Data Processing Terms

These terms form part of the Site Manager terms of service and apply where we process personal data on your behalf under UK GDPR.

Roles

You are the controller of personal data you put into Site Manager, such as tenant names, contact details, contracts, correspondence and meter readings. We are your processor.

What we do with it

We process it only to provide Site Manager to you and on your documented instructions, which are these terms and how you use the app. We don't sell it or use it for our own marketing.

Our commitments

Staff and contractors with access are bound by confidentiality.
We use appropriate security, including encryption in transit, hashed passwords, encrypted Xero tokens, access controls between customer accounts and regular backups.
We use the sub-processors listed below, and we'll tell account owners at least 30 days before adding a new one so you can object.
We help you respond to requests from people exercising their data rights.
We tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data.
When your account closes, we delete your data after 90 days, unless the law requires us to keep it.
We give you the information you reasonably need to show you're meeting your obligations.

International transfers

Some sub-processors are based in or process data in the United States. Where they do, transfers rely on the UK International Data Transfer Addendum, the UK Extension to the EU-US Data Privacy Framework, or another lawful safeguard.

Sub-processors

Railway Corporation: application hosting and database.
Resend: sending system and tenant emails.
Stripe Payments UK: subscription billing (your business's billing details only).
Xero: only if you connect it; Site Manager reads your invoices, contacts and reports.
Anthropic: only when you use AI document reading; the document is processed to extract dates and details and is not used to train models.

Contact