This Privacy Policy explains how spanSense collects, uses, shares, and protects personal data when you use the spanSense platform and the spanSense Field companion app.
spanSense Ltd · Registered in England and Wales, company no. 17464577 · Registered office: 8 Howard Street, Reading, RG1 7XS
1.1This Privacy Policy applies to personal data processed by spanSense in connection with the spanSense web application and the spanSense Field companion app (together, the "Service"). It should be read alongside our Terms & Conditions.
1.2We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.
2.1The data controller for personal data processed through the Service is spanSense Ltd (company number 17464577), trading as spanSense, whose registered office is at 8 Howard Street, Reading, RG1 7XS ("spanSense", "we", "us").
2.2You can contact us about privacy matters at [email protected].
3.1We collect the following categories of personal data:
| Category | Examples |
|---|---|
| Account data | Name, email address, role, organisation, password (stored as a salted hash) |
| Usage data | Login activity, actions taken within the Service, device and browser information |
| Inspection-related data | Inspector names recorded against inspections; site photographs, which may incidentally include images of people or vehicles present at a site |
| Communications | Messages sent to us via the Contact Us form or support email |
3.2Structure and defect data (bridge condition scores, span details, BCI values, and similar) is not, in itself, personal data, unless it is combined with information that identifies a specific individual.
4.1We collect data you provide directly (for example, when registering an account or logging an inspection), and data collected automatically through your use of the Service (for example, login timestamps).
| Purpose | Legal basis |
|---|---|
| Providing and maintaining the Service, including your account and inspection records | Performance of a contract with you or your organisation |
| Responding to support requests and messages sent via Contact Us | Legitimate interests (supporting our users) |
| Monitoring for misuse, and maintaining the security of the Service | Legitimate interests / legal obligation |
| Improving the Service (e.g. understanding which features are used) | Legitimate interests |
| Complying with legal or regulatory obligations | Legal obligation |
6.1Most data recorded within the Service (structures, defects, spans, BCI scores) describes physical infrastructure rather than individuals. Where personal data does appear — for example, an inspector's name against a record, or a person incidentally visible in a site photograph — the Customer submitting that data is responsible for ensuring it has a lawful basis to do so and, where applicable, for informing the individuals concerned.
7.1We do not sell personal data. We share personal data only with the service providers who host and support the Service on our behalf ("sub-processors"), under contractual terms that require them to protect it, and only to the extent necessary to provide the Service.
| Sub-processor | Purpose |
|---|---|
| Render | Application hosting |
| Supabase | Our PostgreSQL database, and secure storage of uploaded photographs and files |
| Google (Gemini API) | AI-assisted extraction of structured data from uploaded inspection documents and drafting of conclusion text; document contents and inspector-entered comments are sent to this API for processing |
| CARTO / OpenStreetMap | Map tile imagery for the structure-location map; tile requests carry the requesting device's IP address |
7.2We may also disclose personal data where required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (in which case we will take reasonable steps to ensure your data continues to be protected).
8.1Our sub-processors may store or process data outside the UK. Where this occurs, we take reasonable steps to ensure appropriate safeguards are in place, such as relying on providers' standard contractual clauses or adequacy arrangements recognised under UK data protection law.
9.1We retain personal data for as long as your account is active and the data is needed to provide the Service, and afterwards for a reasonable period to comply with legal obligations, resolve disputes, and enforce our agreements.
9.2On request, or on termination of an account, we will delete or anonymise personal data we no longer need to retain, subject to any legal retention requirements.
10.1We use technical and organisational measures appropriate to the risk to protect personal data, including:
10.2No method of transmission or storage is completely secure, and we cannot guarantee absolute security. A fuller data security policy, covering our practices in more detail, is in preparation.
11.1The Service uses essential cookies/local storage strictly necessary to keep you signed in and to remember preferences such as dark mode. We do not currently use non-essential analytics or advertising cookies.
12.1Subject to applicable law, you have the right to:
12.2To exercise any of these rights, contact us at [email protected]. Where your account is managed by an organisation (your employer), some requests may need to be made through that organisation as the relevant data controller for its own records.
13.1The Service is intended for use by professionals in the course of their work and is not directed at, or intended for use by, children.
14.1We may update this Privacy Policy from time to time. Material changes will be notified via email or an in-app notice before they take effect.
15.1For any questions about this Privacy Policy or how we handle personal data, contact [email protected].