Draft: needs legal review before launch. This is a plain-English draft, not final terms.
Data processing note (UK GDPR)
Last updated 13 October 2026
A short summary of how Snagwalk processes personal data on behalf of firms, for your records under UK GDPR Article 28.
Roles
- Controller: the firm using Snagwalk. The audio, photos and lists belong to the firm.
- Processor: Snagwalk. We process the firm’s data only on its instructions, to provide the service.
What, whose and why
- Data: voice recordings, photos, transcripts, names and contact details, signatures, IP addresses.
- People: the firm’s staff, its clients, trades, and anyone else heard or seen on a walk.
- Purpose: making snag lists, sharing them with trades and clients, and recording client approvals of extra work.
The firm’s duties
- Tell the client and anyone on site that you’re recording, before you start.
- Have a lawful basis for recording, usually your legitimate interest in an accurate record of the work.
- Answer requests from people about their data. We will help you do it.
Our duties
- Keep the data confidential, and only let staff who need it see it.
- Keep it secure: encrypted in transit and at rest, private storage, short-lived links to media, and no login-free access beyond each link’s scope.
- Use only the sub-processors listed below, and tell firms before adding one.
- Tell the firm without undue delay if there is a data breach affecting its data.
- Delete or return the data when the firm deletes a job or its account (within 30 days, including backups).
Sub-processors
- Supabase: database, sign-in and file storage (EU)
- AssemblyAI: turning walk audio into text, using its EU service; audio is deleted after processing (EU)
- Anthropic: drafting items from the transcript and photos; not used for training (US, under UK transfer safeguards)
- Resend: sending emails, such as links and signed approvals (EU sending region)
- RevenueCat: managing app subscriptions; it sees the firm id and plan, not job data (US, under UK transfer safeguards)
- Sentry: crash and error reports (EU)
Export and deletion
Firms can export any job (photos with marks, items and approvals) and delete any job with all its media from the app. Deleting the account queues deletion of every job and its media, and switches off every link straight away.