Privacy Policy

Last updated: 9 October 2026 · UK GDPR & Data Protection Act 2018

UK GDPR compliance summary

FitOut Insider is operated by Dariusz Kubies Services (JDG), al. Solidarności 68 lok. 121, 00-240 Warszawa, Poland. NIP 7532202127, REGON 544086256 ("we", "us", "our"). For data protection enquiries, contact: hello@fitoutinsider.com. As the data controller, we are responsible for any personal data processed by this Service.

We collect minimal data: • Account data: when you sign up we collect your email address and a password, which our sign-in provider Supabase stores in hashed form so we never see it. After sign-up we ask for your first name and role (and, for a business, your company name). You can add your phone number, job title, a profile photo and a company logo in Settings. Your profile photo is shown in the app only, never on an export; your company logo appears in the header of every PDF and Word export you generate. They are deleted when your account is deleted. To change these details later, email hello@fitoutinsider.com. When you subscribe, Stripe collects your billing name, billing address, tax/VAT ID and card details through its own hosted checkout and holds them; we receive only reference numbers, the status of your subscription and the country of your billing address. • Country records for VAT: when you choose or change a plan, we record the country you tell us your business is registered in and the country your internet connection appears to be in at that moment. When you complete checkout, we also record the country of the billing address you give Stripe (the country only, not the address). Once in each billing period we record your connection country again when you use the Service. Our host, Vercel, works out the connection country; we store only the country, not your IP address. These records are linked to your account (while it exists) and your Stripe reference, and we use them only as evidence of where we supply the Service, which tax law requires us to keep. If the countries do not match, we may contact you to check. See section 9. • Referrals: if you join through someone's referral link, we record which account referred you and whether your subscription qualifies for their reward (sign-up, first payment, any refund or cancellation). The person who referred you sees only counts, never your name or email address. If you refer others, people who open your link see your first name and the initial of your surname. These records are kept with the account and deleted with it, except where they form part of billing records, which we keep for the period stated in section 9. • Registration IP address: We record the IP address you register from. We delete it when your account is deleted, except the copy kept in your acceptance record, which we keep for the period stated in section 9. • Tool-use log: each time you run a tool we record your account identifier and email address, which tool you ran, your IP address, your browser type, your plan and the time. We also record when an API key is saved, removed or used (never the key itself). This log does not include what you typed or what the AI returned. We keep it to keep the Service secure, to investigate misuse and to count usage. After 12 months we remove your email address, IP address and browser type from it, except in a record made when we could not save the country you declared for VAT (see section 9). • Project room guests: if one of our customers invites you into a project room, that customer decides what you can see and is responsible for the information about you in the project room; we handle that information for them. We also keep our own security record of guest sign-ins - the time, your email address, and the IP address and browser used - to keep the Service secure and to investigate misuse. Our lawful basis is our legitimate interest in keeping the Service secure. After 12 months we remove your email address, IP address and browser type from it. • Session authentication: when you sign in, our sign-in provider, Supabase, stores your session in a cookie on your device. It contains your user ID and email address so that the Service knows who you are, and it is used for nothing else. • Your Anthropic API key: if you connect one, we store it encrypted with AES-256-GCM and decrypt it server-side only at the moment of an API call. It is never returned to your browser and never written to a log. We delete it when you remove it or when your account is closed. A key is a credential rather than personal data, but we list it here so this inventory is complete. • Tool inputs and AI processing. Text you enter into a tool is sent to the Anthropic Claude API to generate the document. The prompt and the AI response are transmitted securely and are not stored by us as prompts or as a conversation. What you typed is saved with the document if you save it - see the next bullet, and section 3. • Voice input. Some tools have a microphone button. It uses your web browser's own speech recognition, not ours: your speech is sent to your browser's provider (Google in Chrome, Apple in Safari, Microsoft in Edge) under that company's own privacy terms, to turn it into text. We never receive the audio. On some tools, a voice-to-form button then sends that text to us and to Anthropic to sort it into the form fields, in the same way as text you type. If you prefer, type instead. • Saved documents. When you press Save on a document, both the document and the form inputs used to create it are stored in your account, so you can reopen, edit, print and complete it later. This includes anything you typed or uploaded into the form, which may include names, job titles, contact details, training certificates and incident details. Retained for as long as your subscription is active. See Data retention. • Exporting a document. Exporting to Word or PDF downloads a copy to your device. On most tools that is all it does - nothing is stored in your account, so press Save as well if you want the document kept. A small number of tools do save on export, and those say so on screen when they have. • Document Search: when you upload a file to Project Files, we extract its text and store it with the project in our database in the EU so that you can search it. When you ask a question, the most relevant passages are sent to Anthropic to write the answer. The text is kept and deleted together with the file it comes from, as described in section 9. • Project registers. Some tools, including the Site Diary and the Visitor and Site Access Register, save entries automatically as you type, because they are continuous project records rather than one-off documents. The same retention applies. • Data about other people. Many of these tools are designed to record information about your staff, subcontractors and site visitors. Where you enter data about other people, you are the controller of that data and we act as your processor. You are responsible for informing those people and for having a lawful basis to record it. • Content you contribute to someone else's project. Where you are a member of a project you do not own and you upload a document or add an entry, that content belongs to the project and stays with it. It is not removed when you close your own account, in the same way that work you did for an employer stays with the employer when you leave. If you want content removed from a project you do not own, ask whoever owns that project. They control it, and we act on their instruction. • Work in progress that has not been saved. Some tools keep what you are working on in your own browser until you save it, so that you do not lose it if the page reloads. Until you press save, that content stays on your device and never reaches us. It is not part of your account, it is not included in a copy of your data, and it will not be there if you clear your browser or move to another device. Site photos are currently kept this way too: they are stored only in your browser and are removed when you sign out. If you ask an AI tool to analyse a photo, it is sent to Anthropic to produce the result, in the same way as other tool inputs, and is not stored by us. Some tools, including the Near Miss and Incident report, keep the text you write exactly as you write it. Where you name a person in that text, the name is retained on the record for as long as the record exists, and it is included if you or that person exercise a right of access. • Usage tracking: We record the number of AI requests you make. We record counts only, never the content of a request or a response. Your count is shown back to you in your account so you can see your own usage. We also use usage counts and your account identifier to apply limits that protect the service: a spending limit on free trials and on the support chat, a limit on AI requests (currently 30 a minute and 300 an hour per user), and rate limits on requests to our servers, run by our provider Upstash. If you reach a limit, you may need to wait, or on a free trial, subscribe to continue. • Feedback, support messages and technical error logs: stored to diagnose issues and improve the Service (EU region, Ireland eu-west-1) and kept for the periods set out in Data retention below. Where an error is serious enough to alert us, a copy of that record is emailed to us through Resend, our transactional email provider. It contains the error message, the page you were on, your account identifier and the technical stack trace. We do not sell this data and we do not disclose it to anyone else. • Demo bookings: if you book a demo through "Book a demo", your booking details (name, email address and anything you add to the booking) are received by us and processed by Cal.com. Cal.com's privacy policy applies to that booking. Monthly industry update. If you tick the box when you sign up or accept an invitation, we email you a short monthly industry update, and invited team members also receive our product tips. We do this with your consent. You can withdraw it at any time with the unsubscribe link in every email or in Settings, and we then stop.

Tool inputs are processed by Anthropic's Claude API, using the API key you connect to your own account, to generate outputs. During your free trial, and in the support chat if you have not connected your own key, your requests are sent to Anthropic through our own Anthropic account instead of your key. The same information is sent either way. If you type a question into the question box on our website, what you type is sent to Anthropic through our own Anthropic account to produce the answer. Please do not include personal or project details. By Anthropic's policy, API inputs are not used to train AI models. We do not keep a record of your prompts and we keep no conversation history. The prompt and the AI response are transmitted over an encrypted connection and are not stored by us as prompts or as a conversation. Three things that come out of that process are kept, and each is covered in section 9. The information you enter into a tool is saved alongside the document it creates, so that you can come back to it and edit it, and is kept for as long as your subscription is active. The document the tool generates is kept on the same basis, where you choose to save it. And where a generation fails, the technical error log may contain the content of the failed request, and is kept for 90 days. We recommend you do not input sensitive personal data unless necessary for the specific document being generated.

The Near Miss and Incident Reporting tool records the classification of a workplace incident - the date, location, event type, severity class, root cause and the actions taken - including whether the incident is reportable under RIDDOR. It does not ask who was involved, and provides no fields for the name, address, date of birth or contact details of an injured person. Where a report generated by the Service contains a section for those details, that section is deliberately left blank for you to complete and retain on your own systems. If you enter information identifying an individual into a free text field, that is special category data under Article 9 and you remain the controller of it. We process it solely as your processor, on your instructions, so that you can meet your own obligations under health and safety law, and for no other purpose.

The Service does not provide any facility for recording an individual's security clearance, vetting status, criminal record check, or the outcome of any such check. Fields of that kind have been removed from the Service. The Training Matrix records ordinary competence certifications such as CSCS, SMSTS, SSSTS, IPAF, PASMA, first aid and asbestos awareness, together with their issue and expiry dates. You should not enter data relating to criminal convictions and offences, as defined in Article 10 of the UK GDPR, into any field of the Service.

Account data and saved outputs are stored in Supabase (PostgreSQL), hosted in the EU (Ireland, eu-west-1). All connections are encrypted end-to-end (TLS 1.3). We do not use your data to train AI models. We do not share or sell your data. Hosting runs on Vercel for serverless functions and CDN delivery.

We use only essential cookies, which the Service needs to sign you in, keep you signed in securely, keep your place while you work and carry your sign-up choices into your new account. The main one is the sign-in cookie set by Supabase, which holds your user ID and email address and lasts until you close your browser, or 7 days if you tick "remember me". Our Cookie Policy lists every cookie, what it does and how long it lasts. Our public website sets no cookies. We use Vercel Web Analytics to count visits to our pages and a few steps in sign-up and checkout: starting and completing sign-up, starting a trial, saving your AI key, and starting and completing checkout (with the plan name only). It does not use cookies or store anything on your device. We do not send your name, email address, company, user ID or payment details with these events. No consent is required under GDPR, UK GDPR or PECR. We do not use advertising or third-party tracking cookies. See our Cookie Policy for full details.

• Legal obligation (Art. 6(1)(c)): keeping billing, invoice and transaction records, and the VAT country records described in section 2, as Polish and UK tax law requires. • Contract performance (Art. 6(1)(b)): processing account and usage data to deliver the subscription, including a few short product tips emails to account holders in their first two weeks, which you can turn off in Settings. • Legitimate interests (Art. 6(1)(f)): session authentication, transient processing of tool inputs, registration-IP record, error logging, and the tool-use log, for keeping the Service secure and preventing abuse. • Consent (Art. 6(1)(a)): for any optional feedback or support messages, the monthly industry update, and product tips for invited team members. You can withdraw consent at any time with the unsubscribe link in any email or in Settings. • Demo bookings: to arrange and hold the demo you asked for. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) UK GDPR / GDPR).

Sign-in cookies: the sign-in cookie lasts until you close your browser, or 7 days if you tick "remember me"; the session check cookie (fitout-snonce) lasts up to 30 days. Both are removed when you sign out. AI prompts (the exact text sent to Anthropic): not retained by us as prompts, and no conversation history is kept. The tool inputs you typed are saved with the document you created - see Saved documents and project registers below - and where a generation fails, the request content may appear in a technical error log for 90 days. How long our AI provider keeps your inputs Anthropic is our AI subprocessor. Under their published policy for business customers, inputs and outputs are automatically deleted within 30 days of being received or generated. Two things extend that. Where a request is flagged by their automated safety systems, inputs and outputs may be kept for up to two years, and the safety classification scores produced by that flagging for up to seven. And they may keep data for longer where the law requires it. We do not hold a zero-retention agreement with Anthropic. That means we cannot tell you your inputs are never stored anywhere - only that the periods above are what their policy provides, and that we do not keep your prompts as prompts ourselves. Billing, invoice and transaction records: retained for 7 years. This covers both the Polish statutory minimum, which runs 5 years from the end of the year in which the tax became due, and the UK VAT record-keeping requirement of 6 years. This applies regardless of when you cancel your subscription. VAT country records: kept until 31 December of the sixth year after the year of your last billing period, which covers the period in which the Polish and UK tax authorities can check the VAT on our supplies to you. These records survive the deletion of your account, because the law requires us to keep them. If your free trial ends without a paid subscription, these records are deleted 90 days after the trial ends, or straight away if you delete your account first. Saved documents and project registers, including the tool inputs used to create them: retained for as long as your subscription is active. There are then two ways your data leaves the Service, and they are not the same. If your subscription simply ends, access to the Platform ends and your data is kept for a further 90 days. Resubscribe within that period and it is exactly as you left it. If you do not, it is permanently deleted at the end of the 90 days. If you press Delete account in your settings, there is no 90 day window. Your profile, projects and saved documents are destroyed immediately and permanently, we cannot restore them afterwards, and resubscribing does not bring them back. The records that survive are those described below that we must or are entitled to keep: billing records, VAT country records (for paid subscriptions), records of notices and terms you accepted, the erasure audit log, and any feedback you have sent us, which we keep for up to twelve months. Our database is backed up once a day and those backups are kept for seven days, so the Service can be restored if something goes wrong. A record you have deleted may still exist in a backup until that seven-day cycle completes; it is not accessible while it sits there, and it goes when the backup is overwritten. Files you upload are also copied once a day to a separate backup, so they can be restored if something goes wrong. A file you delete, or an earlier version of a file you change, is kept in that backup for up to seven days and then removed. You can also delete any individual document or entry yourself at any time, and that deletion is permanent. Registration IP: deleted when your account is deleted, except the copy in your acceptance record - see Records of safety notices and terms you accepted, below (fifteen years). Usage records: 13 months. Tool-use log: email address, IP address and browser type are removed after 12 months, and straight away when you delete your account. The tool name, the date and the account identifier are kept while your account exists. The exception is a record made when we could not save the country you declared for VAT: it keeps these details for six years, because tax law requires us to keep evidence of where we supply the Service. Feedback: up to 12 months. Technical error logs, which may include the content of a failed tool request: 90 days. Erasure audit log: 12 months. When an account is deleted we keep a record of the deletion itself. It holds the account identifier, and the email address, first and last name, phone number, company name and job title held on the account at the time, together with any reason you gave and the date. It does not hold your projects, your saved documents or anything you entered into a tool - all of that is destroyed at the point of deletion. Our lawful basis is legitimate interests under Article 6(1)(f): preventing fraudulent deletion and re-registration, and being able to answer a dispute about whether and when an account was closed. You can object to this retention at any time by writing to hello@fitoutinsider.com. Records of safety notices and terms you accepted: retained for fifteen years from the date of acceptance. Each record holds your account identifier, your email address and, if you have given it, your name, as held at the time, the IP address the acceptance came from, the identifier and exact wording of the notice you were shown, and the date and time. Our lawful basis is legitimate interests under Article 6(1)(f): establishing, exercising and defending legal claims. Fifteen years is chosen because it is the longest period in which a claim relating to a document produced through the Service could still be brought against us, and because documents made here - risk assessments, construction phase plans, fire risk assessments - are routinely relied on many years after they are created. These records survive the deletion of your account, for the same reason. Demo booking details: kept for 12 months after the demo, unless you become a customer, when they are kept as account data. Cal.com keeps its own copy under its own policy. Records are removed by a daily deletion job, so removal can take a few days after the end of the period shown.

You have the right to: Access, Rectification, Erasure ("right to be forgotten"), Restriction, Portability, and Objection. To exercise any of these, contact hello@fitoutinsider.com, we respond within 30 days. You may also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We implement appropriate technical and organisational measures: TLS 1.3 in transit, AES-256 at rest (Supabase), sign-in cookies sent over HTTPS only, and Row Level Security, so that data can be reached only by the account, or the workspace, it belongs to. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay. We report breaches to the supervisory authority where the law requires it: the President of the Personal Data Protection Office (UODO) in Poland and, for UK residents, the Information Commissioner's Office (ICO).

Supabase (EU, Ireland), database/auth · Anthropic (USA), transient AI processing via your own connected API key, or via our own account during your free trial, in the support chat and in the question box on our website · Vercel (USA/UK/EU), hosting and cookieless analytics (Vercel Web Analytics, which collects no personal data and sets no cookies), functions run in London (UK) · Stripe (USA/EU), payment processing - Stripe collects and holds your billing name, address, tax/VAT ID and card details, we receive only reference numbers, the status of your subscription and the country of your billing address · Resend (USA), transactional email - sends the emails the Service produces and processes whatever each one contains. That includes the name, email address and message you submit through the contact form; account emails such as your welcome message, a notice when your account is signed into from a new device, a recovery code confirmation, billing and subscription notices and a deletion confirmation; invitations, which carry the email address of the person you invite together with your name and the organisation or project name; a comment left by a client on your project portal, including their name and what they wrote; reminders naming a project and the item they concern, such as an overdue RFI or an approaching payment deadline, and the monthly industry update; feedback and bug reports, including your email address, the page you were on, what you wrote and any screenshot you attach; and technical error alerts containing the error message, the page URL, your account identifier and a stack trace. When you complete sign-up we send ourselves a short notice of the new account (your name, role, account type, company name for a business account, email address and whether you asked for the industry update) so we can welcome you and support you. We delete these notices after 12 months · Upstash, Inc. (United States) - helps keep the service secure. It limits the rate of requests to our servers to protect the service from overload and misuse, using your IP address and account identifier. It also protects your signed-in session: it holds a random security check value for each signed-in user, and a one-way coded (hashed) record of the browsers you have signed in from, so that we can block a stolen or replaced session and tell you when you sign in from a new device. The data is stored in London, United Kingdom (Amazon Web Services). Upstash is a US company and may access the data from the United States; that transfer is protected by the European Commission standard contractual clauses and the UK International Data Transfer Addendum, both part of Upstash's data processing addendum. Rate-limit records expire automatically within two hours, and session security records within 30 days. · Google (USA/EU), optional sign-in - where you choose to sign in with a Google account, Google processes your email address and account identifier to authenticate you · Microsoft (USA/EU), optional sign-in - where you choose to sign in with a Microsoft or Azure AD account, Microsoft processes your email address and account identifier to authenticate you · Microsoft (USA/EU), optional Teams notifications - where you choose to connect a Microsoft Teams channel, we send notification messages to the webhook address you supply. Those messages name the project and the item they concern, such as an overdue RFI or an approaching payment deadline. This is separate from the optional Microsoft sign-in above · Slack (USA), optional Slack notifications - where you choose to connect a Slack channel, we send notification messages to the webhook address you supply. Those messages name the project and the item they concern, such as an overdue RFI or an approaching payment deadline · Companies House (UK), company and director lookup - where you search for a company, the search terms you enter are sent to the Companies House public register. A search term can include a person's name · Xero (New Zealand and USA), optional accounting connection - where you choose to connect a Xero account, Xero authenticates you and processes your Xero organisation identifier. Where you choose to send an invoice to Xero, we transmit the customer or contact name, the amount, the due date, the invoice number and the project name for that invoice · Procore (USA), optional project connection - where you choose to connect a Procore account, we request your company's projects, RFIs, submittals and drawings on your behalf and display them to you. Those records can include the names of people at other organisations. We pass them to your browser and do not store them · Autodesk (USA), optional project connection - where you choose to connect an Autodesk account, we request your hubs, projects, folders, drawings and RFIs on your behalf and display them to you. Those records can include the names of people at other organisations. We pass them to your browser and do not store them · Cal.com (USA), demo booking scheduling - Cal.com, Inc. is based in the United States. When you book a call, your booking details (name, email address, and anything you add to the booking) are processed by Cal.com and transferred to the United States under the safeguards in Cal.com's data processing terms. · DataRep (UK and Ireland), our UK GDPR representative - receives requests and correspondence that people in the UK send to it about how we handle their personal data, and passes them to us. It processes the name, contact details and content of each request, and may hold a copy of our record of processing activities to show the Information Commissioner's Office if asked. Transfers to the USA are governed by standard contractual clauses (SCCs) under UK & EU GDPR.

DPAs are in place with each sub-processor via their standard contractual terms. A Data Processing Agreement between you and FitOut Insider forms part of the standard terms accepted by every customer on every plan, not something available only on request to some. The full Data Processing Agreement is published on this Legal page, alongside this Privacy Policy.

FitOut Insider is operated by Dariusz Kubies Services, established in Poland (EU), and is therefore also subject to EU GDPR (RODO). As a Polish-registered business, our primary supervisory authority is the Urzad Ochrony Danych Osobowych (UODO), the Polish data protection authority (uodo.gov.pl). If you are based in the United Kingdom, you also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, in respect of processing that affects you as a UK resident.

FitOut Insider is run from Poland and has no office in the United Kingdom. Under Article 27 of the UK GDPR, FitOut Insider (Dariusz Kubies, sole trader) has appointed DataRep as its representative in the UK. If you are in the UK, you can contact DataRep instead of us about how we handle your personal data or to exercise your rights: - by email to datarequest@datarep.com, with "FitOut Insider" in the subject line; - through the web form at www.datarep.com/data-request; or - by post to DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom. Address your letter to "DataRep", not to FitOut Insider, or it may not reach them. For anything else, such as your account, your subscription or the Service, contact us at hello@fitoutinsider.com.

We may update this Policy from time to time. Where changes are significant, we notify subscribers by email at least 14 days before they take effect. The most recent revision date is shown at the top of this page.

Data controller: Dariusz Kubies Services (JDG), al. Solidarności 68 lok. 121, 00-240 Warszawa, Poland. NIP 7532202127, REGON 544086256 (trading as FitOut Insider) UK representative: DataRep - see section 15. Email: hello@fitoutinsider.com ICO complaints: ico.org.uk · UODO complaints (EU): uodo.gov.pl