Privacy Policy

BlendIQ Limited ("BlendIQ", "we", "us") operates the BlendIQ platform: software for recording site investigations, tracking samples, screening soil and construction material data against published standards, and modelling blends. We are the data controller for the personal data described below.

We are registered with the Information Commissioner's Office (ICO), registration number [to be confirmed].

This policy explains what we do with data. It sits alongside our Terms and Conditions, which govern how the Service may be used and what you are responsible for. Where the two overlap, this policy governs data handling and the Terms govern everything else.

Account data. Your name, email address, and optionally your initials, job title, phone number, preferred name and profile photo. Your password is stored only as a secure cryptographic hash by our authentication provider; we never see it and cannot recover it.

Activity data. When you last signed in, how long your sessions last, and a record of actions taken in the platform such as jobs, samples, stockpiles, uploads and blends created. We use this to run the service, to give administrators oversight of use, and to understand which parts of the product are worth improving.

Content you create and upload. Jobs and site details, site plans, trial pit, borehole and well logs, stockpile records, sample records, laboratory certificates and chain of custody documents, photographs and video, screened reports and saved blends. This is primarily technical and environmental information about materials and sites rather than information about people, but uploaded documents and site photographs may incidentally contain personal data - the name of an engineer on a laboratory certificate, a signature on a chain of custody form, or a person visible in a site photograph.

Notification and messaging data. Notifications generated for you, any notification you forward to a colleague together with the note you attach, and your responses to feedback requests we send through the platform.

Push notification subscriptions. If you turn on notifications, we store a subscription for each device: the address your browser's push service gives us, the encryption keys that go with it, and a short description of the device. This is what lets a notification reach a phone that is not currently open. You can turn it off per device at any time, which deletes the subscription.

Problem reports and feedback. If you report a bug or suggest an improvement we record your name, email address, what you wrote, the page you were on and your browser and device details, plus any screenshot you choose to attach. A screenshot of a problem is usually a screenshot of real project data, so these are stored in a private area readable only by us.

Records of agreement. Which version of our Terms you accepted and when.

Technical data. IP address, browser type and device information recorded in server logs for security and diagnosis.

We do not intentionally collect special category data (such as health, ethnicity or biometric data), and the platform is not designed for it.

BlendIQ can be installed to a phone and used with no signal. To make that work, some data is stored on the device itself rather than on our servers.

Work waiting to be sent. Records you log offline, and photographs you take offline, are held in your browser's local database on that device until they can be uploaded. Until they are sent, they exist only on your phone. If you clear the site's data, or uninstall the app, that work is lost and we cannot recover it because we have never received it.

Cached copies for reading offline. The list of jobs and records you last viewed is kept on the device so the app can open without a signal.

Preferences. Small settings such as which jobs you recently opened, whether the sidebar is collapsed, and whether you have chosen field mode or the full site.

None of this leaves your device except the work that is uploaded to your account when a connection returns.

To provide the Service - creating and authenticating your account, storing and processing your project data, and sending service emails such as invitations and password resets. Lawful basis: performance of our contract with you.

To keep the Service secure and well run - session and access records, administrative oversight of use, diagnosing faults and preventing abuse. Lawful basis: our legitimate interests in operating a secure and reliable service.

To improve the product - aggregated and de-identified usage statistics, and the problem reports and feedback you choose to send us. Lawful basis: our legitimate interests. We do not use your project data to train artificial intelligence models, and we do not make it available to third parties to do so.

To meet legal obligations - keeping records and responding to lawful requests from regulators or authorities. Lawful basis: legal obligation.

We do not sell personal data, and we do not use it for advertising of any kind.

Within BlendIQ, all signed-in users of the platform can see all jobs and the site data within them. BlendIQ is currently a shared workspace rather than a set of separate private accounts: there is no per-job or per-user access restriction. Do not upload anything you would not want every user of your BlendIQ installation to see. Your account details, your notification settings and your own problem reports are not shared in this way.

Some information is visible to other users as a normal part of using the platform: your name and initials appear against records you create and in the team list, and your name is attached to any notification you forward.

We expect to introduce per-organisation separation as the platform grows, and this policy will be updated before that changes.

We use two service providers to run BlendIQ. Both process data on our instructions under their own data processing terms.

Supabase - our database, authentication, file storage, and the emails that carry invitations and password resets.

Vercel - application hosting and server logs.

We do not currently use any analytics, advertising or tracking provider. If we introduce one we will update this policy first.

We may also disclose information where required by law or regulation, or as part of a sale or transfer of the business, in which case this policy continues to apply to the data transferred.

Our database, file storage and authentication are hosted in the European Union, in Frankfurt, Germany. Application hosting and server logs may be processed in other regions depending on where the request is served from.

Transfers from the United Kingdom to the European Economic Area are covered by the UK adequacy regulations. Where any provider processes data outside the UK or the EEA, that transfer is protected by a UK-approved safeguard such as the International Data Transfer Agreement or Addendum.

Account data - for as long as your account is active. If your account is closed or deactivated we keep it for up to 12 months, then delete or anonymise it.

Project and content data - for as long as your use of the platform requires it, and deleted or anonymised within 12 months of account closure unless we are required to keep it for legal reasons. Note that because BlendIQ is a shared workspace, project data you created remains available to other users of the platform after your account closes.

Push subscriptions - until you turn notifications off on that device, or until the device stops accepting them, at which point the subscription is removed automatically.

Problem reports and feedback, including screenshots - up to 24 months after the issue is closed, because a recurring fault is often best understood against what was reported before.

Server and security logs - up to 90 days.

Records of your acceptance of our Terms - for the life of the account plus 6 years, as evidence of the agreement.

Data held on your own device - until it is uploaded, or until you clear the site data or uninstall the app.

Under UK data protection law you have the right to ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we process it, and to receive it in a portable format. Where we rely on legitimate interests you may object, and we will stop unless we have compelling grounds to continue.

To exercise any of these rights, contact edmund@blendiq.co.uk. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to us directly, and we will acknowledge it within 30 days. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

BlendIQ uses only what is necessary to run the service: the cookies and browser storage that keep you signed in, remember your preferences, and hold offline work on your device. We do not use advertising or third-party tracking cookies.

If we introduce optional analytics in future we will ask for your consent before setting anything, and update this policy.

We protect personal data with encrypted connections, passwords hashed by our authentication provider, database row-level security, private storage for material that should not be publicly readable, and access limited to those who need it.

No system is perfectly secure. If a breach occurs that presents a risk to your rights and freedoms, we will notify the Information Commissioner's Office and, where required, you, within the timescales the law sets.

BlendIQ is a professional tool and is not intended for use by anyone under 18. We do not knowingly collect data about children.

We may update this policy from time to time. Where a change materially affects how we handle your data we will tell you through the platform or by email. The version and date at the top of this page show when it last changed.