Privacy notice

This notice describes how the RiskAtlas website and application handle personal data. The operator's legal entity name, registered address and data protection contact must be completed by the operator before public launch; until then this page describes the technical processing accurately but is not a complete legal notice.

Website

The public website sets no analytics or advertising cookies. If you submit the contact form, we store the details you provide (name, email, organisation, role, portfolio size, message) in our database to respond to your request. We do not share them with third parties for marketing.

Application

The application stores account details (name, email, job title, phone if provided), organisation membership and role, and the building safety records your organisation creates. Audit events record who changed what and when. Session tokens are kept in your browser's local storage to keep you signed in. Local storage is also used to recover unsaved text after an interrupted save and to remember interface preferences.

Data is hosted on Supabase (Postgres, authentication and private object storage). Uploaded documents are stored privately and served through short-lived authorised links. If your organisation enables AI-assisted document review, document content is sent to the configured model provider only when a member requests suggestions; the organisation administrator records the applicable data-handling disclosure in Settings and members see it before using the feature.

Retention and your rights

Building safety records are retained for as long as your organisation's account exists; buildings and documents are archived rather than deleted so that historical reports remain complete. You may request access to, correction of, or erasure of your personal data by contacting your organisation administrator or the operator.