Privacy Policy
Sign Check Ltd · Last updated 25 October 2026
Who we are
SignCheck is operated by Sign Check Ltd, a company registered in England and Wales, and registered with the Information Commissioner (ICO) as a data controller under reference C2057304. We provide an installation-evidence platform for the UK signage industry. For any privacy question or request, contact us via the contact page.
What we collect
Account data covers name, email address, phone number, company name and role, collected when you or your manager creates your account, plus any training certificates your company records for you. Job evidence covers photos, written notes, the text of voice notes (we don't keep the recordings), e-signatures, the time you check in on site, and job details (site, address, schedule, client contacts) captured while documenting installation work. Site check-in data is your phone's location, saved only on jobs where your manager has turned on Smart Site Check-In. It is saved once, when you first capture evidence for the job, to show your manager whether the evidence was captured on site. There is no live tracking and no background tracking. Add Photos asks for your phone's location only when one of your open jobs has Smart Site Check-In on, and only to suggest nearby jobs. That suggestion stays on your phone. Diagnostics are error and performance reports: what went wrong or ran slowly, where in SignCheck, and the browser or phone it happened on. They are sent without your IP address or what you typed, and we don't record your screen. An error message can occasionally include a job reference or a name. Client branding is a client's website address and public logo, used to brand your packs. Payment data is handled by Stripe; we never see or store card numbers.
If your team uses SignCheck over WhatsApp, we process your WhatsApp phone number and the messages, photos and voice notes you send to our business number, using Meta's WhatsApp Business Platform. Photos you send, and the text of voice notes, are kept with the job and its completion pack. Voice notes are transcribed by an automated speech-to-text service, and we keep the text, not the recording. Chat messages are separate from that evidence: they are kept for 12 months from when each was sent. The replies that turn job notifications on or off (YES, CONFIRM or STOP) are kept until your account is deleted, as the record of your choice. On our WhatsApp business number, we only send you job notifications after you reply YES to our verification message. Replying STOP to us, on WhatsApp or by text message, stops job notifications by WhatsApp and by text, and replying YES turns them back on. Job notifications by email aren't affected: to turn those off, use the notification settings in the app or ask us. Evidence capture keeps working either way. Your WhatsApp messages are subject to Meta's own terms and privacy policy in addition to ours.
The SignCheck app
SignCheck on a phone runs the same service as signcheck.ai and handles the same data. It uses your camera, microphone and location only after you allow each one in your phone's permission prompt, and you can change that later in your phone's settings. Nothing can be bought in the app; subscriptions are handled on the website. Job notifications come by WhatsApp, text message or email, and show in the app. In the app and on signcheck.ai, we ask before anything you record or write goes to OpenAI, Anthropic or TypeSafe, and you can change your answer in Settings, under Account. Messages you send to our WhatsApp number are processed as described under WhatsApp.
How we use it
To run the service: building completion packs, showing job progress to your team and the companies you work with, sending job notifications, finding and fixing faults, and meeting the record-keeping expectations of UK construction regulation (CDM 2015 and related standards). We also email you about getting started: a welcome, tips for your first jobs, a note if you stop using SignCheck, and a reminder before your trial ends. Whether each one is sent depends on what you have already done in SignCheck, and each has an unsubscribe link. Unsubscribing doesn't stop job packs, invites or password resets. We do not sell personal data, and we do not use your data for advertising.
Our lawful basis
UK GDPR lets us use personal data only where we have a lawful basis for it. Here is ours for each kind of data. Account data: contract, because we need it to give you your account. Training certificates your company records for you rely on its legitimate interest in showing its team is qualified. Job evidence: contract, because recording the work is the service, and legitimate interests, because the companies involved need a reliable record of the work. Site check-in data: legitimate interests, in showing your manager that evidence was captured on site. Voice notes: the same as job evidence. You choose to record one, and we keep only the text. AI processing by OpenAI, Anthropic and TypeSafe: legitimate interests, in transcribing, summarising, sorting, checking and answering what is sent to SignCheck, so the service is quicker to use. Messages: contract, for answering what you send us on WhatsApp, by text or by email, and for the emails the service needs, such as job packs, invites and password resets. Job notifications: legitimate interests, in telling you about work you are part of. On our WhatsApp business number we also wait for you to reply YES. Onboarding emails: legitimate interests, in helping you get started. Each has an unsubscribe link. Payments: contract, to bill your subscription, and legal obligation, because HMRC requires us to keep payment records. Diagnostics: legitimate interests, in finding and fixing faults. Signing in with Google or Apple: contract, to sign you in the way you chose. Where we rely on contract but you have not agreed to our terms yourself, for example if you only use SignCheck over WhatsApp, we rely on legitimate interests instead: ours, and those of the companies using SignCheck, in running the service.
Who can see your data
Job evidence is visible to the people involved in that job: your own company, the company that dispatched the work, and (through a shared completion pack link) the end client. Our service providers process data on our behalf: Supabase (sign-in, database and file storage), Vercel (hosting), Stripe (payments, on the website only), Meta (WhatsApp messaging), Twilio (job alerts by text message or WhatsApp, and replies to them), Resend (sending our emails, and receiving photos emailed to a job), Sentry (error and performance reports), OpenAI (voice-note transcription), Anthropic (summarising notes, drafting pack emails, reading uploaded spec documents, answering questions sent to our WhatsApp number, which for a registered sender can include their own open jobs with site addresses and issue notes, and, for companies in our photo-check trial, checking evidence photos) and TypeSafe (reading a message you send us to work out what you are asking for, reading a note to decide whether it reports a problem, sorting a reported issue and rating it for seriousness, and checking what kind of document an upload is and naming the types of sign it lists). Each processes only what their role requires. Address search uses Ideal Postcodes, postcodes.io and Komoot Photon, which receive only the address or postcode you type. If you sign in with Google or Apple, they confirm who you are and give us your name and email address.
Data processed outside the UK
Some of our service providers process data outside the UK. Supabase keeps our database and files in Dublin, Ireland (AWS eu-west-1). Vercel runs our functions in Dublin (dub1). Static content is served from the nearest CDN location. We do not name a region for the other providers. Some of them may process data outside the UK and the EU. Where data goes outside the UK, we rely on UK adequacy regulations, which cover the EU and, through the UK-US data bridge, US companies certified to it, or on the ICO's International Data Transfer Addendum to the EU standard contractual clauses, in the provider's data processing terms.
How long we keep it
Account details, meaning your login and contact details, are kept until your account is deleted: we erase them 30 days after you ask. Jobs and their evidence, including photos, notes, voice-note text and signatures, are kept for 7 years after the job is completed, or until the company the job belongs to is deleted, if that comes sooner. WhatsApp messages are kept for 12 months from when each was sent. The WhatsApp replies that turn job notifications on or off (YES, CONFIRM or STOP) are kept until your account is deleted, or, if you don't have one, the company you work for, as the record of your choice. Photos and the text of voice notes you send to a job are kept with that job and its completion pack, not on the 12-month chat timetable. Payment records are kept for 6 years, as HMRC requires. Diagnostics are kept for up to 90 days. We don't keep voice recordings at all.
Deleting your account and your rights
To delete your account, open Settings, then Account, then Delete Account, in the app or on the website, or email support@signcheck.ai. Sign-in stops at once, and 30 days later we erase your login, contact details, WhatsApp chats, support questions and notifications. If you are the last person in your company, its jobs, photos and client packs are erased too; otherwise the jobs you worked on stay with your company, with your name on them, as its record of the work. Deleting Your Account has the details. Under UK GDPR you can request access to, correction of, or deletion of your personal data, and object to our using it where we rely on legitimate interests. You can opt out of job notifications at any time in your notification settings in the app, or by asking us. Replying STOP stops the ones by WhatsApp and text. Contact us to exercise any of these rights; if you are not satisfied, you can complain to the ICO at ico.org.uk.
We'll update this page if our practices change, and note the date above when we do.