Privacy Policy — Sandford Digital Limited

01. Who we are

Sandford Digital Limited ("Sandford Digital", "we", "us", "our") is a company registered in England and Wales (company number 17400537). We handle personal data in two different roles.

Customer survey data. Our customers are the organisations that commission surveys using Sandford Site Scan, for example housing associations, councils and managing agents (each is a "customer" in this policy). For the photos, video, sound, notes, answers and other survey records made for a customer, the customer is the controller and Sandford Digital is its processor. We handle that data on the customer's instructions. If you appear in a survey, for example as an occupant, please contact the customer first.
Our own data. Sandford Digital is the controller of the data we hold about accounts and sign-in, organisation and access records, device and technical logs, enquiries and business contacts, and visits to our websites.

Handover is a separate service from Sandford Digital that runs on some of the same servers. It has its own privacy notice, and this policy does not cover it.

We can be contacted at:

Sandford Digital Limited

Company number: 17400537

Registered office: 10 London Lane, London E8 3PR

Email: privacy@sandford.digital

Website: sandford.digital

02. The short version

Sandford Site Scan is designed to inspect assets such as buildings, vehicles and rail equipment, not people. It is not designed to identify, track or profile individuals. We take steps to reduce the risk that people appear in survey photos, but we cannot remove that risk: people, voices and personal items can still appear in photos, video and sound. This policy explains what we do about that.

Where the app finds a face in a photo, it covers the face with a solid block on the phone before the photo is saved or sent. The surveyor can also cover a letter, screen or name label by hand. The original photo is not kept. This reduces the risk that people appear in stored photos; it does not remove it
Photos taken in a survey are stored, with faces covered, as part of the survey record. Unredacted originals of photos are not kept. Video is optional. Video clips are stored as recorded and are not covered, and in the Housing app they are recorded without sound unless the surveyor turns Sound on. Where sound is recorded it may capture voices, so the app asks the surveyor to confirm whether sound is required before filming
The first frame of each video is covered automatically, with the same face check as photos, before it is sent for AI checking. If the check cannot run, that frame is not sent
Location is optional. If the surveyor allows it, each photo and video records where it was taken, including the phone's raw height reading
For customer survey data, the customer decides how the data is used and we act on its instructions. We do not use customer survey data for our own purposes other than providing, securing and supporting the service
We do not sell personal data to third parties under any circumstances
You have rights over your personal data, including to access, correct and ask for erasure of it (Section 08). Where a customer is the controller, we pass your request to the customer

03. What data we collect and why

A. Sandford Site Scan mobile application

The Sandford Site Scan app is a professional tool. Accounts are issued by invitation to surveyors who work for a customer, and there is no sign-up in the app. The tables below describe the Housing version of the app, which is the version released through the app stores. It records surveys of individual homes and inspections of blocks (communal areas). The kinds of data are the same for both. Other versions are described in part F.

Survey data (the customer is the controller; we are the processor)

Data type	Purpose	Legal basis	Retention
Photos, with faces covered on the phone	Record of the condition of the property or asset, and asset condition assessment via AI vision	Legitimate interests of the customer	Six years from the date of the survey
Video clips of up to 15 seconds (optional). Video is not covered	Record of the condition of the property or asset	Legitimate interests of the customer	Six years from the date of the survey
Audio recorded with video clips. In the Housing app, video is recorded without sound unless the surveyor turns Sound on. Where sound is recorded, conversations of surveyors, occupants or bystanders may be heard, so the app asks the surveyor to confirm whether sound is required before filming	Part of the video record	Legitimate interests of the customer	Six years from the date of the survey
Photo covering: where a face is found on the phone, and areas the surveyor covers by hand	Cover people and personal items before a photo is saved or sent	Legitimate interests of the customer	The original photo is not kept
The copy sent for AI checking: a shrunk copy of each covered photo, or the covered first frame of a video, with the room name and area label	Asset condition assessment via AI vision (Section 04)	Legitimate interests of the customer	We do not keep this copy. Anthropic's own retention applies (Section 04)
AI assessment output	Damage finding and severity scoring, shown as advisory	Legitimate interests	Six years from the date of the survey
Location (latitude, longitude and accuracy) recorded with each photo or video. Optional: the surveyor can decline	Record where each photo or video was taken, and print it on the report	Legitimate interests of the customer. Location is optional: the surveyor can decline	Six years from the date of the survey
The phone's raw height reading (altitude) and its accuracy, with the phone type and operating system version, recorded and sealed with the location of each photo or video	Recorded and sealed with the location. Not printed on the report and not checked by us	Legitimate interests of the customer. Location is optional: the surveyor can decline	Six years from the date of the survey
Session ID, capture time and server receipt time	Audit trail and dispute resolution. The capture time comes from the phone's clock and is not independently verified	Legitimate interests / legal obligation	Six years from the date of the survey
Spatial anchor metadata	Mapping frame to position on asset	Legitimate interests	Six years from the date of the survey
Surveyor name and user ID	A professional name is required. It is attached to every survey, sealed in the record and printed on the report	Legitimate interests of the customer	Six years from the date of the survey, as recorded in the survey record
Notes and checklist answers, typed or dictated	The surveyor's observations, sealed in the record and printed on the report	Legitimate interests of the customer	Six years from the date of the survey
Dictation: spoken voice notes converted to text by the phone's operating system, which may use Apple or Google speech recognition	Let the surveyor speak a note instead of typing it	Legitimate interests of the customer	The app does not keep the audio. The resulting text is kept as part of the note (six years from the date of the survey)
Property details: the postcode or address typed by the surveyor, the property or block identifier (such as a UPRN), and an estate label. For a single home we receive a coded form of the address or UPRN. For a block we store the address, postcode and UPRN	Identify the property or block being surveyed and find it again	Legitimate interests of the customer	Six years from the date of the survey
Fingerprint of each sealed survey record, published on a public blockchain (Section 07, Track B)	Let someone check later that the sealed record has not been quietly changed	Legitimate interests of the customer	Permanent (the fingerprint holds no personal data)

Use of survey data. We use customer survey data only to provide, secure and support the service. Any other use, such as aggregate insight, would need the customer's separate permission.

Account, device and technical data (Sandford Digital is the controller)

Data type	Purpose	Legal basis	Retention
Sign-in details: email address, password (held by Google's sign-in service) and user ID	Let the surveyor sign in. The user ID is recorded on each capture	Legitimate interests	Kept until the account is deleted. We delete any account that has not been used for six years, and we review accounts at least once a year to find them
Organisation records: the organisation a person belongs to, their role, access rights, status (including suspension), and invitations (email address, role and expiry)	Control who can use the service and see what, and keep each customer's data separate	Legitimate interests	Kept until the account is deleted. We delete any account that has not been used for six years, and we review accounts at least once a year to find them
Audit log of administration actions: who did what, to whom, and when (for example an invitation or a suspension)	Security, accountability and dispute resolution	Legitimate interests	Generally 90 days. Some are deleted automatically. Where that is not yet automatic, we delete them by hand at least once every 12 months
Device identifiers and checks: a random installation ID, device type, operating system, app version, the number of items waiting to send, and an App Check token (a Google service that confirms the app is genuine). The device identifier recorded in a survey record stays with that record	Security, support, and spotting surveys that are stuck and not sending	Legitimate interests	Generally 90 days. Some are deleted automatically. Where that is not yet automatic, we delete them by hand at least once every 12 months
Technical logs: request records, error reports, and the network (IP) address of a request. For limiting repeated requests we keep only a one-way coded form of the address (still personal data)	Keep the service secure and working, and limit abuse	Legitimate interests	Generally 90 days. Some are deleted automatically. Where that is not yet automatic, we delete them by hand at least once every 12 months
App update checks: the app asks our update provider for updates when it opens, which shows at least the phone's IP address and platform	Deliver app updates	Legitimate interests	Held by the update provider under its own terms

Photo covering: Before a photo is saved, fingerprinted or sent for AI checking, the app looks for faces on the phone and covers each one with a solid block. The check runs on the phone. The surveyor can also draw a box over a letter, screen or name label. The original photo is not kept; the covered photo is what is stored and fingerprinted. This reduces the risk that people appear; it does not remove it. A face can be missed, people can be recognised from other things in a picture, and video clips and their sound are not covered. The app does not cover text automatically. Face detection finds where a face is, never who it is, and no face template or other biometric data is created or kept. The first frame of each video clip goes through the same face check automatically, with no review screen, before it is sent for AI checking. If the check cannot run or cannot give a clear answer, that frame is not sent.

Reports. The app makes a PDF report on the phone from the survey. The surveyor shares it, and we do not store a copy of the PDF. A report can include the surveyor's name, photos, notes, answers and, if location is on, the place each photo was taken. It carries a link and QR code to the public verification page.

Location. The app asks permission to use the phone's location only while the app is in use. The surveyor can decline and still carry out the survey. The report then shows "Location: not recorded". The surveyor can turn location on later from the home screen or change it in the phone's settings.

Blocks. Inspections of blocks are recorded and sealed in the same way as other surveys, and the app can produce a report for a block as well as for a single survey.

B. Client portal and organisation access (portal.sandford.digital)

People in customer organisations are given accounts by invitation. There are four kinds of user: a Sandford Digital administrator; a surveyor, who sees only their own work; a team administrator, who allocates surveys and invites surveyors and managers into their own organisation; and management, who see an overview of the organisation's properties. Occupants of surveyed homes do not have accounts and cannot see anything in the portal. The portal's survey views are being introduced in stages, and at the time of writing the portal is a sign-in protected area. Organisation accounts use the following personal data:

Name (where given) and email address, for account authentication and communications
Organisation name, role, status and the products the organisation may use, for access control and audit purposes
Invitation records. An invitation is sent by email with a one-time link. We keep only a scrambled form of the link code
Login timestamps and activity logs, and the audit log of administration actions, for security and compliance

C. Insights dashboard (insights.sandford.digital)

The Insights site is currently only a sign-in page. It shows no data. Only Sandford Digital uses it. Sign-in uses account data (name, email, organisation) for authentication only. No customer's survey data is shown there. If we ever show grouped figures, they would need the customer's separate permission (see "Use of survey data" in part A), they would not identify individuals or customers, and we will update this policy first.

D. Websites (sandford.digital and the verification page)

Contact form: name, work email, organisation and message. The form sends them to our servers in Google Cloud, and a notification email is sent to us through our email provider. We keep the form record for 12 months. A notification email is also sent to us and is held in our email, and the enquirer may be added to our business contacts, which have their own retention (see part E)
To stop abuse, the form limits how often one network address can submit it. We keep only a one-way coded form of the address (still personal data) for this
Visit logs: our hosting provider (Section 06) records ordinary server logs, such as IP address, browser type and the pages requested
We do not add analytics, advertising or tracking tools to the website. The self-assessment quiz runs in your browser and sends nothing to us
Pages of sandford.digital other than this one load a font from Google Fonts. This sends your IP address and browser details to Google when the page loads
Public verification page: when you scan a report's QR code or enter its reference, the page looks up the record. Your browser also contacts a public blockchain network service to read the published fingerprint. We keep ordinary technical logs of requests

E. Business contacts and email

Sandford Digital is the controller of the business contact details we hold about people at housing associations, fleet and rail operators and other organisations we may contact about our services. These are names, work email addresses, phone numbers, organisation and role, and notes of our contact with them. They come from publicly available and business sources, and from people who contact us. They are held in our database in Google Cloud and in our email system (Google Workspace). An automated job on our servers checks our business mailboxes every 15 minutes. When a reply matches a business contact in our contacts system, the job sends the subject and body of the reply to Anthropic's AI service (the Anthropic API) to sort it, for example into interested, not interested or a question. The job then labels the email as handled and marks it as read. It also reads our sent mail to match recipients to contacts. This means the email text of business contacts goes to Anthropic (Sections 04 and 06). You can ask us to stop contacting you at any time by replying to our email or writing to privacy@sandford.digital.

Data type	Purpose	Legal basis	Retention
Business contacts and enquiries (including contact form submissions)	Tell organisations about our services, respond to enquiries and keep a record of our contact	Legitimate interests	Until you ask us to stop contacting you or to delete your details. Contact form record: 12 months (see part D)
Subject and body of replies from business contacts, sent to Anthropic's AI service	Sort replies so we can follow them up	Legitimate interests	We do not keep the copy sent to Anthropic. Anthropic's own retention applies (Section 04)

F. Other versions of the app

Sandford Site Scan has other versions used with invited customers. They share the same sealing and public fingerprint, and the controller and processor roles in Section 01 apply to them too. They differ from the Housing version in these ways:

Fleet (vehicle inspections): photos and video (which may include sound), location, notes, and the vehicle registration (number plate) and vehicle identification number (VIN) where entered, for vehicle identification at handover. The registration and VIN are kept for six years from the date of the inspection
Rail (depot and asset inspections): photos and video (which may include sound), location and notes
Film and TV Locations: photos and notes about a location. This version does not collect location data or require a sign-in, and the location name stays on the phone. Notes are free text, so the app tells the user not to type personal data into them
The face covering described in this policy is part of the Housing version only. Photos and video in the Fleet and Rail versions are not covered
Photos in the Fleet and Rail versions are checked by the AI service in Section 04 through a Sandford Digital server in Google Cloud, and a summary of each session is sent to that server so it can be shown in the client portal

04. How we use AI vision

Sandford Site Scan uses Claude, an AI model developed by Anthropic, to give an advisory assessment of asset condition from photos and video. A shrunk copy of each photo, after covering, and one still frame from each video clip, also covered, are submitted to Anthropic's API over an encrypted connection (TLS), through our own server. Only the picture and the room name and area label are passed to Anthropic. We do not send the location, address, surveyor name or customer. Anthropic's data processing terms apply to this transfer.

The first frame of a video is put through the same face check as a photo before it is sent. If the check cannot run, the frame is not sent. The video itself is not sent to Anthropic.

We instruct the AI model to:

Assess the physical condition of the asset surface visible in the frame
Identify damage, wear, or anomalies against a known baseline condition
Return a structured JSON assessment: severity, findings, confidence, recommendation
Describe only observable physical conditions of the property, and make no comment on occupants, housekeeping, belongings or pets

We do not ask the AI to identify or describe people. People can still appear in a photo, because the face covering can miss a face and does not cover bodies, voices or other things that identify someone. Before the first photo or video, the app shows this notice: "Photos, and a still picture from each video, are sent to Anthropic's AI service in the United States to check for defects. Keep faces, family photos, letters, screens and name labels out of frame." Before filming, the app also asks the surveyor to confirm whether sound is required.

We also use Anthropic's API for a second purpose. It sorts replies from our business contacts (Section 03, part E). For that, the subject and body of the reply are sent to Anthropic. This is our own business email, not survey data.

Anthropic keeps what we send, for both purposes, under its own terms. At the time of writing, its published position is that it deletes inputs and outputs within 30 days of receipt, and may keep them for up to two years where its systems flag content as breaching its usage policy. We do not have a zero retention agreement with Anthropic. We do not keep the copies sent to Anthropic. We keep the AI assessment output as part of the survey record.

The AI result is advisory. It is shown to the surveyor and in the report as AI-assisted triage, not as an inspection finding, and it is not part of the tamper-evident record. We do not use it to make decisions about individuals. Decisions about repairs or action are made by the customer's staff. Our use of AI is assistive, not determinative.

05. Offline processing

Sandford Site Scan is designed for use where there is little or no signal, including depots, basements and underground facilities. When network connectivity is unavailable:

Photos and video are taken, faces are covered on the phone, and the photos, video and survey details are stored on the phone in a queue
The AI check cannot run offline. Photos are checked when the phone is back online, and until then the report shows them as not checked
Nothing is sent until the phone has a network connection. The queue then sends to our servers automatically
Survey data stays on the phone, in the app, after it has been sent, until the app is removed. There is no clear-data button in the app, and the app adds no encryption of its own on the phone (see Section 09)

06. Who we share data with

Recipient	Purpose	Location
Customers	Survey results, reports and audit trail for their own surveys	UK / EU
Anthropic	First, AI vision processing of survey photos and video frames via the Claude API (Section 04). Second, sorting replies from our business contacts: the subject and body of the reply are sent (Section 03, part E)	United States
Google Cloud Platform (Google)	Hosting and data storage: Firestore database, Cloud Storage (photos, videos and files), our server functions, scheduled jobs, and the pages used to accept organisation invitations	United Kingdom (London region)
Google (Firebase Authentication and App Check)	Sign-in of users and checking that requests come from the genuine app	United States and other countries where Google operates
Google Workspace (Google)	Runs our sandford.digital email inboxes, including hello@sandford.digital and privacy@sandford.digital, and our documents	United States and other countries where Google operates
Postmark	Sending our emails, such as invitations to join an organisation and notifications. It receives the recipient's email address and the message	The provider is based in the United States
Ideal Postcodes	Address lookup: the address or postcode typed by the surveyor is sent to find the matching property	United Kingdom
Apple and Google (speech recognition)	Turning dictated voice notes into text, where the surveyor uses dictation. The device operating system may send the audio to Apple or Google for this. We never receive the audio	United States and other countries where Apple and Google operate
Expo	Checking for and delivering app updates	United States
Alchemy	Blockchain network access used to publish the fingerprint (hash only) described in Track B. No photos, notes or other personal data are sent	United States
Public blockchain (Arbitrum One) and its network services	The fingerprint is published on this public network, where anyone can read it. The verification page reads it through a public network service, which sees the visitor's IP address	Global, public
Cloudflare	Hosting of the public verification page, and domain name (DNS) services	Global network; the provider is based in the United States
Sentry	Error and crash reporting from our servers (technical error details, which may include identifiers such as a user or request ID; we remove email addresses and IP addresses before sending)	European Union
Netlify (website hosting provider)	Hosting of our websites and their server logs: IP address, browser and pages requested	Global network; the provider is based in the United States
Google Fonts (Google)	Supplying the font used on pages of sandford.digital, which sends the visitor's IP address to Google on each page load	United States and other countries where Google operates
Apple App Store and Google Play	The app listing, privacy declarations and download data, under their own terms	United States

We do not sell, rent, or trade personal data. We do not share personal data with advertisers or data brokers. If we change a provider, we will update this table.

International transfers

Some of these providers are in the United States, or may handle data there. For these transfers we rely on each provider's standard terms for international transfers and, where the provider is certified, the UK data bridge (the UK extension to the EU-US Data Privacy Framework). We use each provider's standard online terms and have not negotiated separate agreements.

07. How long we keep data

Track A: evidence content

Evidence content is the substance of a survey: photos, video, sound, notes and answers, location, spatial and session metadata, and AI assessment output.

Survey records (photos, video and sound, notes and answers, location with height, address, session details and AI assessment output) are kept for six years from the date of the survey, then deleted. We review our records at least once a year to find any that are due for deletion
Earlier if the customer instructs, or if a valid erasure request requires it.
Audit log, device identifiers and technical logs are generally kept for 90 days. Some are deleted automatically. Where that is not yet automatic, we delete them by hand at least once every 12 months
The device identifier recorded in a survey record stays with that record
Unredacted original photos are not kept. The covered photo is the record
Surveyor, organisation and portal account details and name: account details are kept until the account is deleted. We delete any account that has not been used for six years, and we review accounts at least once a year to find them
Contact form record: 12 months (see part D). Business contacts: until you ask us to stop contacting you or to delete your details
Data on the phone: stays in the app until the app is removed
Copies sent to Anthropic: held under Anthropic's own terms (Section 04)

Survey records are kept for six years from the date of the survey. This matches the limitation period for most claims in England and Wales (Limitation Act 1980) and our customers' own record-keeping duties. As processor we follow the customer's written instruction, so a customer may instruct earlier deletion or return, within 30 days of termination. Records are deleted after the period ends, or sooner on instruction (see Section 08). Where a customer asks us to delete or return records, we will do so within one month of the request.

Backups and recovery features of our hosting provider may keep deleted data for up to 7 days after deletion.

Track B: tamper-evident fingerprint

We create a tamper-evident fingerprint of every sealed survey record, a short code. The fingerprints of the records sealed since the last run are combined into one short code, which we publish permanently on a public blockchain (Arbitrum One) at frequent intervals, currently nightly and expected to become more frequent, so a very recent record may not yet be published. A sealed record covers the photos, the location (including the phone's raw height reading) and time of capture, the surveyor's name, and the surveyor's answers and notes. The content stays in our own secure database; only the fingerprint is published, and no content or personal data is on the blockchain. What the fingerprint does is let someone, such as a regulator, an insurer or a court, check that the sealed record in our database has not been quietly changed since it was sealed, without having to take our word for it. If a value in the record is erased (for example, if someone asks us to remove their data), the fingerprint remains on the blockchain, but the record can no longer be verified against it. The fingerprint only works as proof for as long as the record it checks still exists unchanged.

08. Your rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

Access — request a copy of personal data we hold about you
Rectification — request correction of inaccurate personal data
Erasure — request deletion of your personal data where there is no legitimate reason for continued processing
Restriction — request that we restrict processing of your personal data in certain circumstances
Portability — request transfer of your personal data to another controller in a structured, machine-readable format
Objection — object to processing based on legitimate interests
Automated decisions — you have the right not to be subject to solely automated decisions that have legal or significant effects on you

Data we control. For our own data (Section 01), contact us at privacy@sandford.digital. We will reply within one month.

Survey data. Where a customer is the controller, your request should go to the customer. If you send it to us, we will pass it to the customer within 5 working days and tell you we have done so. Our records are organised by property, not by person, and we do not search them by person, so it helps to tell us the property and the approximate date of the survey.

Deleting your account and data

To ask for your account or your data to be deleted, email privacy@sandford.digital. We will reply within one month, saying what we will delete, what we have to keep and why, and when. We may have to keep survey records that you helped create, including your name as recorded in them, because they are sealed evidence your organisation relies on (kept for six years from the date of the survey), and the fingerprints of those records that are published on a public blockchain, which hold no personal details and cannot be changed (see Section 07).

Location. You can decline location in the app, and turn it off again in the phone's settings.

Complaints

If you are unhappy with how we have handled your personal data, please tell us at privacy@sandford.digital. We will acknowledge your complaint within 30 days and tell you what we find. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

09. Security

Data is encrypted in transit using TLS
Data held in Google Cloud is encrypted at rest by Google. The app adds no encryption of its own on the phone, so data stored on the phone relies on the phone's own protections
Our servers check the surveyor's sign-in on every request. Access is controlled by organisation and role. We are moving every account into an organisation so that each customer's survey data is kept separate from other customers', and accounts created before that move are being transferred
We use Google's App Check to check that requests come from the genuine app. It is currently in monitoring mode, which records requests that fail the check but does not yet refuse them. We also limit repeated requests
Secret keys for our servers, including the key for the AI service, are held in Google's secret storage on the server, not in the app.
Access to client data is restricted to authorised personnel only
We keep an audit log of administration actions
We conduct regular security reviews of our infrastructure and codebase

10. Cookies

sandford.digital sets no cookies and uses no analytics or advertising cookies. Pages of sandford.digital other than this one load a font from Google Fonts, which is not a cookie but sends your IP address to Google (see Section 06).

Our sign-in pages (the client portal at portal.sandford.digital, insights.sandford.digital, and the organisation pages hosted by Google Firebase) use a cookie or similar browser storage only to keep you signed in. This is strictly necessary for the pages to work and does not require consent under PECR.

The Sandford Site Scan mobile application does not use cookies, and it contains no advertising and no analytics or crash-reporting tools. The app stores data on the phone, as described in Section 05.

11. Changes to this policy

We will update this policy as our products and legal obligations evolve. Material changes will be communicated to active customers by email with 30 days notice before taking effect. The version number and last updated date at the top of this page will always reflect the current version.

12. Contact us

Data protection enquiries

Sandford Digital Limited, company number 17400537

Registered office: 10 London Lane, London E8 3PR

Email: privacy@sandford.digital

For general enquiries: hello@sandford.digital