Privacy Policy

Last updated: 30 September 2026 · England & Wales

Who we are

GuardConstruct ("we", "us") provides an automated commercial risk review tool for small UK construction businesses and freelancers. Contact for privacy queries: tobyburrows1@icloud.com.

What we collect

• Account details: your email address, and a password if you choose one (stored hashed by our login provider, never by us in plain text).
• Job context you enter (trade, package size band, duration, role).
• Contract documents, photos or text you upload for review (read in memory, not stored: see Retention).
• Your review history: the AI result for each check and the job context. We don't keep the contract itself. Results can quote contract wording, which may include names and addresses of the parties.
• For free-tier limits: a normalised form of your email address, a one-way hash of your IP address, and a daily count of photo pages read (deleted after 7 days).
• If you use a team workspace: your membership, and the email addresses of people invited (kept until the invite is accepted, revoked or expires). Other members of a team can see your name, email address, and the reviews and deadlines you create in that team.
• If you use project tracking and reminders: project names, the deadlines picked out of your contract (including short quotes of the relevant clauses), dates and notes you add yourself, whether you've marked them done, and a record of reminder emails sent.
• If you ask for help getting paid: the amount owed, who owes it, how many days overdue, whether a pay less notice was served, your name, email, phone number (optional), any notes, and a record that you ticked the consent box and its exact wording.
• Payment and subscription data processed by Stripe if you subscribe.
• Basic technical data (IP address, browser type) in server logs for security and rate limiting, and how long each check took.

How we use it

• To run an automated contract risk summary and show results to you.
• To keep your review history so you can see it on any device.
• To send deadline reminder emails you have asked for. You can turn these off in the account menu or with the unsubscribe link in any reminder email.
• To follow up a "Need help getting paid?" request. Only if you tick the consent box, we may pass your request to a solicitor or adjudication partner, who may pay us a referral fee. We do this by hand; nothing is shared automatically, and you can withdraw consent at any time by emailing us before we pass it on.
• To enforce free-tier limits and Pro subscriptions.
• To process payments and prevent abuse (rate limiting, fraud checks).
• To respond to support requests you send us.

Legal bases under UK GDPR: contract performance (providing the service you request), legitimate interests (securing the service, preventing abuse), consent (sharing a help-getting-paid request with a partner), and legal obligation where applicable.

AI processing

Contract text and images are sent to our AI provider Anthropic solely to extract text and generate a commercial risk summary. Outputs are automated, may be incomplete or incorrect, and are not legal advice. Do not upload documents you are not entitled to process.

Third parties

• Anthropic — AI processing of document content.
• Stripe — subscription payments and billing portal.
• Supabase — login and database (accounts, review history, subscription status).
• Vercel — website hosting and serverless infrastructure.
• Resend — sending reminder emails, and emailing us your help-getting-paid requests.
• Solicitor or adjudication partners — only a help-getting-paid request you consented to share, passed on by us by hand. They may pay us a referral fee. They are independent and handle your data under their own privacy notice.

These providers may process data outside the UK. Where they do, we rely on appropriate safeguards they publish (such as standard contractual clauses).

Cookies

We do not use advertising or analytics cookies. We use strictly necessary cookies to keep you signed in. Older versions of the app stored your account on your device; the app now removes that data automatically and offers to move any saved reviews into your account.

Retention

Uploaded files and the full contract text are processed in memory for the request and are not stored by us, so there is no file to delete later. Your review history (as described above) is kept until you delete it, which you can do for each review in the app, or until you delete your account (account menu → Delete my account) or ask us to. Free accounts see only their latest check; earlier ones are kept so they come back if you subscribe, and are removed when you delete your account or ask us to. Deleting a check also deletes the deadlines and reminders taken from it. Help-getting-paid requests are kept until you delete your account or ask us to delete them. Deleting your account removes your profile, personal reviews, projects, tracked dates, help-getting-paid requests and any teams you own. We keep the normalised email and count used for the free-tier limit, so the free check can't be reset by re-registering, and Stripe keeps billing records as the law requires. Hashed IP addresses used for free-tier limits are deleted after 2 days. Stripe retains payment records per their policies. Server logs are kept for a limited period for security.

Your rights

Under UK GDPR you may request access, correction, erasure, restriction, or portability of personal data we hold, and you may object to certain processing. Contact us at the email above. You may complain to the ICO (ico.org.uk).

Children

The service is aimed at businesses and is not intended for anyone under 18.

Changes

We may update this policy; the "Last updated" date will change when we do.