SiteFeed TeamsPrivacy notice
Who we are
SiteFeed Teams is provided by Steve O’Neill, a sole trader trading as SiteFeed, Flat 2 Walker House, 1 Barker Butts Lane, Coundon, Coventry, CV6 1BF, United Kingdom ("we", "us"). For privacy questions or requests, email support@sitefeed.co.uk.
This notice covers the SiteFeed Teams app, its online service and this website only. SiteFeed Estimating is a different app that works differently; its own privacy policy is at sitefeed.co.uk/privacy. Unlike SiteFeed Estimating, SiteFeed Teams stores your company's records on our servers so your team can share them between phones.
Our two roles
We handle information in two different ways, and the law gives us a different role for each.
- We are the controller for the information we need to run SiteFeed Teams ourselves: your sign-in account, sign-in sessions, server request logs and messages you send us. This notice explains what we do with it and our legal basis.
- We are a processor for the job, customer, team and financial records your company keeps in the app, including anything about your customers, your team or (for an Admin) your money. Your company decides what to keep and why, and is the controller. We only use those records to provide SiteFeed Teams to your company, on the terms in our data processing terms. Questions about why your company keeps something about you are for your company to answer.
What we collect and why
Information we control:
| Information | Why | Legal basis |
|---|---|---|
| Your name and email address | To create your account, send sign-in codes and invitations, and show your name to your team | Contract: providing the account you sign up for under our terms |
| Sign-in sessions: when they were created, and the IP address and device description that made them | To keep you signed in, let you sign out everywhere, and protect accounts from misuse | Legitimate interests: keeping accounts secure |
| Server request logs (time, address requested, response, and technical details such as the IP address) kept by our hosting provider | To run, secure and fix the service | Legitimate interests: running a secure, working service |
| Emails you send us, and our replies | To answer you and deal with requests, including privacy requests | Legitimate interests: supporting our users; legal obligation where the request is a data protection request |
Records we process for your company (your company is the controller and decides its own legal basis):
| Information | What we do with it |
|---|---|
| Company records your team enters: projects, diary entries and hours, to-dos, reminders, customers and their contact details, photos, documents, sign-offs | Store them and sync them between your team's devices |
| Financial records, for Admins: budgets, costs, quotes, invoices (including any CIS deduction shown on them), payments and VAT details | Store them, number issued invoices for your company |
We do not use advertising, analytics or tracking tools, we do not sell information, and we do not use your records to train AI models.
What stays on your phone
Your sign-in token is kept in the iPhone's Keychain. The app keeps a copy of your company's records on the phone so it works offline. Reminders are scheduled on the phone. The app asks before using the camera, photo library or notifications, and only when you use those features. When you open an address in a maps app, that app's own privacy terms apply.
Who processes information for us
- Cloudflare (Workers, D1 database and R2 file storage): hosts the service and stores your records and files. Cloudflare is a US company that runs data centres around the world.
- Resend: sends sign-in codes and invitation emails. Resend says it stores the emails it sends, and its delivery records, in the United States.
Apple is not one of our processors. Apple distributes the app through the App Store and TestFlight under its own terms and privacy policy, and reminders are scheduled by the app on your device. The sign-in token kept in the Keychain stays on your device.
Your company's records and files are stored by Cloudflare in its European Union jurisdiction. Requests are handled in Cloudflare data centres around the world, and Resend stores emails in the United States, so some information is transferred outside the UK. Cloudflare relies on the UK Extension to the EU-US Data Privacy Framework, with standard contractual clauses and the UK Addendum as a fallback. Resend relies on the Data Privacy Framework (including the UK Extension) and standard contractual clauses in its data processing agreement.
How long we keep information
- Your account details: while you have an account. When you delete your account in the app, your name and email are erased straight away; if you ask us by email instead, we do it within one month (see Delete your account).
- Sign-in codes: stored only as a hash and valid for 5 minutes. Sessions: expire 60 days after you last used them, or when you sign out.
- Emails you send us: for up to two years after the conversation ends, unless we need them longer for a legal claim.
- Server request logs: Cloudflare Workers Logs currently keeps them for up to 3 days on our Free plan. Database point-in-time restore history: currently up to 7 days on our Free plan. These periods may increase if we change hosting plans; Cloudflare currently allows up to 7 days of Workers Logs and 30 days of database restore history on its Paid plan. Data deleted from the live service may remain in recoverable database history until the restore window expires.
- Records we process for your company: while your company uses SiteFeed Teams. When someone deletes a record in the app it disappears for your team, but in this version the server keeps the stored copy, and any attached photos and files, until your company asks us to erase them or stops using SiteFeed Teams. Your company's Admin can request a copy or permanent erasure by emailing support@sitefeed.co.uk. This requires identity and authority checks and is handled manually in V1. We return or erase the records within 90 days of a company closing its account or a valid request under our data processing terms, except where the law requires retention. Requests involving individuals' data protection rights are handled within the applicable legal deadlines, which may be shorter.
Your company is responsible for keeping its own business records for as long as the law requires (for example, for HMRC, Companies House, VAT and CIS). Keep your own copies: SiteFeed Teams is not a substitute for that.
Your rights
You can ask for a copy of your personal information, ask us to correct it, object to how we use it, ask us to limit its use or delete it. You can delete your account yourself in the app. For records your company keeps in the app, your company is the controller: we will pass your request to it and help it respond. If you are unhappy with how we handle your information you can complain to the Information Commissioner's Office (ico.org.uk).
Children
SiteFeed Teams is a business tool and is not intended for children.
Changes
We will update this notice if how we handle information changes, and show the date at the bottom of the page.