Privacy Notice
Last updated: 18 July 2026
This notice explains how we collect, use, share and protect personal information when you visit this website, contact us, or use the Site Chronicle application.
Who we are
Site Chronicle is a brand and trading style of Hardcastle Advisory Group L.L.C-FZ (“we”, “us” or “our”). We are responsible for personal information collected through the Site Chronicle website, including enquiries, demonstration requests, Evidence Health Check enquiries and pilot applications.
Where we process project information on behalf of a customer using the Site Chronicle application, the customer will generally act as controller and we will generally act as processor, subject to the applicable customer agreement.
You can contact us about privacy at hello@site-chronicle.com.
The personal information we process
- Website enquiries and lead data: when you submit a form (a demonstration request, an Evidence Health Check enquiry, a pilot application or an introduction), we collect your name, work email, phone number (if given), company name, your message and any referral code. A referral code records who made an introduction so we can attribute it.
- Account and user administration: for application users, name, email address, role and the organisation you belong to, plus authentication data needed to sign you in and administer accounts.
- Project data processed for customers: records your team enters into the application, which can include the names and hours of on-site workers, plant and materials, progress, delays, quality and safety entries, and photographs of the works (which may incidentally include people).
- Client sign-off data: where a diary is sent for client acknowledgement, the reviewer’s name, email address and, for on-site sign-off, a drawn signature image.
- Security and audit information: access logs and audit-trail records (such as who submitted, reopened or acknowledged a record and when), and technical data such as IP address, used to operate and secure the service.
- Support communications: the content of emails and support requests you send us, and our replies.
- Email notifications: recipient details and message content for the transactional and notification emails the service sends (for example invitations, acknowledgement requests and weekly summaries).
- Error monitoring: technical error reports and diagnostics generated when something goes wrong, used to identify and fix faults.
- AI-generated weekly summaries (optional): where a customer enables this feature, diary content is processed by our AI provider to generate a summary narrative.
- Billing information: where billing is enabled, billing contact details and subscription information, handled through our payment provider. We do not store card numbers.
Why we use it and our lawful basis
- Responding to your enquiry / providing a demo, Evidence Health Check or pilot: our legitimate interests, or steps taken at your request prior to entering a contract.
- Providing and supporting the application: performance of our contract with your organisation.
- Securing the service, keeping audit records and preventing abuse: our legitimate interests and our legal obligations.
- Billing and account administration: performance of our contract and our legal obligations.
- Meeting legal and regulatory obligations: compliance with a legal obligation.
We do not use the personal information in your site diaries for our own marketing, and we do not sell personal information.
Client acknowledgement is a record of receipt
Where a client reviews and acknowledges a diary, that acknowledgement is a record that they received and reviewed it. It does not, by itself, constitute contractual acceptance, and we make no representation about its legal effect between you and your client.
Who we share it with (subprocessors)
We use a small number of vetted service providers to run the service, for hosting, database and storage, email delivery, error monitoring, billing (where enabled) and, where enabled, AI-generated summaries. See the service providers list below for the current list. We may also disclose information where required by law.
International transfers
Our primary application database, authentication data and evidence-file storage are hosted in London, United Kingdom. Some service providers may process limited personal data outside the United Kingdom and European Economic Area. Where a restricted transfer occurs, we use an applicable lawful transfer mechanism, which may include adequacy regulations, the UK International Data Transfer Addendum, Standard Contractual Clauses or another applicable transfer mechanism. Further information is in the service providers list below.
How long we keep it
We keep lead and enquiry data for as long as needed to deal with your enquiry and for a reasonable period afterwards. Records you send us for an Evidence Health Check are used only for the review and deleted within 30 days of the review being delivered, unless you authorise continued retention; limited information may persist for longer in security logs and routine backups, which expire on their own cycle, and where retention is required by law. Application data is retained for the life of your organisation’s account and in line with the retention terms in our customer agreement; site-diary records are kept as contemporaneous evidence for as long as your organisation requires them. We delete or anonymise information when it is no longer needed.
Your rights
Depending on the data-protection law that applies to you, you may have the right to access, rectify, erase, restrict and object to the processing of your personal information, and to data portability. Where your information sits inside a customer organisation’s account, we will usually direct your request to that organisation. To exercise your rights, contact hello@site-chronicle.com.
Complaints
If you are unhappy with how we have handled your personal information, please contact us first at hello@site-chronicle.com so we can try to resolve it. You may also have the right to complain to a supervisory authority. In the United Kingdom, the Information Commissioner’s Office (ico.org.uk).
Service providers (subprocessors)
These are the third-party providers we rely on to deliver Site Chronicle. Some are used only where the relevant feature (billing, or AI-generated summaries) is enabled for your organisation.
| Provider | Purpose | When used | Processing location | Nature of data |
|---|---|---|---|---|
| Supabase | Database, authentication and evidence-file storage | Always used | Primary project region: London, United Kingdom | Account data, project and diary records, photographs and evidence files |
| Vercel | Application hosting, serverless compute and content delivery (including Vercel Web Analytics on the marketing site) | Always used | Global infrastructure; processing may occur outside the UK/EEA | Request data (such as IP address), form submissions in transit, aggregated analytics |
| Resend | Transactional and notification email delivery | Always used | Processing may occur outside the UK/EEA under applicable contractual safeguards | Recipient name and email address, email content (e.g. notifications and summaries) |
| Sentry | Application error monitoring and diagnostics | Always used | Region not fixed; processing may occur outside the UK/EEA under applicable contractual safeguards | Error reports and technical diagnostics generated when something goes wrong |
| Microsoft 365 | Inbound and business email (handling enquiries and support communications), and appointment scheduling (Microsoft Bookings) when you book a call | Always used | Region not fixed; depends on tenant configuration | The content of emails you send us and our replies; and, if you book a call, your name, email address, chosen time and any details you provide |
| Stripe | Subscription billing | Only where billing is enabled | Processing locations may vary internationally | Billing contact and payment details (handled by Stripe; we do not store card numbers) |
| Anthropic | Optional AI-generated weekly summary narratives | Only where the feature is enabled | Processing may occur outside the UK/EEA under applicable contractual safeguards | Diary content included in the summary being generated |
Some providers are used only where the relevant feature is enabled. Where a provider processes personal data outside the UK/EEA, we use the transfer mechanism applicable under that provider’s agreement and data-processing terms. We will update this list before adding or materially changing a provider.
Cookies and browser storage
The application uses strictly-necessary cookies to keep you signed in and to protect your session: authentication cookies, session cookies and security-related cookies (such as tokens that defend against request forgery). These are essential for the service to work, so they do not require consent; blocking them will stop the application from functioning. Where the application stores a preference (for example a display setting), that preference is held in your browser and used only to provide the feature.
The marketing website uses Vercel Web Analytics to understand, in aggregate, how the site is used (for example which pages are visited and which forms are started). It does not use cookies to track you across other sites. We do not set advertising cookies; if we introduce any optional advertising or tracking cookies in future, we will ask for your consent first and update this notice.
Offline application storage
The Site Chronicle application uses browser storage, including IndexedDB, to support offline working. This allows authorised users to create records and queue photographs while no connection is available, before synchronising them when connectivity returns. This storage is required to provide the offline feature and is not used for advertising. Unsynchronised records may remain on the relevant device until they are synchronised, cleared or removed as part of the application’s operation.
You can control or delete cookies through your browser settings. Note that removing the essential cookies will sign you out of the application, and clearing browser storage may remove offline records that have not yet synchronised.
Contact
Email hello@site-chronicle.com, or see our Contact page for postal details.
Changes
We may update this notice from time to time; the date above shows when it was last reviewed.