1. Who we are
Saundy ("we", "us") provides Saundy Inspect, a property inspection platform available at saundy.com, its web application, and its mobile apps.
- Legal entity: SAUNDY LTD, a private limited company registered in England and Wales
- Company number: 17363175
- Registered office: 128 City Road, London, England, EC1V 2NX
- Contact: hello@saundy.com
For personal data collected through our websites and the accounts our customers create with us, we are the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If your data reached us because it appears in an organisation's inspection content (for example you signed an inspection report, or you appear in a photo or note), we act as a data processor on that organisation's behalf. See section 10.
2. Data we collect
Account data. When you register we collect your name, email address, and a password (stored only as a salted hash). We record the date you accepted our terms.
Organisation and team data. Organisation names, team membership, roles and permission groups, and the names and email addresses of people invited to join an organisation (including invitees who have not yet created an account).
Base location (optional). Team members can set a base postcode so their organisation can see how far each person is from an inspection site when assigning work. It is entirely optional, set separately for each organisation you belong to, and visible to that organisation's admins. You can change or clear it at any time from your profile page, and it is deleted when you delete your account. To turn postcodes into map coordinates, our servers look them up against the open postcodes.io geocoding service; each lookup contains a bare postcode and nothing else — no names, account identifiers, or network addresses — so nothing that could identify you is shared (see the note at Sub-processors).
Billing data. Payments are handled by Stripe. We do not see or store card numbers; we store only your Stripe customer and subscription identifiers, your plan tier, and your report-credit balance.
Enquiries and register interest. If you ask us to contact you about Saundy Inspect (for example through the contact form or the register-interest form on this site), we collect your name, email address, optionally your company name, and the message you send us.
Activity within inspection records. Inspection records kept by your organisation include the names of the team members who were assigned to them, submitted them, and signed off defects, and the drawn signatures added to submitted reports. Your organisation may also upload site documents (plans, drawings) against its properties. These form part of your organisation's inspection content.
Shared report links. Your organisation can create links that let anyone holding the link open one specific submitted report without signing in, for example to send a report to a client. Links can be given an expiry and can be withdrawn by your organisation at any time. For each link we record who in your organisation created it, when, and how many times the report was downloaded through it. We do not record who opened a link.
Shared site registers. Your organisation can also create a link that lets anyone holding it see a read-only register of every submitted report for one site or part of a site, including the names of the team members who submitted those reports, and, where your organisation chooses, the site's open defects. Such links always expire (after at most two years), can be withdrawn at any time, and can be protected either by a passcode, which we store only as a salted hash, or by a list of email addresses your organisation enters, in which case we email each listed address a personal link to open the register on your organisation's behalf, and a visitor can ask for a fresh link by confirming one of those addresses. For each link we record who in your organisation created it, when, how many times the register was opened and how many reports were downloaded through it. For a link restricted to email addresses we also hold the addresses your organisation listed, when each was added, whether its invitation was delivered, each personal link we issued (invitation or confirmation) and when it was last used; we keep the record of issued links for 30 days, and the listed addresses are deleted with the link. Beyond that we do not record who opened a link.
Client portal accounts. Your organisation can give its own clients (for example a landlord, managing agent or developer whose properties it inspects) a login to a client portal. To do so it enters the client's name and email address; we email the client an invitation, and the client creates a Saundy account (or signs in with one they already hold) which is then linked to your organisation as a client, never as a team member. For that account we are the controller, as for any account (section 2, "Account data"). Your organisation controls which sites the client can see and whether they see the site's defects, and can withdraw access at any time; we record who in your organisation invited the client and granted each site, and when, and when the client last used the portal. Anything the client submits through the portal — a note or photo added to a defect, or a request for an inspection — becomes part of your organisation's inspection content, labelled with the client's name. A client can remove their own account at any time (section 8); your organisation's records then keep what was submitted but lose the client's name and address.
AI-assisted features (optional). The Service offers optional AI features, including the Saundy template assistant, which drafts inspection templates from what you tell it or from documents you upload. When your organisation uses an AI feature, the content that feature needs (for the template assistant: the messages typed, the template being worked on, and any uploaded document) is sent to our AI sub-processor (Anthropic) to produce the result — see Sub-processors for what each feature sends. We record who used a feature and when, so we can apply the fair-use allowances. Nothing is sent in the background of normal use, what AI features produce is advisory until your organisation accepts it, and Anthropic does not use the data to train its models.
Emails. We send transactional email only (welcome emails, password resets, team invitations, client portal invitations sent on an organisation's behalf, and one-time links to open shared site registers restricted to listed email addresses: an invitation when your organisation lists an address, and a confirmation when a visitor asks for one). We do not send marketing email and we do not operate mailing lists. The one exception: if you register interest in Saundy Inspect, we will email you about availability and early access, and we delete your details or stop contacting you whenever you ask.
Sign-in and session records. We record sign-in and session events against your account (sign-ins, sign-outs, session renewals, and failed password attempts): the time, the type of event, which Saundy app (and app version) made the request, and the IP address the request came from. For each organisation you belong to we also keep a note of which app you last used and when. We use these records to keep accounts secure, to investigate problems you report, and to understand whether the service is being used. They are never used for advertising or profiling.
What we do not collect. Our websites use no analytics, no advertising trackers, and no third-party tracking scripts. All fonts, styles, and scripts are served from our own domains. We do not use browser fingerprints. IP addresses recorded with sign-in and session events are kept for 90 days for security and audit (see section 7) and are never used for advertising, profiling, or tracking your movements.
3. Purposes and lawful bases
| Purpose | Data | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Providing your account and the service | Account, organisation, team data | Contract (Art. 6(1)(b)) |
| Distance-aware assignment of inspection work | Optional base postcode | Contract (Art. 6(1)(b)) |
| Giving an organisation's clients access to its client portal | Client account data; the organisation's record of the client and the sites granted | Contract (Art. 6(1)(b)) with the client for their account; processing on the organisation's instructions for its record of them (section 10) |
| Billing, subscriptions, and report credits | Billing data | Contract (Art. 6(1)(b)) |
| Security and abuse prevention | Account and activity data | Legitimate interests (Art. 6(1)(f)) |
| Auditing sign-ins and understanding use of the service | Sign-in and session records, including IP address | Legitimate interests (Art. 6(1)(f)) |
| Transactional email | Email address | Contract (Art. 6(1)(b)) |
| Optional AI-assisted features, with fair-use limits | The content your organisation submits to the feature being used; usage records | Contract (Art. 6(1)(b)) |
| Responding to enquiries and register-interest requests | Name, email, company, your message | Steps at your request prior to entering a contract (Art. 6(1)(b)) |
| Accounting and tax records | Billing data | Legal obligation (Art. 6(1)(c)) |
We do not currently rely on consent for any processing, and we make no automated decisions producing legal effects.
4. Cookies
We use no advertising, analytics, or tracking cookies, which is why you do not see a cookie consent banner on our sites.
The only cookies we set are:
| Cookie | Purpose | Lifetime |
|---|---|---|
__Host-saundy.csrf |
Protects forms on this site and in the portal against cross-site request forgery. Strictly necessary for security. | Session |
saundy.site-share |
Set only when you enter the passcode for a shared site register, or confirm your email address for one, so that device does not have to do so again. Scoped to that one register's address and holds nothing about you. Strictly necessary to provide the page you asked for. | 30 days |
The portal also stores your sign-in tokens in your browser's local or session storage so you stay signed in, and the mobile app stores your sign-in tokens and offline inspection data, including site documents downloaded for offline viewing, on the device so you can work without a connection. These are strictly necessary to provide the service you have requested and are exempt from consent requirements under the Privacy and Electronic Communications Regulations (PECR).
5. Who we share data with
We share personal data only with the sub-processors needed to run the service: hosting, payments, transactional email, and — only when your organisation uses an optional AI feature — AI processing. The current list, with what each one receives, is maintained at Sub-processors.
We may also disclose data where required by law, court order, or to protect our rights, and in the event of a merger or acquisition (in which case this policy continues to apply to data collected under it).
We never sell personal data.
6. International transfers
Some sub-processors may process data outside the UK. Where that happens we rely on UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, as incorporated in each sub-processor's data processing terms.
7. How long we keep data
| Data | Retention |
|---|---|
| Account and organisation data | Until you delete your account (see section 8) |
| Base postcode | Until you clear it on your profile page, or deleted with your account |
| Inspection content (sites, site documents such as plans and drawings, templates, inspections, reports, photos, defects, signatures) | Until your organisation deletes it or the organisation is deleted; inspection records are your organisation's documents and have no automatic expiry |
| Contact-form and register-interest details, including your message | Deleted within 6 months of our last correspondence with you about it (for the iOS notify-me list, within 6 months of the launch email), or immediately on request |
| AI feature usage records (who used one and when) | Until your organisation is deleted |
| Expired sign-in tokens, password reset tokens, and invitations | Deleted within 30 days of expiry |
| Shared-register access links (the listed address an invitation or confirmation link was issued to, when, and when it was used) | Deleted 30 days after the link was issued or last used; the listed addresses themselves are deleted with the link |
| Client portal records held by an organisation (the client's name and email address, who invited them and when, which sites they may see, when they last used the portal) | Until the organisation removes the client's access or is deleted; when a client deletes their own account their name and address are pseudonymised and the access is withdrawn, while what they submitted stays in the organisation's inspection content |
| Email delivery log (recipient address, type of email, time sent, delivery outcome; never the email content) | Deleted 12 months after sending; the address is pseudonymised when you delete your account |
| Sign-in and session log (time, type of event, app and version used, IP address) | Sign-in records are deleted 12 months after the event and session-renewal records after 30 days; the IP address is removed after 90 days; every record is deleted when you delete your account or leave your last organisation |
| Last-active record per organisation (which app you last used and when) | Until the organisation is deleted or you delete your account |
| Billing records | As required by UK tax law (typically 6 years) |
| Backups | Retained for 7 days, then deleted automatically. Data erased from live systems may persist in backups until they expire; backups are used only for disaster recovery, and erasures are re-applied if a backup is restored. |
8. Your rights
Under the UK GDPR you have the right to access, rectify, erase, restrict, and object to the processing of your personal data, and the right to data portability.
You can exercise the most common rights directly in the portal:
- Erasure: delete your account from your profile page. This removes or anonymises your personal data, including your name in inspection history, your drawn signature on reports you signed as a team member, and any base postcode you set.
- Portability / access: download a copy of your personal data as JSON from your profile page. The export includes any base postcode you have set.
- Rectification: edit your name and email, and set or clear your base postcode, on your profile page.
For anything else, email hello@saundy.com. We respond within one month.
You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk.
9. Security
Passwords and sign-in tokens are stored only as cryptographic hashes. All traffic is encrypted in transit (TLS), each customer organisation's data is isolated by tenant-level access controls, and access within an organisation is governed by roles and permission groups. Where an organisation chooses to share a report or a site register by link, anyone holding that link can open that report, or that site's register, until the link expires or is withdrawn; the link itself is unguessable and stored only as a hash, a register's passcode, where set, is stored only as a salted hash, and a register restricted to listed email addresses opens only after a one-time emailed link is clicked through, which is likewise stored only as a hash.
10. When we act as a processor
Organisations use Saundy Inspect to record inspections of their properties. That content can include personal data: the names, roles, and drawn signatures of people who sign reports, people who appear incidentally in photos or notes, and the organisation's own clients, where it invites them to its client portal (the name and address it enters, the sites it grants them, and what they submit). For that data the organisation is the controller and we are a processor: we process it only on their instructions, under our Data Processing Agreement. A client's Saundy account itself is ours to look after, as for any account holder.
If you believe an organisation holds your data in its inspection records and you want it accessed, corrected, or deleted, please contact that organisation directly; they control it. We provide them the tools to honour your request.
11. Changes to this policy
We will post any changes on this page and update the "Last updated" date above. Material changes will be announced to account holders by email.