Privacy policy
PinMap is operated by Alex Hewitt trading as AH AI Automation, a sole trader established in the United Kingdom ("we", "us"). Contact: [email protected]. Postal address: available on request by email.
1. Who this covers
PinMap is a business tool. Two groups of people are covered:
- Account holders and crews: people whose employer or contractor (the "Customer company") has set them up in PinMap. For your day-to-day work data, the Customer company decides why and how it is used. It is the controller and we process that data on its instructions (see section 7). Ask your office first about anything on your own record.
- Prospective and paying customers: the people who email us, create a company, and pay. For that data we are the controller.
2. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Name, work email, role, company | Typed in at sign-up or added by your office | To run your account and control who sees which job (contract; legitimate interests) |
| Phone number | Asked for when you create a company or join one from an invite link. People who already had an account are asked once in the app and can say Not now. | So your company's office and managers can ring you about the job when you are on site, and so we can reach the person who runs the account about the service (your company's legitimate interests as your employer or main contractor, or your contract with them; for the account holder, our contract with you). Shown next to your email on your company's Operatives page. Seen only by you, your company's office and managers, and PinMap support; other crew cannot see it. Not used for text messages, login codes or marketing, and not passed to anyone outside the providers in section 4. Kept with your company's records (section 5). |
| Password | Chosen by you | Stored only as a salted hash by our authentication provider. We never see it. |
| Job records: pins, photos, notes, mark-ups, QA checks, RFIs, variations, orders, drawings | Created by the crew on site | The work itself. Photos may show people; please avoid photographing people where you can. |
| Clock in and Clock out: time, one photo (phones only) and one GPS position when you tap Clock in or Clock out, plus which job site circle it matched (PinClock only) | Your phone, at the moment you tap, and only if your company has PinClock switched on | Time sheets and confirming you were at the job site (your company's legitimate interests as employer, or your contract with them). Seen by your company's managers and office only. Kept while your company's account is open, like other job records. |
| Site checks (optional, set by your company): while you are clocked in, PinMap is open on your screen, and the time is inside your company's contracted-hours window, the app compares your position to the job site circle every 15, 30 or 60 minutes (your company picks). Only a check that finds you OFF site is stored, as a flag with the distance from site. Checks that find you on site are not kept as positions. | Your phone, only in those conditions. No check runs when you are clocked out, when PinMap is not open, or outside the window, even if you are still clocked in. | Confirming attendance at the site during working hours. Seen by your company's managers and office only. A check that finds you away from site also alerts your office and the managers on that job inside PinMap, writes one line in your company's activity log (the time, the site and roughly how far away you were; never your coordinates), and sends them one email per shift saying the same thing, with no map. Your office can set a quiet time each day in which that email is not sent, or switch the email off altogether; the check, the log line and the in-app alert still happen then. Off-site flags, and the activity log line and alert that go with them, are deleted automatically after 90 days. |
| Live tracking mode (optional, set by your company, app-store app only): while you are clocked in and inside the contracted-hours window, your phone holds one circle around the job site and reports to PinMap only when you leave or re-enter that circle, with one position at that moment. In this mode there is no route, breadcrumb trail or periodic recording; the only periodic feature is the live location map below, which is separate and needs your agreement. | Your phone, using a one-shift secret that stops working the moment you clock out, the window ends, your company turns the mode off, or an automatic clock-out runs. Our server refuses any report outside those conditions and tells the phone to remove the circle. You can refuse or withdraw "Allow all the time" location permission in your phone settings at any time; the app then falls back to the clock in, clock out and site check behaviour above. | Site attendance for companies that need it. Seen by your company's managers and office only. Leaving the circle alerts your office and the managers on that job, is written to your company's activity log and can be emailed to them, in exactly the way described for site checks above. Leave and re-enter events, and the log line and alert that go with them, are kept for 90 days, then deleted automatically. |
| Live location map (optional, set by your company, and only with your agreement): while you are clocked in, PinMap is open on your screen, the time is inside your company's contracted-hours window, and you have agreed in the app, your phone sends its position every 5, 10 or 15 minutes (your company picks). Each new position replaces the last, so PinMap holds at most one position for you at a time, with its time and how accurate it was. No route or history is stored. The position is deleted when you clock out, when an automatic clock-out closes your shift, or when the window ends. | Your phone, only in those conditions. In a browser or the home-screen version, only while PinMap is open on your screen. In the PinMap app from the App Store or Google Play, your company can also allow sending to continue while the app is in the background (phone locked or another app open), and this needs a second, separate agreement from you in the app; if you say Not now to that, the map works only while PinMap is on your screen, as before. While background sending is running, iPhone shows the location indicator and Android shows a PinMap notification the whole time, and the position is read in a lower-power mode that is accurate to roughly 100 metres. Each send uses a one-shift code issued to the app when you clock in, which stops working the moment your shift ends, the window closes, you switch off, or your company turns the map or background sending off; our server refuses any send outside those conditions. Nothing is sent when you are clocked out, outside the window, if you have said Not now, or after you switch the map or background sending off in Profile. If you have turned off precise location for PinMap in your phone settings, the position is approximate. | So your office can see which site each clocked-in worker is on right now, for site attendance, safety (knowing who is where if something goes wrong) and coordinating work between sites. Your company's lawful basis is its legitimate interests as your employer, and your agreement in the app is a safeguard on top of that: the map is your choice, saying no has no effect on your work, and you can change your mind at any time. Seen by your company's office and by the managers your office has chosen to show it to; other managers and crew cannot see it. Because the map is live, a person watching it can see you move between positions during your shift, even though PinMap keeps only the latest one. Deleted at the end of each shift. |
| Email sign-off text, order text you type | Typed by you | Sent to your wholesaler in quote emails (Orders module only) |
| Technical logs: IP address, browser type, timestamps, errors | Automatic | Security and keeping the service running (legitimate interests). Kept short-term by our hosting and database providers. |
| Billing contact and invoices | From the person who pays | Getting paid and tax records (contract; legal obligation) |
When PinMap can and cannot see where you are
When you are not clocked in, PinMap collects no location at all and there is nothing in the product that lets your office request or see where you are. While you are clocked in and inside your company's contracted-hours window, PinMap can know where you are in up to four ways, and your company chooses which are on: one position when you tap Clock in and one when you tap Clock out (always, if PinClock is on); off-site flags from site checks; leave and re-enter events from live tracking; and, only if you have agreed to it, your current position on the live location map, refreshed every few minutes while PinMap is open on your screen or, in the PinMap app from the App Store or Google Play and only if you have separately agreed to it, while the app is in the background with your phone's location indicator or a PinMap notification showing. The map is the only one of these that lets your office see where you are right now, and only the office and the managers it has chosen can see it. If a site check or live tracking finds you away from site, your office and the managers on that job are told in the app and by one email per shift, with the distance but no map. PinMap keeps just your latest map position and deletes it when your shift ends; it never stores a route. Be aware, though, that someone watching the map during your shift can see your dot move. Clocking out switches everything off on the spot. Outside the contracted-hours window nothing runs and nothing is sent, even if you forgot to clock out, and an automatic clock-out ends a shift that has been left open. The clock screen shows a status chip whenever site checks, live tracking or the live location map are on, so you always know. You can say Not now to the map, and separately to background sending, and still clock in; you can switch either on or off at any time under Profile. Your company sets the hours window, the check and map intervals and which managers see the map, not PinMap. If the hours shown do not match your contract, tell your office.
We do not collect anything for advertising. There is no ad tracking, no analytics tags and no profiling on this website or in the app. We do not send text messages and we do not use your phone number to sign you in.
3. How we use it
- To provide PinMap to your company and keep it secure.
- To show your phone number to your company's office and managers on the Operatives page so they can ring you, and to contact the person who runs your company's account about support, billing or changes to the service.
- To show your company's office, and the managers it chooses, the live location map of clocked-in workers who have agreed to it, inside the limits described in section 2.
- To tell your company's office and the managers on your job, in the app and by email, when a site check or live tracking finds you away from site, inside the limits in section 2.
- To send emails you or your office ask us to send: quote requests to your wholesaler, SI notices to your office, RFI drafts. Wholesaler quote emails carry the name and email address of the person who raised the order so replies reach them.
- To read wholesaler quote emails and order text with an AI model so lines and prices can be matched automatically (Orders module). Only the order text and the quote are sent; not your login details.
- To give you support and keep the service working, which can include our administrator opening your company's records, as described under "Administrator access" in section 8.
- To answer support requests and tell you about changes to the service. We do not send marketing email unless you have asked for it, and you can stop it at any time.
4. Who we share it with (our processors)
| Provider | What they do | Where |
|---|---|---|
| Supabase, Inc. | Database, file storage, login. All customer data is stored in the London (eu-west-2) region. | UK data centre; US company |
| Higgsfield | Serves the app's code files (delivered through Cloudflare's network) | No customer data is stored there. Accounts, pins, photos and drawings live in Supabase (London); the app in your browser talks to Supabase directly. |
| Anthropic, PBC | AI reading of order lists and wholesaler quotes (Orders module only) | USA. Data submitted through the API is not used to train their models. |
| Zapier, Inc. | Sends and receives the Orders module's emails through the Customer company's own Gmail account | USA |
| Resend, Inc. | Sends PinMap's own emails: invites, notices to your office and the PinClock away-from-site email (the worker's name, the site, the time and the distance; no coordinates) | USA. Emails are held by Resend only for delivery and logging. |
| Google (Gmail) | The mailbox the Customer company uses for orders | Customer's own account |
| Cloudflare (cdnjs), jsDelivr, unpkg | Serve the app's script libraries. They see your IP address when the app loads. | Global CDNs |
| OpenStreetMap, Esri | Map tiles for PinClock job sites and the live location map. They see the viewer's IP address and the map area viewed; they do not receive worker names or the positions themselves, but a map centred on a worker reveals that area. | Global |
Transfers outside the UK rely on the UK International Data Transfer Addendum or the provider's UK-approved terms. We do not sell personal data.
5. How long we keep it
- Job records: for as long as your company's account is open. Construction records are often needed for years afterwards, so deletion is your office's decision, not automatic.
- When a company account closes: the office can export its data first. We delete the company's data 30 days after closure unless the law requires us to keep it longer.
- Your phone number: kept while you are on the company. If the company removes you, the number stays in the company's records until the office deletes it or the company account closes (then deleted with the rest of the company's data, 30 days after closure). It is deleted when you delete your own account.
- A self-serve company that is never activated is deleted automatically 48 hours after sign-up.
- PinClock off-site flags and leave/re-enter events, the matching line in your company's activity log and the in-app alert: 90 days, then deleted automatically. The one email per shift sent to your office and managers stays in their mailboxes under your company's own retention rules; it contains no coordinates. Live location map: only the latest position of a current shift is held, and it is deleted when the shift ends (clock-out, automatic clock-out or the end of the contracted-hours window); it is not kept in any report or export. Deleted data can remain in our database provider's encrypted backups for up to 7 days before those expire. Clock-in and clock-out records (time, photo, position) stay with the company's job records.
- Logs: up to 90 days.
- Invoices and tax records: 6 years.
6. Your rights
Under UK GDPR you can ask for a copy of your data, ask for it to be corrected or deleted, object to or restrict processing, and ask for it in a portable format. You can change your phone number yourself at any time under Profile; to have it removed, ask your office (or email us if you run the account). If your data is held for a Customer company, contact your office first, since they control it; we will help them respond. Otherwise email [email protected]. We respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
7. For Customer companies: your responsibilities
Your company is the controller of your crew's data. That means you must tell your staff what PinMap records about them, especially the PinClock clock-in photo and position, site checks, live tracking and the live location map, and have a lawful basis for it (usually your legitimate interests as their employer, backed by a written legitimate interests assessment, or the employment contract; consent is rarely a sound basis at work because staff may not feel free to refuse). You set the contracted-hours window, the check and map intervals, the distance allowed from the clock-in spot when a site is not recognised, the daily quiet time for away-from-site emails (or whether those emails are sent at all), whether site checks, live tracking or the live location map are on, and which managers can see the map; you are responsible for those settings matching your workers' actual contracted or working hours and for keeping them up to date when hours change. Away-from-site alerts and emails go to your office and to the managers on that job: make sure those are work mailboxes, tell your staff that the alerts exist, and treat an alert as a prompt to ask, not as proof; phone positions can be tens of metres out, especially indoors. Before switching on live tracking or the live location map you must carry out a data protection impact assessment (the ICO requires one for tracking the location of workers; a template is available in the app and from us), tell your staff in writing, and consult staff or their representatives where required. A worker who declines the map or switches it off must suffer no detriment, and you must not ask them to turn it back on as a condition of work. If you turn on background sending for the PinMap app, you must review your impact assessment for it first, tell your staff in writing before it starts, and remember that it runs on your workers' own phones: a worker who declines it or switches it off, including on breaks, because of battery or data cost must likewise suffer no detriment. The ICO's guidance on monitoring workers applies. Location data must be used only for the purposes described here: attendance and time sheets, and, for the live location map, safety and coordinating work between sites. It must not be used to monitor performance, speed, breaks or anything outside those purposes. Your crew's phone numbers are shown to your office and managers so they can be rung about work. Use them for that; do not add them to marketing lists or pass them to third parties without a separate lawful basis. Our data processing terms set out what we do on your behalf.
8. Security
Data is encrypted in transit (HTTPS) and at rest. Each company's data is separated by database-level access rules, so a member of one company cannot read another's. Phone numbers are held in a separate table with their own access rules, so only the person, their company's office and managers, and PinMap support can read them. Photos and drawings are only reachable through short-lived signed links. Only approved email addresses can sign in.
Administrator access. PinMap's administrator (the operator named above) has an administrator account that can open any Customer company. We use it only to provide and support the service: to answer a support request, to find and fix a fault, to carry out maintenance or a migration you ask for, and to keep the service secure. We do not browse customer data for any other reason, and we do not use it for marketing, demonstrations or training. Anyone we authorise to use administrator access is bound by confidentiality. Administrator access does not appear in your team lists, and changes an administrator makes inside your company while acting as administrator are recorded as "PinMap support". If you want to know whether we have accessed your company, ask us and we will tell you what we can.
9. Children
PinMap is for people at work. You must be 16 or over to have an account.
10. Changes
We will post changes here and, if they matter, email the office admin of each company.