Privacy notice
What we collect, why, who it goes to and how long we keep it — for this website, the Squareaway web app and the engineer phone app.
- Who we are
- Your employer and us
- What we collect
- The phone app
- Why we use it
- Who we share it with
- How long we keep it
- Your rights
Who we are
Squareaway is run by Squareaway App Ltd, a company registered in England and Wales, number 17507384, part of the CME Group Holdings group. Registered office: 128 City Road, London, EC1V 2NX. ICO registration number: ZC271513.
Contact us about anything on this page at help@squareaway.uk.
Your employer and us
Squareaway is used by companies (our customers) to run their work. That gives us two different roles, and it matters which one applies to your information:
- Your employer is in charge of the work records. If you use Squareaway because your company does, the jobs, certificates, timesheets, photos and checks you record belong to your company. Your company is the controller of that information and decides what is recorded and how long it is kept. We are its processor: we store and handle it only to run Squareaway for them, under a written data processing agreement. Questions about those records go to your employer first — we will help them answer.
- We are in charge of our own information. For people who visit this website, ask for a demo, contact support, or hold a Squareaway login, Squareaway App Ltd is the controller of the information needed to run the website, the login and our relationship with our customers.
What we collect
This website
- If you ask for a demo: your name, company, email, phone number and message. The form emails them to us; it does not add you to a mailing list.
- Your light or dark theme choice, kept in your own browser. We use no cookies, no analytics and no advertising trackers on this site.
- Fonts are loaded from Google Fonts, so Google receives your IP address when the page loads.
Your Squareaway login
- Your name, email address, job title and, if you or your company add them, your phone number, skills and home postcode (used by your company to plan routes to jobs).
- Records of signing in, which we keep for security.
- Anything you send us through support.
Work records (held for your employer)
Depending on what your company uses: jobs and visits, notes and photos, certificates and signatures, risk assessments and briefings you sign, van checks, fuel receipts and expenses, timesheets, health and safety reports, training records and — for rail work — hours worked and fatigue scores.
The phone app
- Camera and photos. Only the photographs you choose to take or attach, which go to the job, certificate or receipt you are working on.
- Location. Only at the moment you save a job photo or a pre-start check, to record where it was done. The app never tracks your location in the background.
- Notifications. A notification token from Apple or Google, so we can tell you when a job is booked, moved or cancelled. You can switch these off in the app or in your phone's settings.
- Face ID and fingerprint. Handled entirely by your phone. We never receive your face or fingerprint data — your phone only tells the app whether the check passed.
- Working offline. Work you record without signal is kept on your phone until it can upload, then sent to Squareaway.
Why we use it, and our lawful basis
| What for | Lawful basis (UK GDPR) |
|---|---|
| Providing Squareaway to the companies that pay for it, including your login | Contract with our customer, and our legitimate interest in providing the service they have asked for |
| Work records held for your employer | Your employer's basis; we act on their instructions |
| Keeping Squareaway secure and working, and answering support requests | Legitimate interests |
| Replying to a demo request | Legitimate interests (you asked us to) |
| Accounting and tax records about our customers | Legal obligation |
We do not sell personal information, we do not use it for advertising, and we do not make decisions about you by automated means that have legal or similarly significant effects.
Who we share it with
Only the service providers that run Squareaway for us, each under a contract that limits what they may do with it:
| Provider | What they do |
|---|---|
| Supabase | Database, file storage and sign-in, hosted in the UK (London) |
| Vercel | Hosts the website and web app |
| Resend | Sends Squareaway's emails |
| Anthropic | Runs the AI features. Text and documents are sent only when someone asks the AI to read or draft something. Under Anthropic's commercial terms they are not used to train its models. |
| Apple and Google | Deliver notifications to the phone app |
Your company can also connect other services, and only then does information go to them: Microsoft 365 (Outlook and OneDrive), Xero, BrightHR, a text message provider, a postcode look-up service and the DVLA vehicle enquiry service. Your employer decides whether these are switched on.
Some of these providers are based in, or have staff in, the United States. Where information leaves the UK it is protected by the UK's approved safeguards — the UK Extension to the EU–US Data Privacy Framework or the International Data Transfer Addendum.
We would also disclose information if the law required it, or to a buyer if Squareaway were ever sold, in which case this notice would continue to apply.
How long we keep it
- Your login — while your company uses Squareaway and you are one of its users. When you delete your account, your login and profile are deleted straight away.
- Work records — for as long as your employer keeps them. Many are legal or accreditation records (certificates, safety checks, hours worked) that a company must keep for years, so deleting your login does not delete them; they stay with the company, with your name on them as the person who did the work.
- When a company leaves Squareaway — its records are returned to it on request and then deleted.
- Demo requests — up to 24 months, unless you become a customer.
- Backups — copies roll off on a regular cycle, so deleted information is gone from backups within 30 days.
Your rights
Under UK data protection law you can ask for a copy of your information, ask us to correct or delete it, ask us to limit or stop using it, and ask for it in a portable format. To use these rights, email help@squareaway.uk. For work records your employer holds, ask them — or ask us and we will pass your request on and help them deal with it. We reply within one month.
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
Security
Everything travels over encrypted connections. Each company's information is kept separate from every other company's, and people only see what their role allows. The phone app can be locked with Face ID or a fingerprint. No system is perfectly secure; if something goes wrong that affects your information we will tell the affected company, and the ICO where the law requires, promptly.
Children
Squareaway is a work tool for businesses and is not meant for anyone under 16.
Changes to this notice
If we change how we handle personal information we will update this page and the date at the top, and tell our customers about anything significant.