Onsite Companion — Privacy Policy

Last updated: June 2026

    Summary in plain English
    We collect the information you give us to run the service. We don't sell your data. Your job data belongs to you. We use a small number of trusted third-party services (Supabase, Stripe, Twilio) to deliver the product. You have the right to access, correct or delete your data at any time.
  

1. Who we are

Launchpad Studio Apps (sole trader, operated by Steve Lane) is the data controller for Onsite Companion. This means we are responsible for deciding how your personal data is used.

ICO Registration: [PENDING — to be added on registration]

2. What data we collect

Account data — when you sign up:

Your full name
Your company or trading name
Your email address
Your password (stored securely — we never see it in plain text)

Business data — data you enter while using the app:

Job details, estimates, quotes and invoices
Customer names, phone numbers and addresses
Business expenses, mileage logs and CIS payment records
Supplier invoice photos
Company details (name, address, VAT number, bank details) stored locally on your device

Payment data — when you subscribe:

Your card details are collected and stored securely by Stripe. We never see or store your full card number.
We receive a payment reference and your subscription status from Stripe.

Technical data — automatically collected:

We do not use cookies or tracking analytics. No browsing behaviour is recorded.

3. Why we collect it and our legal basis

Under UK GDPR we must have a lawful basis for processing your data. We rely on the following:

Contract — your account data, subscription data and business data are processed to provide the service you have signed up for.
Legitimate interests — we may contact you about service updates, maintenance or significant changes to Onsite Companion. You can opt out at any time.
Legal obligation — we may need to retain certain records to comply with tax or legal requirements.

4. Third-party services we use

We use the following trusted services to deliver Onsite Companion. Each acts as a data processor on our behalf and is bound by their own data protection agreements.

Service	Purpose	Data shared	Location
Supabase Privacy policy	Database and authentication	All account and business data	EU (Ireland)
Stripe Privacy policy	Payment processing	Name, email, card details, subscription status	EU / USA (Standard Contractual Clauses)
Twilio Privacy policy	SMS notifications to your customers	Customer phone numbers and message content	USA (Standard Contractual Clauses)
Netlify Privacy policy	Web hosting and serverless functions	Requests made to the app	USA (Standard Contractual Clauses)

We do not sell your data to any third party, and none of the above companies are permitted to use your data for their own marketing purposes.

5. Your customers' data

When you enter customer names, phone numbers and addresses into Onsite Companion, you are responsible for ensuring you have a legitimate reason to hold that information and that you handle it in line with UK GDPR. You are the data controller for your customers' data — we process it only on your behalf.

Customer phone numbers are used only to send SMS messages that you explicitly trigger (variation approvals, invoice reminders). We do not contact your customers for any other purpose.

6. How long we keep your data

Active accounts — data is kept for as long as your subscription is active.
Cancelled accounts — data is retained for 30 days after cancellation, then permanently deleted.
Payment records — Stripe retains payment records in line with their own policy and applicable financial regulations.

7. Your rights under UK GDPR

You have the following rights regarding your personal data:

Right of access — you can request a copy of the data we hold about you
Right to rectification — you can ask us to correct inaccurate data
Right to erasure — you can ask us to delete your data (subject to legal obligations)
Right to portability — you can request your data in a machine-readable format
Right to object — you can object to processing based on legitimate interests
Right to restrict processing — you can ask us to pause processing in certain circumstances

To exercise any of these rights, email us at stevelanestudios@gmail.com. We will respond within 30 days.

8. Security

Your data is stored in Supabase's EU-based infrastructure with Row Level Security enabled — meaning each user can only access their own data. Passwords are hashed and never stored in plain text. All connections use HTTPS encryption. Card details are handled entirely by Stripe and never pass through our servers.

9. Complaints

If you are unhappy with how we handle your data, please contact us first at stevelanestudios@gmail.com and we will do our best to resolve the issue. You also have the right to lodge a complaint with the UK's data protection authority:

Information Commissioner's Office (ICO)
ico.org.uk — 0303 123 1113

10. Changes to this policy

We may update this policy from time to time. We will notify you by email of any significant changes. The date at the top of this page shows when it was last updated.

Privacy questions? Email stevelanestudios@gmail.com