Privacy Policy

1. Who we are & our role

EarlyFinish Ltd operates EarlyFinish, software that helps electricians produce electrical certificates. For the data you (the electrician) enter about your own customers and properties, you are the data controller and EarlyFinish acts as your data processor - we process it on your instructions to provide the service. The terms of that arrangement are in our Data Processing Agreement. For your own account and how the product runs, we are the controller.

2. What we hold

• Your account - email address (and an internal user ID + creation date), or, if you sign in by phone, your mobile number.
• Your business profile - business name, address, phone, email, VAT number, competent-person scheme + membership number, engineer name and qualifications.
• Your customers & properties - names, addresses, postcodes, phone numbers, email addresses and occupier names you enter.
• Certificates, jobs, diary & invoices - every field you record, including circuit test values, observations, the engineer's signature, and finalisation dates.
• Photos - board / meter / supply / site images you scan, stored privately as your audit trail.
• Technical data - session tokens, AI-usage counts, and routine server request logs (IP, timestamp, status).

3. Lawful bases

We (and you, as controller of your customers' data) rely on:

• Contract - to provide the service you signed up for.
• Legal obligation - electrical certification records must be kept (Building Regulations / scheme / landlord duties).
• Legitimate interests - operating, securing and improving the service.

4. Who processes it (our sub-processors)

We use carefully chosen providers, each under a data-processing agreement:

• Supabase - database, authentication & photo storage, hosted in the EU (Paris).
• Cloudflare - application hosting, content delivery & voice-note transcription (see §5).
• Anthropic - the Claude AI that reads your scanned photos and assistant notes (see §5).
• Stripe - subscription payments & billing. You enter card details directly with Stripe (PCI-compliant); we never see or store your full card number.
• Resend - sends sign-in emails.

A current sub-processor list is available on request.

5. AI processing

When you use a Scan feature, the photo is sent to Anthropic's Claude API to extract the values, which you then review and confirm. Under Anthropic's commercial API terms, your inputs and outputs are not used to train their models, and are retained only transiently for trust-and-safety purposes. The AI is an aid - you remain responsible for verifying every value before signing a certificate.

Voice & typed assistant notes

• Recordings stay on your phone. Voice notes are saved to your device first and deleted from it as soon as they've been turned into text. A note that can't be processed yet — you're offline, or your monthly assistant allowance is used up — keeps its recording on your phone (never on our servers) until it can be; notes that repeatedly fail to process are deleted after 7 days. The note text is kept on the device for up to 30 days, then deleted. Nothing you say is stored on our servers.
• On iPhone, speech is transcribed on the device where the hardware supports it — the audio never leaves the phone. If on-device transcription isn't available on your iPhone, and always on Android and the web, the recording is sent to Cloudflare Workers AI (Whisper) to be turned into text, then discarded — Cloudflare does not retain it or use it for training. Cloudflare processes on its global network, so this step may run outside the UK/EU.
• The note text is sent to Anthropic's Claude API to suggest diary entries, invoices and reminders, under the same no-training commercial terms as scans. Notes can mention customer names and addresses — that's personal data, handled under the safeguards in §6.
• Nothing is created without you. Every suggestion is shown to you first; only what you confirm becomes a record.
• What we keep server-side is numbers only: usage counts and anonymous quality statistics (how many notes, how often suggestions needed correcting) — never audio, never transcripts, never what a note said.

6. International transfers

Your stored data sits in the EU (Supabase, Paris). Some providers (Anthropic, Cloudflare, Resend) may process data in the United States; these transfers are covered by appropriate safeguards in their data-processing agreements - the UK International Data Transfer Agreement (IDTA) / Standard Contractual Clauses, and/or the UK Extension to the EU-US Data Privacy Framework.

7. How long we keep it

For the life of your account, plus any statutory retention you require for HMRC / scheme / legal record-keeping. You can permanently erase everything at any time via Settings → Delete my account (see how to delete your account).

Assistant voice notes follow shorter, device-local clocks: audio is deleted the moment it's transcribed (a note still waiting to process — offline, or allowance used up — keeps its recording on the device until then), note text after 30 days, and deleting your account wipes all of it from the device immediately.

8. Security

Encryption in transit (HTTPS/TLS) and at rest, per-account authentication, row-level isolation so you only ever access your own workspace, a strict content-security policy, and an audited deletion process.

9. Your rights (UK GDPR)

• Access - request a copy of your data.
• Rectification - correct any record directly in the app.
• Erasure - Settings → Delete my account.
• Restriction / objection / portability - contact us at privacy@earlyfinish.co.uk.
• You may complain to the ICO (ico.org.uk) at any time.

10. Cookies & local storage

We use strictly necessary cookies to run the app - your sign-in session, payment-fraud prevention, and a record of your cookie choices. With your consent, we also use analytics and advertising cookies (including server-side conversion sharing) to understand usage and measure our advertising. You can set or withdraw consent at any time via the "Cookie settings" control in the footer.

Full details - every cookie and similar technology, its purpose, category and expiry - are in our Cookie Policy.

11. Your responsibilities as a controller

As a business processing your customers' personal data, you are responsible for your own ICO registration (ico.org.uk - usually ~£40/year) and for giving your customers their own short privacy notice. We can provide a template to help.

12. Contact

Data-protection enquiries: privacy@earlyfinish.co.uk · ICO registration 00014559653.