Privacy notice

The operator of this deployment has not published contact details yet. They are required before this notice can stand as a published policy — see the warning above.

We have not appointed a Data Protection Officer, and this notice does not claim a company registration number or a legal basis that nobody has decided. Those are noted as outstanding rather than filled in.

Only what the product needs to do the things you asked it to do.

• Your account. Email address, name if you give one, postcode, phone number if you add one, how you prefer to be contacted, and an avatar if you upload one. The postcode calibrates local prices; the rest identifies you to people you choose to work with.
• Your project. What you type about the work you want done — the brief, the answers to the scoping questions, notes, and any photographs or documents you upload.
• Builder and company data. If you are a builder: your company details, services, areas covered, portfolio, logo, and any evidence you submit for a badge.
• What happened. Proposals, quotes, jobs, updates, decisions, invoices and payment records, and messages exchanged through the product.
• Operational records. A limited log of security-relevant actions — who revoked a share link, who published a listing, who asked for a deletion — and a record of when the assistant was used and what it suggested. Neither holds the content of your conversations.

We do not collect special category data, and we ask you not to put it in a project description. We have no advertising and no third-party trackers selling your data.

• To build your scope of works and estimate a cost range for it.
• To share what you choose with the builders you choose.
• To let builders quote, and to hold what was quoted so it can be compared.
• To run an accepted job: schedule, updates, changes, handover.
• To keep the service working, secure, and answerable when something goes wrong.

The lawful basis for each of these is a decision our operator has to record. This notice does not assert one.

• Builders you invite or select. They see the scope you shared with them and the documents attached to it. They do not see your other projects, your other builders’ quotes, or anything you have not shared.
• People you share a link with. A share link shows one version of one scope. You can revoke it at any time, and it expires on its own.
• The public directory. Only builders, only if they choose to publish, and only the fields on their listing. Homeowners are never listed.
• Reviewers at RightScope. Evidence submitted for a badge is read by somebody here, who decides whether it supports the claim. The badge then says exactly what was checked.

We do not sell your data and we do not share it for advertising.

The database, authentication and file storage are Supabase. The application runs on Google Cloud Run. Email, where configured, is sent through an SMTP provider chosen by the operator. Assistance features use an AI provider chosen by the operator.

The specific regions, providers and any transfers outside the UK depend on how this deployment is configured, and are recorded by the operator rather than asserted here. We are not going to name a processor list we have not verified.

RightScope uses AI to read your brief, interpret answers, research prices and draft text. Everything it produces is assistive: a suggestion for you or a builder to check, never a decision made about you.

We keep a limited record of when it ran — the purpose, the model, whether the answer was usable, and a summary of the outcome. That record deliberately holds no prompt, no chain of thought, and no copy of what you wrote. Where a price came from public retailer pages, the record keeps the links so the figure can be checked.

• Your account and projects: until you delete them, or until you delete your account.
• After a deletion request: 30 days, during which you can change your mind. Sign-in stops immediately.
• Security and operational logs: 365 days by default.
• Data exports: the download link expires, and the archive is removed with it.

Where a record is part of somebody else’s lawful account of a job — a quote a builder sent, a document you shared with them, an invoice — deleting your account does not erase their copy. We say so before you confirm, rather than after.

You can ask for a copy of your data, ask us to correct it, or ask us to delete your account. Two of those are buttons:

• Account settings → Export my data builds an archive of what you can see and gives you a link that expires.
• Account settings → Delete my account stops sign-in immediately and removes your personal data after 30 days.

For anything else — a correction, an objection, a complaint — write to the address above. You can also complain to the Information Commissioner’s Office.

When this notice changes in a way you should know about, you will be asked to acknowledge the new version the next time you use RightScope. You will not be silently treated as having read it.

• 25 September 2026 (beta-2026-09-25) — First published notice. Describes what the beta collects, who it is shared with, how long it is kept, and how to export or delete an account.