Privacy policy

Last updated: «DATE»

Who we are

RiskPass is a trading name of «FULL NAME», «TRADING ADDRESS». We are the data controller for the information described here. Contact: «CONTACT EMAIL».

What we collect

When you use RiskPass we collect the trade and job type you select, your answers about the job (such as how many people are working, whether you are working alone and, if you are, the name and phone number of the person you check in with, and how old the building is), the job description you write and any questions about the job you answer, the site address and postcode, your company name, the name of the person preparing the document, a contact telephone number, and your email address. We also record a hashed form of your IP address, and the date and time of your request.

We record when key steps happen — a form opened, a form sent, a document written, a document unlocked, a document downloaded — against a randomly generated identifier that exists only in your browser's memory while the page is open. Nothing is stored on your device for this, and the identifier is gone when you close the page. We use it to see where people get stuck, not to identify you.

We do not collect card details. Stripe handles payment and we never see your card number.

Why we collect it

The job details and site information are used to generate your document and appear in it. Your email address is used to deliver the document and to contact you about your order. The hashed IP address is used only to prevent abuse of the free preview; we cannot recover the original address from it.

Our legal basis is performance of a contract with you, and our legitimate interest in preventing abuse of the service.

Who we share it with

We use the following processors:

• Supabase: database hosting, in the UK (London)
• Stripe: payment processing
• Resend: email delivery
• Anthropic: document generation. Your job details are sent to the Anthropic API. They are not used to train models.
• Vercel: website hosting, and page-view counts (Vercel Analytics), which are aggregated and set no cookies
• postcodes.io: your site postcode is sent to postcodes.io to find its location so we can identify the nearest A&E department for the emergency section of your document. No other information is sent.

We do not sell your data or share it for marketing.

How long we keep it

Generated documents and their job details are kept for 12 months so you can retrieve a document you have paid for. Unpaid previews are deleted after 30 days. Payment records are kept for six years, as tax law requires.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to our processing. Email «CONTACT EMAIL» and we will respond within one month.

You can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

We use only cookies that are strictly necessary for the site and checkout to work. We do not use advertising or analytics cookies that require consent. If that changes, we will add a consent banner.