.	United Kingdom.

What protects it

Checkable statements about things that exist, rather than a paragraph of adjectives.

Every table is row-level secured and scoped to one firm. Two firms sharing a database cannot read each other, and a test builds a second firm, tries to cross the boundary, and takes it down again.
An engineer sees the properties they have work at and no others. What a client is invoiced is held in a separate table they cannot read at all, because row security cannot hide one column from somebody who can read the row.
The engineer’s map is deliberately narrowed rather than widened: an address, what is due and when, and nothing else — no tenant name, no phone number, no access note.
Uploaded files are private. Every link to one is signed and expires, and each store refuses any file type outside its own list.
A job’s history cannot be rewritten by anybody, the database owner included. Changes to rates, clients, properties, engineers and invoice figures are recorded by the database itself, with who made them and what the value was before.
Passwords are held by the authentication service and never by the application. There is no password field this software is able to read.
Signing out clears everything held on the handset, because a cached page carries tenant names and telephone numbers and a phone gets lost.
Every page, and every one of these boundaries, is checked by two sweeps that sign in and try it rather than by reading the code.

What this software does and does not do is set out separately, on what this does.

Privacy notice

Who holds it

What is held

The occupier of a dwelling

A telephone entry as it was before it was split

The appointment emails sent to the occupier

The occupier’s answer to an appointment email

How to get into the property

The dwelling itself

What was done at the property, and what was found

Photographs and filed documents

The people who work here

Time off, and sickness

Thanks to the office

Where an engineer was, and when they were working

Who changed what

Wrong passwords

Downloads

Queries and complaints

What can be erased, and what cannot

What you can ask for

If you work here

Who else sees it

What protects it