Privacy Policy

Effective 24 September 2026 · Version 2026-09-23-b2b-production-v1

1. Who we are

SiteHQ is operated by Stripout London Ltd (company number 13654607), 30 Great North Road, Brookmans Park, Hatfield, Hertfordshire AL9 6NF. We are registered with the Information Commissioner's Office under reference ZB485737; the current registration is paid through 12 December 2026.

Stripout London Ltd is the controller for account, billing, support and service-administration data. For customer workspace content, the customer organisation determines the purpose of processing and is normally the controller; Stripout London Ltd processes that content on its instructions to provide SiteHQ.

2. Data we process

  • Account and workspace data, including name, email address, organisation, role and authentication identifiers.
  • Project, contact, document, photo, attendance, commercial and health and safety content entered into a workspace.
  • Usage, security, audit, device, diagnostic and support records.
  • Subscription, invoice and payment-status data. Stripe processes payment-card details.
  • Data from optional integrations such as Gmail, Google Business Profile, LinkedIn or Xero when an authorised user connects them.

3. Why we process data

We process data to create and secure accounts, provide workspace features, generate requested AI-assisted output, administer subscriptions, send service communications, support users, respond to outages, prevent misuse, keep required records and improve reliability.

Our legal bases include performance of a contract, legitimate interests in operating and securing the service, compliance with legal obligations and consent where required for optional integrations or optional learning features. You can disconnect an optional integration or withdraw consent without affecting earlier lawful processing.

4. AI-assisted processing

When you request an AI-assisted feature, relevant workspace content is sent to the selected AI provider to produce the requested output. Support and outage response are handled in-house; our staff may use AI-assisted tools under human oversight. Do not include unnecessary personal data in prompts or support requests.

Optional cross-customer platform learning is off by default and requires an authorised administrator to opt in. The setting can be withdrawn for future contributions. Xero data and directly identifying customer details are excluded from that feature.

5. Processors and subprocessors

We use service providers only to operate SiteHQ. They include:

  • Vercel for application hosting and delivery.
  • Supabase for authentication, database and file storage.
  • OpenAI for requested AI-assisted features.
  • Stripe for Checkout, subscription billing and the Customer Portal.
  • Google for sign-in and authorised Google integrations.
  • Resend for transactional email when enabled.
  • Upstash for hosted Redis infrastructure used for rate limiting and abuse protection; request identifiers and limited technical metadata may be processed for that purpose.
  • LinkedIn and Xero only when an authorised user enables the relevant optional integration.

A provider may use its own subprocessors under its data-processing terms. Processing may occur outside the UK. Where UK restricted-transfer rules apply, we use the provider's applicable lawful transfer mechanism. We will reflect material processor changes in a dated policy version before or when the change takes effect, as legally required.

6. Sharing and security

We do not sell personal data. We disclose it to authorised workspace users, the providers above, professional advisers, regulators or law enforcement only where needed to provide the service, follow instructions, protect rights and security, or comply with law. We use access controls, tenant boundaries, encryption in transit, private storage controls and audit records appropriate to the service.

7. Retention and closure

We keep workspace data while the account is active. After confirmed workspace closure, the standard retention period is three months. Selected records can be exported during the first 30 days after confirmed closure. We keep a record longer only when a specific law requires a longer minimum period, or for the limited time needed to establish, exercise or defend legal claims. We delete or irreversibly anonymise data when the applicable period ends.

Requesting subscription cancellation, workspace closure and erasure are separate actions. A closure request begins identity and scope checks and does not itself cancel billing or immediately delete data. You may request erasure sooner, but we may retain the minimum data and period required by law.

8. Your rights

Depending on the circumstances, UK data-protection law gives you rights of access, correction, erasure, restriction, portability, objection and withdrawal of consent. Where your organisation controls workspace content, contact it first; we will assist it as processor. For data controlled by Stripout London Ltd, email hello@site-hq.ai. We normally respond within one month.

You may complain to the Information Commissioner's Office at ico.org.uk.

9. Cookies

SiteHQ uses cookies and similar storage needed for authentication, security and the choices required to operate the service. Any non-essential analytics or marketing technology must be separately disclosed and, where required, enabled only after consent.

10. Versions and contact

SiteHQ records the privacy-policy version accepted during onboarding. Each published change will have a version and effective date. We will provide notice, and request renewed acceptance where required, before a material change applies to the affected processing.

Privacy and data-rights enquiries: hello@site-hq.ai or SiteHQ support.