1. Who We Are

CLRD is operated by CLRD Technologies Ltd, a company registered in England and Wales (company number 16970508) with its registered office at 6B Wyndham Road, Poole, BH14 8SH, United Kingdom. We are the data controller for personal data we hold about you in connection with your CLRD account.

This policy explains how we collect, use, and protect your personal data when you use our service at clrd.app. For privacy questions, please contact us.

2. Data We Collect

We collect the following information:

• Account information — name, email address, phone number, job title, company details
• Installation data — site addresses, client details, equipment specifications, site location geometry (the property boundary and meter position drawn for the Site Boundary Map), and other information you enter to generate documentation
• Correspondence and files — DNO correspondence on your jobs (including attachments sent and received), files you upload (such as a company logo), the notes and files you hand over with a managed job request, messages exchanged with CLRD staff in CLRD Messages, and messages you send us via the contact form
• AI Assistant questions — the questions you type into the AI Assistant, and the answers given, kept as a conversation you can delete at any time, and deleted with your account
• Payment information — processed securely by Stripe; we do not store card details. We keep a record of the invoices and payments Stripe has taken for your account (amounts, dates and what each was for)
• Usage data — server logs including IP addresses, browser type, and pages visited; and, on our public pages only and only if you accept analytics cookies, the page views described in section 12
• Signatures — electronic signatures captured for inclusion in generated documents, including signatures of clients and commissioning engineers collected via signing links

3. How We Use Your Data

We use your data to:

• Provide and operate the Service, including generating compliance documentation and the AI features described in section 9
• Verify and approve new accounts
• Manage your account and process payments
• Send transactional emails (verification, password resets, document notifications)
• Respond to support requests
• Maintain security and prevent fraud

We do not sell your data or use it for advertising.

4. Legal Basis for Processing

We process your data under the following legal bases (UK GDPR):

• Contract — to provide the Service you have signed up for
• Legitimate interest — to maintain security, prevent abuse, and improve the Service
• Legal obligation — to comply with applicable laws and regulations
• Consent — analytics cookies on our public pages (section 12), which you can withdraw at any time from the Cookie settings link in the page footer

5. Data Sharing

We share data with the following service providers, who act as our data processors under written contracts no less protective than this policy and our Data Processing Agreement:

• DigitalOcean LLC — virtual server hosting (United Kingdom region)
• Scaleway S.A.S. — outbound transactional email delivery (France, EU)
• Twilio Ireland Limited — text message delivery (messages processed in the United States). Used only when you choose to text a signing link from a job, to your client or to a commissioner: their mobile number and the short message (your company name, the site postcode and the link) are sent to Twilio to deliver it.
• Stripe Payments UK Ltd. — subscription payment processing
• Google LLC — federated authentication (only if you choose to sign in with Google); Google Maps (used to display the map editor and render the Site Boundary Map image; map requests include the site's location coordinates); analytics on our public pages, only where you have accepted analytics cookies (see section 12); and Google Workspace, which delivers the email we send from info@clrd.uk: your client's signing request, their copy of the network operator's approval letter when you send it, and our release announcements to you
• what3words Limited — conversion of the site's meter position coordinates to a what3words address, printed on the Site Location Plan (the coordinates are sent once, server-side, when the map is saved)
• IDDQD Limited (trading as Ideal Postcodes) — UK address lookup (United Kingdom). Used mainly on the site forms, where the address is your customer's: enter the postcode of an installation site and we send that postcode alone, server-side, and get back the addresses registered at it for you to pick from, so the address and post town printed on the DNO forms are the ones Royal Mail holds. The same lookup fills the town on your own company or profile address if you enter a postcode there, though a company address is normally taken from the MCS register instead. The data is Royal Mail's Postcode Address File, which Ideal Postcodes are licensed to supply. A postcode is not personal data on its own and no name, job or account detail is sent with it. We keep the answer for 90 days so the same postcode is not looked up twice.
• Horizon Landings Limited (trading as Provero) — contact validation (United Kingdom; validation data hosted in the EU). We send only the single value being checked, server-side, at the moment it is entered: an email address entered on a client record or at sign-up, to flag a likely typo or a mailbox that does not exist; and, for our own sales contact with installer companies listed in the public MCS directory, a telephone number screened against the Telephone Preference Service registers before anyone calls it. Provero's published default is to delete or anonymise validation data after three months; CLRD keeps no record of an email check at all.
• Anthropic, PBC — the AI features (United States). The Dashboard summary is built from a pseudonymised view of your jobs: names, addresses, phone numbers and MPANs are replaced by placeholders before anything leaves CLRD, and the real values are put back only after the answer returns, so Anthropic never receives them. The AI Assistant sends the text of the question you type, and answers from CLRD's own documentation and the published ENA standards; it has no access to your account or job data. Under Anthropic's commercial terms your data is not used to train its models and is retained only briefly for abuse monitoring.

We do not share your data with any other third parties unless required by law (for example, to respond to a lawful request from a regulator or court).

6. Data Retention

We retain your account and job data for as long as your account is active. Generated documents, the associated audit trail, and DNO correspondence associated with a job are immutable once a job is audit-locked and are retained indefinitely as evidence of regulatory compliance, even after your account is closed, unless deletion is required by law.

You can request deletion of your account yourself, from Settings → Account. A deletion request has a 14-day grace period during which you can cancel it from the same page; after that the account is closed and we remove personal data not subject to the compliance-record exception, in any case within 30 days of your request. Backup copies are overwritten in the ordinary course of operation within 90 days.

7. International Transfers

Personal data is stored and processed within the United Kingdom and the European Economic Area. Some of our service providers (for example Google, Stripe, Twilio and Anthropic) may process limited data outside the UK/EEA; where they do, the transfer is protected by safeguards recognised under Chapter V UK GDPR, such as the UK Extension to the EU–US Data Privacy Framework or the ICO's International Data Transfer Agreement/Addendum.

8. Data Security

We protect your data with encryption in transit, encrypted backups, server-side session management, and access controls. Authentication uses secure password hashing.

9. Automated Decision-Making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. The Service applies a deterministic compliance rules engine to data you enter to generate documentation, but the resulting documents are reviewed and submitted by you, and any decision about regulatory submission rests with you.

The AI features are advisory. The Dashboard summary describes what your jobs need from you, and the AI Assistant answers questions about CLRD, the DNO forms and the ENA standards; neither decides a job's route, generates a document or submits anything. You can turn the summary off from the Dashboard.

10. Children's Data

The Service is intended for use by professional installers and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16.

11. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data, subject to the audit-trail retention noted above (self-service in Settings → Account, with a 14-day grace period)
• Export your data in a portable format (a complete JSON export is available from Settings → Account; it becomes downloadable 24 hours after you request it)
• Object to or restrict processing
• Withdraw consent at any time, where processing is based on consent (this does not affect the lawfulness of processing carried out before withdrawal)
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk) if you believe your data-protection rights have been infringed

Data export and account deletion are available directly in the app under Settings → Account. To exercise any other right, please contact us.

12. Cookies

Essential cookies. We use a single cookie to maintain your logged-in session. No personal information is stored in the cookie itself — it contains only an opaque session identifier. It needs no consent, because the Service cannot work without it.

Analytics cookies, only if you agree. Our public pages — the sign-in landing page, sign-up, the FAQ and guides, the API and CSV summaries and these legal pages — use analytics cookies to count page views and see how those pages are used. They are set only if you accept the cookie banner, and nothing is stored on your device before you do. Our analytics provider is the one named in section 5, acting as our processor; it receives the address of the page (stripped of everything but campaign parameters), the site that referred you, your browser and device type, and an approximate location derived from your IP address. It never receives your name, email address, phone number, MPAN or any address. We use no advertising or personalisation cookies at all, and we do not use any of this for advertising.

Signed-in pages carry no analytics. Once you sign in, nothing of the kind loads on any page — your jobs, clients, sites, documents and messages are never described to anyone else. Nor do the links we send your clients and commissioning engineers to sign.

One choice across both our sites. clrd.uk and clrd.app are one service, run by us. Answer the cookie banner on either and we do not ask again on the other. Use the Cookie settings link at the foot of any public page to change your answer at any time; we re-ask at least once a year, and clearing your browser's cookies for the site clears it too.

If you create an account we record with it where that sign-up came from, so we can tell which of our own pages bring people to CLRD. It is ordinary account data from then on, covered by your rights in section 11 and included in your account data export.

When you interact with billing (provided by Stripe), choose to sign in with Google, or open the Site Boundary Map editor (which loads Google Maps), those providers may set their own cookies or receive requests from your browser to complete those flows. Stripe and Google act as independent data controllers for any such cookies — please refer to their respective privacy policies for details.

13. Data Processing Agreement

If you use the Service to process personal data of your own customers, our Data Processing Agreement applies and forms part of your agreement with us. Under the DPA, you are the data controller for that data and CLRD is the data processor.

14. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or through the Service.

15. Contact

For privacy-related questions or to exercise your data rights, please contact us.