Privacy Policy

• Account data — name, email, phone, company details, VAT status, password (stored as a secure hash by our authentication provider).
• Business content — everything your organisation puts into the platform: customer records, quotes, sales orders, invoices, job details, notes, documents and photos.
• Photos and AI inputs — property photos uploaded for quotes, job records or AI visualisation. Photos submitted to the visualiser are sent to our AI provider to generate the render.
• Free visualiser trial — if you use the free trial at /try, the details you give at signup and the driveway photos and renders on your account are held by us as controller (no organisation is involved). Trial renders normally carry a visible watermark.
• Location data — if your organisation uses crew clock-in or site photo capture, GPS coordinates are recorded at the moment of clock-in/out or photo capture. This is visible to your organisation’s managers for workforce and job records.
• E-signature records — when a document is signed electronically we record the signature image, typed name, timestamp and IP address, as evidence of execution.
• Billing data — subscription status and invoices. Card details are collected and stored by Stripe, not by us.
• Technical data — authentication cookies, log data and basic device information needed to run and secure the Service.

• To provide the Service you signed up for — contract performance.
• To take payment and manage subscriptions — contract performance and legal obligation.
• To secure the platform, prevent abuse and keep audit records (e.g. signature IP logs) — legitimate interests.
• To send service messages (receipts, security notices, product changes) — contract performance; marketing is only ever sent with consent and can be stopped any time.
• To comply with law (tax, accounting, lawful requests) — legal obligation.

We do not sell personal data, and we do not use your organisation's customer data to train AI models.

We use a small number of service providers to run the platform:

• Supabase — database, authentication and file storage.
• Vercel — application hosting.
• Stripe — subscription payments.
• Resend — transactional email delivery (EU region).
• OpenRouter — AI processing for visualisations and drafted text (photos/text you submit to AI features are processed to produce the output).
• Google — calendar sync, only where your organisation connects a Google account.
• Optional integrations — Monday.com, GoHighLevel, Xero, Twilio/Vapi (call handling): data flows to these only if your organisation connects them.

We may also disclose data where the law requires it. Some providers process data outside the UK; where they do, transfers are protected by UK adequacy decisions or the UK International Data Transfer Agreement / Addendum (standard contractual clauses).

If your organisation connects a Google account, we request the Google Calendar events scope (calendar.events). This section explains exactly what we do with that access.

• What we access — beyond basic Google account identity (the connected account's email address, used to identify and display the connection), only calendar events. We do not request Gmail, Drive, Contacts or any other Google scope, and we use the events-only scope rather than full calendar access because we never need to create, delete or change the settings of a calendar itself.
• Writing — when you create, reschedule or cancel an appointment in the platform, we create, update or cancel the matching event on your connected Google calendar.
• Reading — to detect changes made directly in Google Calendar, we retrieve changed events from the connected calendar and match them against the event IDs we recorded when we created them. Events that do not match — anything the platform did not create — are discarded immediately: they are never imported, stored, displayed or acted on.
• What we store — the connected account's email address, the calendar identifier, access and refresh tokens, a synchronisation cursor, and the Google event ID of each appointment we created. The tokens carry an additional layer of AES-256-GCM encryption under a per-connection key and are readable only by our server — never by the browser, and never by other organisations.
• What we never do — we do not sell Google user data; we do not transfer it to advertisers, data brokers or any other third party for their own purposes; we do not use it for credit or lending decisions; and we do not use it to train AI models. No D4 staff member reads it except with your explicit permission for a support issue, where necessary for security or to comply with the law, or in aggregated, anonymised form.
• Disconnecting — disconnect at any time from Settings → Integrations. We ask Google to revoke the tokens, and immediately disable the connection and destroy the stored tokens and their encryption key in our active systems; backup copies roll off automatically on the storage provider's schedule (see Retention). You can also revoke the platform's access yourself from your Google account's permissions page (myaccount.google.com/permissions).

Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

• Every organisation’s data is isolated with database row-level security — one organisation can never read another’s records.
• Data is encrypted in transit (TLS) and at rest; especially sensitive fields (e.g. subcontractor bank details and tax numbers) carry an additional layer of AES-256-GCM encryption.
• Files are stored in private buckets and served through short-lived signed URLs.
• Access to production systems is limited to the small D4 team that operates the platform.

• Account and organisation data: kept while your account is active.
• After a subscription ends, organisation data is retained for 90 days so it can be exported, then deleted in the ordinary course.
• Free visualiser trial photos and renders: kept for a maximum of 30 days.
• Signed contracts, invoices and billing records: kept for up to 6 years to meet legal and accounting obligations.
• Backups roll off automatically on the storage provider’s schedule.
• Inbound call-notification emails (Call Email Bridge): the original email body is deleted within 30 days of receipt; the reviewed call summary remains part of your organisation's CRM records until you delete it or your subscription data is removed.

Under UK GDPR you can ask for access to your personal data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interests. Email support@d4digitalos.com and we will respond within one month. If you are a customer of one of the contractors using the platform, the contractor is the controller of your data — contact them first, and we will help them fulfil your request. You can also complain to the Information Commissioner's Office (ico.org.uk).

The platform sets only essential cookies: authentication/session cookies from our auth provider so you stay signed in. We do not run third-party advertising or tracking cookies.

We will post any changes to this policy here and, for material changes, notify account holders by email or in-app. Data protection contact: support@d4digitalos.com, marked "Privacy".