Privacy Policy

BlendIQ Limited ("BlendIQ", "we", "us") operates the BlendIQ platform: software for recording site investigations, tracking samples, screening soil and construction material data against published standards, and modelling blends. We are the data controller for the personal data described below.

We are registered with the Information Commissioner's Office (ICO), registration number ZC182443.

This policy explains what we do with data. It sits alongside our Terms and Conditions, which govern how the Service may be used and what you are responsible for. Where the two overlap, this policy governs data handling and the Terms govern everything else.

Account data. Your name, email address, and optionally your initials, job title, phone number, preferred name and profile photo. Your password is stored only as a secure cryptographic hash by our authentication provider; we never see it and cannot recover it.

Activity data. When you last signed in, how long your sessions last, and a record of actions taken in the platform such as jobs, samples, stockpiles, uploads and blends created. We use this to run the service, to give administrators oversight of use, and to understand which parts of the product are worth improving.

Content you create and upload. Jobs and site details, site plans, trial pit, borehole and well logs, stockpile records, sample records, laboratory certificates and chain of custody documents, photographs and video, screened reports and saved blends. This is primarily technical and environmental information about materials and sites rather than information about people, but uploaded documents and site photographs may incidentally contain personal data - the name of an engineer on a laboratory certificate, a signature on a chain of custody form, or a person visible in a site photograph.

Notification and messaging data. Notifications generated for you, any notification you forward to a colleague together with the note you attach, and your responses to feedback requests we send through the platform.

Push notification subscriptions. If you turn on notifications, we store a subscription for each device: the address your browser's push service gives us, the encryption keys that go with it, and a short description of the device. This is what lets a notification reach a phone that is not currently open. You can turn it off per device at any time, which deletes the subscription.

Problem reports and feedback. If you report a bug or suggest an improvement we record your name, email address, what you wrote, the page you were on and your browser and device details, plus any screenshot you choose to attach. A screenshot of a problem is usually a screenshot of real project data, so these are stored in a private area readable only by us.

Records of agreement. Which version of our Terms you accepted and when.

Technical data. IP address, browser type and device information recorded in server logs for security and diagnosis.

We do not intentionally collect special category data (such as health, ethnicity or biometric data), and the platform is not designed for it.

BlendIQ can be installed to a phone and used with no signal. To make that work, some data is stored on the device itself rather than on our servers.

Work waiting to be sent. Records you log offline, and photographs you take offline, are held in your browser's local database on that device until they can be uploaded. Until they are sent, they exist only on your phone. If you clear the site's data, or uninstall the app, that work is lost and we cannot recover it because we have never received it.

Cached copies for reading offline. The list of jobs and records you last viewed is kept on the device so the app can open without a signal.

Preferences. Small settings such as which jobs you recently opened, whether the sidebar is collapsed, and whether you have chosen field mode or the full site.

None of this leaves your device except the work that is uploaded to your account when a connection returns.

To provide the Service - creating and authenticating your account, storing and processing your project data, and sending service emails such as invitations and password resets. Lawful basis: performance of our contract with you.

To keep the Service secure and well run - session and access records, administrative oversight of use, diagnosing faults and preventing abuse. Lawful basis: our legitimate interests in operating a secure and reliable service.

To improve the product - aggregated and de-identified usage statistics, and the problem reports and feedback you choose to send us. Lawful basis: our legitimate interests. We do not use your project data to train artificial intelligence models, and we do not make it available to third parties to do so.

To meet legal obligations - keeping records and responding to lawful requests from regulators or authorities. Lawful basis: legal obligation.

We do not sell personal data, and we do not use it for advertising of any kind.

Within BlendIQ, jobs and the site data within them are visible to the signed-in members of your organisation. Each organisation's workspace is separated from every other's, and that separation is enforced at the database level: users in one organisation cannot see another organisation's jobs, records, uploads or reports. There is currently no per-job or per-user restriction within an organisation, so do not upload anything you would not want other members of your organisation to see. Your account details, your notification settings and your own problem reports are not shared in this way.

Some information is visible to other members of your organisation as a normal part of using the platform: your name and initials appear against records you create and in your organisation's team list, and your name is attached to any notification you forward.

A small number of BlendIQ Limited platform administrators can access data across organisations, solely to run, support and secure the service.

We use three service providers to run BlendIQ. Each processes data on our instructions under its own data processing terms.

Supabase - our database, authentication and file storage.

Vercel - application hosting and server logs.

Resend - delivery of the emails we send you: invitations, password resets, reminders and replies to demo requests. It receives your name, your email address and the content of those emails, and nothing else.

We do not currently use any analytics, advertising or tracking provider. If we introduce one we will update this policy first.

We may also disclose information where required by law or regulation, or as part of a sale or transfer of the business, in which case this policy continues to apply to the data transferred.

Our database, file storage and authentication are hosted in the European Union, in Frankfurt, Germany. Application hosting and server logs may be processed in other regions depending on where the request is served from. Email delivery is handled by Resend, a company based in the United States, so the emails we send you and your email address may be processed there.

Transfers from the United Kingdom to the European Economic Area are covered by the UK adequacy regulations. Where any provider processes data outside the UK or the EEA, that transfer is protected by a UK-approved safeguard such as the International Data Transfer Agreement or Addendum.

Account data - for as long as your account is active. If your account is closed or deactivated we keep it for up to 12 months, then delete or anonymise it.

Project and content data - for as long as your use of the platform requires it, and deleted or anonymised within 12 months of account closure unless we are required to keep it for legal reasons. Note that project data you created belongs to your organisation's workspace, so it remains available to the other members of your organisation after your account closes.

Push subscriptions - until you turn notifications off on that device, or until the device stops accepting them, at which point the subscription is removed automatically.

Problem reports and feedback, including screenshots - up to 24 months after the issue is closed, because a recurring fault is often best understood against what was reported before.

Server and security logs - up to 90 days.

Records of your acceptance of our Terms - for the life of the account plus 6 years, as evidence of the agreement.

Data held on your own device - until it is uploaded, or until you clear the site data or uninstall the app.

Under UK data protection law you have the right to ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we process it, and to receive it in a portable format. Where we rely on legitimate interests you may object, and we will stop unless we have compelling grounds to continue.

To exercise any of these rights, contact edmund@blendiq.co.uk. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to us directly, and we will acknowledge it within 30 days. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

BlendIQ uses only what is necessary to run the service: the cookies and browser storage that keep you signed in, remember your preferences, and hold offline work on your device. We do not use advertising or third-party tracking cookies.

If we introduce optional analytics in future we will ask for your consent before setting anything, and update this policy.

We protect personal data with encrypted connections, passwords hashed by our authentication provider, database row-level security, private storage for material that should not be publicly readable, and access limited to those who need it.

No system is perfectly secure. If a breach occurs that presents a risk to your rights and freedoms, we will notify the Information Commissioner's Office and, where required, you, within the timescales the law sets.

BlendIQ is a professional tool and is not intended for use by anyone under 18. We do not knowingly collect data about children.

We may update this policy from time to time. Where a change materially affects how we handle your data we will tell you through the platform or by email. The date at the top of this page shows when it last changed.