What we do with your information.

Who we are

SubbyFlow is operated by [TO SUPPLY: registered company name], registered in England and Wales, company number [TO SUPPLY: company number], registered office [TO SUPPLY: registered address]. We are registered with the Information Commissioner's Office under [TO SUPPLY: ICO registration number].

For anything on this page, write to [TO SUPPLY: privacy contact email].

Who is responsible for what

This matters more here than on most sites, because two different relationships run through the same product.

When you visit this site or join the waitlist, we decide what is collected and why. We are the controller.

When a contractor uses SubbyFlow to manage their subcontractors, that contractor decides who is invited, which documents are required and what the vetting decision is. They are the controller and we are their processor, acting on their instructions. If you are a subcontractor and you want your record corrected or removed, the contractor who invited you is the right first contact — though you can write to us and we will make sure it reaches them.

Visitors to this site

Measurement only, and only with your agreement. The cookies page lists each tool, what it stores and what happens if you decline. Nothing runs until you answer the banner.

The waitlist

If you ask for access we store your name, your email address, and which call to action you came through so we know which page is working. We also record the exact wording you agreed to, the version of that wording, the time, your IP address and your browser's user agent.

That last part is deliberate. If you ever ask why we emailed you, the honest answer has to be the precise sentence you saw and when — not a general claim that a form was submitted. The wording is written from the server rather than accepted from your browser, because consent evidence the sender can set is not evidence.

Lawful basis: consent. You can withdraw it at any time using the unsubscribe link on any email we send, or by writing to the address above. Withdrawing does not affect anything done before you withdrew.

Subcontractors

A subcontractor invited onto a contractor's register is asked for what that register needs. Depending on the trade and the contractor's own requirements, that can include:

• Name, company name, email address and phone number
• Registered office address, company number, VAT number, UTR, CIS status and National Insurance number
• Bank account details, for payment
• The trades you cover and the area you are willing to work in
• Uploaded documents and certificates — insurances, competency cards, accreditations — and their expiry dates

There is no account and no password. You reach the form through a one-time link addressed to you, which expires. That is a design decision rather than a shortcut: the fewer credentials exist, the fewer there are to lose.

Lawful basis:the contractor's legitimate interest in knowing who works on their sites, and in most cases their legal obligations around health and safety and tax. We process it only to provide the service to them.

Staff using the portal

Named users at a contractor get an account: name, work email, role, and the permissions set for them. Authentication is handled by Clerk. Where a contractor has switched them on, we also record sign-in country and device, so that access from an unexpected place can alert their administrators.

How it is held

• Documents sit in private storage. Opening one creates a link that only works for the person who opened it and stops working after a few minutes. Nothing is on a public address.
• Access is set per role and per personacross ten areas of the product, each at edit, view or hidden — so a contractor's finance people can own bank and tax details without their site team ever seeing them. It is enforced on the server, not hidden on screen.
• Changes are recorded. Every status change, upload, permission change, rating override and bank edit is written down with who did it and when.
• Sign-in can be restrictedto one device and to a single country, at the contractor's option.

Who else processes it

We use a small number of suppliers, each under a data processing agreement. None of them use the data for their own purposes.

Clerk

Staff authentication and session management.

Supabase

Database, and private storage for uploaded documents.

Resend

Sending email — invitations, reminders and notifications.

Vercel

Hosting and content delivery.

Google, Microsoft and PostHog

Measurement on this public page only, and only with consent. See the cookies page.

[TO SUPPLY: confirm this list is complete and a DPA is signed with each, and state whether any processing happens outside the UK or EEA and under what transfer mechanism.]

How long we keep it

Waitlist records are kept until you unsubscribe or ask us to remove them. Subcontractor records are kept for as long as the contractor whose register they sit on needs them, and are deleted or returned when that contractor's account ends. Audit records outlive the record they describe, because an audit trail that can be thinned out is not an audit trail.

[TO SUPPLY: specific retention periods for each category.]

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to how we are using it, ask us to restrict it, or ask for it in a portable form. Where we rely on your consent, you can withdraw it at any time.

Write to [TO SUPPLY: privacy contact email]. If you are on a contractor's register, see “Who is responsible for what” above.

If we do not resolve something to your satisfaction you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would rather you came to us first.

Changes to this notice

The date at the top says when this was last revised. If something material changes we will say so, rather than quietly amend it.