Privacy notice for Upkept Logbook

Last updated 25 October 2026. Draft, to be reviewed.

Two roles

For your account (the owner’s email, sign-in codes, billing details and support messages) Upkept (Upkept, London, United Kingdom) is the controller. For the records your team enters (check entries, staff display names and PINs, corrective actions, photos) you are the controller and we are your processor, acting on your instructions under the data processing agreement.

What we collect, and why

• Owner email. To sign you in with a six-digit code and to send account, trial and billing emails. Lawful basis: performing our contract with you.
• Billing. Stripe handles your card. We hold your Stripe customer id, subscription state and invoice summaries, never card numbers. Lawful basis: contract and our legal obligation to keep accounting records.
• Staff names and PINs. Staff give a display name only, no email or phone. PINs are stored as a one-way hash. We process these on your behalf.
• Check entries, corrective actions, photos. Yours; we process them to provide the service, store them in the UK, and never use them for anything else. Photos are optional and must not show people.
• Usage analytics. PostHog (EU) in cookieless mode: no cookies, no cross-site tracking, used for statistics about how the app is used. Under the statistical-purposes exception in PECR you do not need to consent; you can object by emailing us.
• Errors. Sentry records technical errors with personal details scrubbed (no emails, no free text).
• Marketing. Only if you tick the separate box at sign-up. Then your email, sector and trial dates go to MailerLite. You can unsubscribe in any email or by asking us.

Who else sees it (sub-processors)

Supabase (database, authentication and file storage, UK region), Vercel (hosting and the scheduled jobs), Stripe (payments), Resend (transactional email), Sentry (errors), PostHog (analytics, EU), MailerLite (marketing list, only with consent) and Zoho (our support inbox). Some are outside the UK; where they are, the UK International Data Transfer Addendum or an adequacy decision applies.

How long we keep it

While your site is subscribed or on trial we keep everything you enter. After a trial lapses or a subscription ends the site stays read-only for the retention period you choose in Settings (12 months by default, up to five years, because HSE expects legionella records kept for five years). We email you 30 days and 7 days before deletion. Account and billing records are kept as long as tax law requires. You can ask for earlier deletion at any time from Settings, Your data; a person handles it within 30 days.

Your rights

Under UK GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to processing, and take it elsewhere. Every account can export everything as CSV, JSON and PDF without asking. For anything else email support@upkept.uk. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk.

Security

Every table is protected by row-level security so one site can never read another. Entries are append-only and hash-chained. Staff PINs are hashed. Webhooks are signed. We run on UK and EU infrastructure with daily backups.