Privacy Policy

Last updated: 23 September 2026

SiteLynx ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your personal data when you use our platform at site-lynx.co.uk.

1. Who We Are

The data controller is Site Lynx Group Ltd, a company registered in England and Wales under company number 17151377, trading as SiteLynx. We are registered with the Information Commissioner's Office under registration ZC127371.

Contact: info@site-lynx.co.uk

2. What Data We Collect

Account data: name, email address, company name, job title, password (hashed).

Usage data: pages visited, features used, timestamps, IP address, browser type.

Business data: projects, documents, reports, invoices, employee records, and any content you create within the platform. This data belongs to you.

Location data: GPS coordinates when you use clock-in/out or geofencing features (only with your permission).

Payment data: processed securely by Stripe. We do not store card numbers.

2a. The Lynx OP App

Lynx OP is the SiteLynx operative app for iPhone, iPad and Android, published on the App Store and Google Play by Site Lynx Group Ltd. It is used by operatives and supervisors of companies that run SiteLynx. This section explains what the app itself collects on your device.

Account: your name, email and the company you belong to, so the app can sign you in and show your own RAMS, QA inspections, snags, toolbox talks and documents.

Camera and photos: used only when you choose to take or attach a photo, for example on a snag, a QA inspection, a plant check or a site diary entry. Photos you take are sent to your company's SiteLynx account with the record they belong to. The app does not read your photo library except when you pick a photo from it.

Location: when you sign a RAMS or a toolbox talk on your phone, the app may record your device location once, with your permission, alongside your signature as evidence of where the sign-on happened. Location is never tracked in the background and is never read at any other time. You can refuse the permission and still sign.

Notifications: if you allow notifications, the app stores a push token so your company can send you a snag assigned to you, a RAMS to sign, or a permit decision. Turning notifications off in your device settings stops this.

Offline queue: records and photos you capture without signal are stored on your device until they send, then removed from the queue.

Device and diagnostics: the app model, operating system version and app version, and crash reports, used to keep the app working. No advertising identifiers, no ad tracking, no third-party analytics SDKs.

Who holds it: everything the app sends goes to SiteLynx's own service and is held for your company, who is the data controller for their site records; Site Lynx Group Ltd processes it on their behalf. Push notifications are delivered through Expo's notification service, which sees only the push token and the message.

Deleting your account and data: in the app, open Account, then Delete account, or email info@site-lynx.co.uk. Safety records your company must keep by law (RAMS sign-offs, inspections, permits) stay with your company under their own retention rules.

Children: the app is for people working for a SiteLynx customer and is not directed at anyone under 16.

3. How We Use Your Data

We use your data to: provide and improve the platform, authenticate your identity, send transactional emails (welcome, invitations, billing), process payments, respond to support requests, and ensure security. We do not sell your data. Ever.

4. Legal Basis (GDPR)

Contract: processing necessary to deliver the service you signed up for. Legitimate interest: analytics to improve the platform, security monitoring. Consent: optional analytics cookies, marketing emails (if any).

5. Data Sharing

We share data only with: Supabase (database hosting, EU region), Vercel (application hosting), Stripe (payment processing), Resend (transactional email), Anthropic (AI features, text only, no personal data sent), Mapbox (map tiles). No data is sold to third parties.

6. Data Retention

We retain your data for as long as your account is active. If you cancel, we retain data for 30 days then delete it. You can request immediate deletion by emailing info@site-lynx.co.uk.

7. Your Rights

Under GDPR, you have the right to: access your data, correct inaccuracies, request deletion, restrict processing, data portability, and object to processing. To exercise these rights, email info@site-lynx.co.uk.

8. Security

All data is encrypted in transit (TLS) and at rest. Authentication uses industry-standard practices via Supabase Auth. Passwords are hashed and never stored in plain text. Access to production systems is restricted.

9. Cookies

See our Cookie Policy for details on what cookies we use and why.

10. Changes

We may update this policy. Significant changes will be notified via email or in-app notification. Continued use constitutes acceptance.

11. Contact

Email: info@site-lynx.co.uk