Site Readiness privacy notice
Version 1 ยท 27 October 2026
In short. We hold your name and work email so you can sign in, a record of what you do in the service so it stays secure and your company can see who decided what, and anything you choose to tell us. We use a few suppliers to run the service; one of them, WorkOS, which signs you in, holds your name and email in the United States. We do not sell your information, use it for advertising, or set tracking cookies. You can ask to see, correct or delete it, object to how we use it, or complain to us or to the ICO.
1. Who we are
This notice is from Thri5 Project Consulting Ltd, trading as ThriveFSM, a company registered in England and Wales with company number 11188445, whose registered office is Ground Floor Dearing House, 1 Young Street, Broomhall, Sheffield S1 4UP. We are the controller of the personal information described here.
We have not appointed a data protection officer, because the law does not require one for what we do. For anything in this notice, contact tom@thri5.co.uk, or write to us at the registered office.
This notice covers the Site Readiness Service, including its preview. Our websites have their own notice.
2. Your right to object
You can object at any time to our using your personal information on the basis of our legitimate interests, which is the basis for almost everything in this notice (section 4). Tell us at the address in section 1. We will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the information to establish, exercise or defend a legal claim. Because the service cannot be used without signing in, objecting to section 4's first purpose will usually mean closing your access.
3. What we hold about you, and where it comes from
| What | Details | Where it comes from |
|---|---|---|
| Who you are | Your name, your work email address, your company, and your role in the service | From you, or from the person who asked us to invite you, such as a colleague |
| How you sign in | When you signed in and by which method, your browser and device, and your IP address | Collected by WorkOS when you sign in |
| What you do | An audit record of actions such as signing in, decisions recorded, people invited and settings changed, each with who and when; the decisions you record, with who made them and the reason you gave; how many checks you ran | Created as you use the service |
| What you tell us | Feedback you send from the planning screen, with the page you sent it from; emails between you and us | From you |
| Security records | Requests to the service, with IP address and time | Collected by our hosting provider, Cloudflare |
The job data your company checks (job references, locations, times and the kind of work) is your company's information, not information about you. Our preview terms ask your company not to include anything that identifies a person. If any personal data is included anyway, we handle it on your company's behalf under those terms, and your company's own privacy notice applies to it.
When you open a job list on the planning screen, the file stays in your browser. Columns such as customer and notes are shown on your screen but are not sent to us.
We do not ask for, and ask you not to give us, information about health, ethnicity, religion, politics, trade union membership, sexuality or criminal records.
4. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| To run your account: signing you in, showing you your company's work, and keeping a record of who decided what, so that your company can rely on it | Our legitimate interests in providing the service your company asked to use, and your company's in knowing who made each decision |
| To keep the service and your company's data secure: detecting misuse, investigating problems, limiting traffic, and keeping the audit record | Our legitimate interests in protecting the service, our customers and their data |
| To improve the service from your feedback and from how it is used | Our legitimate interests in making the service better |
| To contact you about the preview: your invitation, changes to the service, its end, and whether your company would like to carry on | Our legitimate interests in running the preview and our business |
| To measure how accurate the service is, from checks, decisions and what was found on site, with names and email addresses removed | Our legitimate interests in knowing whether the service works, and showing it |
| To keep a record of which version of the terms you accepted, and to deal with any complaint or legal claim | Our legitimate interests in being able to show what was agreed and to defend our position |
| To do what the law requires, such as answering a request about your rights | Legal obligation |
We have weighed these interests against yours: the information is work contact details and a record of work done, the uses are those you would expect from a business service you have been invited to use, and you can object (section 2). Our assessment is available on request.
We will not send you marketing emails without your agreement, and we do not sell your information or use it for advertising.
What happens if you do not give us your information. You need to give a work email address to sign in. Without it you cannot use the service. Everything else is optional.
Decisions by machine. The service answers questions about sites and roads, not about people. We make no decisions about you by automated means that have a legal or similarly significant effect on you. WorkOS may automatically block a sign-in that looks like an attack; if that happens to you, contact us.
5. Who we share it with
We share your information only with the suppliers who help us run the service, each under a contract that requires them to protect it and use it only on our instructions:
| Supplier | What they do for us | Where |
|---|---|---|
| WorkOS, Inc. | Signs you in, and holds your name, email address and sign-in records | United States |
| Neon, Inc. (part of Databricks) | Hosts our database, which holds your account, your company's work and the audit record | London, United Kingdom |
| Cloudflare, Inc. | Runs the service and delivers it to your browser, and keeps short-lived request logs | Worldwide network; logs held by Cloudflare |
| GitHub, Inc. (Microsoft) | Runs our scheduled checks and reports, which read the database; holds our code, but no customer information | United States |
| Microsoft | Our email, so it holds emails between you and us | United Kingdom |
| Anthropic PBC | An AI assistant we use to help build and run the service, which can read our email and documents | United States |
We may also share information if the law requires it, to protect our rights or someone's safety, or with a buyer if our business is sold, who would have to treat it in line with this notice.
Your browser also talks directly to three other services when you use the planning screen. They receive your IP address and what your browser asks them for, and each is responsible for that information under its own privacy policy:
- OpenStreetMap's map servers, run by the OpenStreetMap Foundation, which send the map tiles for the area you are looking at;
- postcodes.io, a free postcode lookup run by Ideal Postcodes, which receives any postcode you search for;
- cdnjs, run by Cloudflare, which sends the code that draws the map.
6. Information sent outside the UK
WorkOS holds your name, email address and sign-in records in the United States. That transfer is protected by the European Commission's standard contractual clauses with the UK's International Data Transfer Addendum, in WorkOS's data processing agreement. Any other supplier that handles personal information outside the UK does so under the safeguards UK data protection law requires. Our database is in London. You can ask us for a copy of the safeguards.
7. How long we keep it
| What | How long |
|---|---|
| Your account, your company's work and decisions, the audit record, and your feedback with your name on it | While your company uses the service. If a preview ends and your company does not carry on, 90 days after it ends. Earlier if your company asks. |
| Feedback | After that, kept without your name or anything else that identifies you, to improve the service. |
| Sign-in records held by WorkOS | Until we delete your account with them, which we do when we delete your company's data (the first row above) |
| Request logs held by Cloudflare | Seven days |
| The record of which terms you accepted | Six years after your access ends, the period in which a legal claim could be made |
| Emails between you and us | Six years, as ordinary business correspondence |
| Backups of our database, and our test copy of the service | Deleted information leaves both within 14 days |
8. Your rights
You have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct it if it is wrong or incomplete;
- ask us to delete it;
- ask us to restrict how we use it while a concern is looked into;
- object to how we use it (section 2);
- where it applies, ask for it in a form you can take elsewhere.
These rights have some exceptions. We will reply within one month, which the law lets us extend by two further months for a complex or repeated request, in which case we will tell you why. There is no charge. We may ask you to confirm who you are first.
Some information about you is also your company's record, such as a decision you recorded. If you ask us to delete it, we will remove your name and email address from it and keep the decision itself for your company, unless the law requires otherwise.
9. Complaints
If you are unhappy with how we have handled your personal information, please tell us first, at the address in section 1, by whatever means suits you. We will acknowledge your complaint within 30 days, look into it, keep you told how it is going, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commission (the ICO), the UK regulator for data protection, at any time: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or by post to the Information Commission (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
10. Cookies and your browser
The service sets only what it needs to work:
| What | Why | How long |
|---|---|---|
| A sign-in cookie | Keeps you signed in. Strictly necessary. A second one lasts only while you sign in. | Up to 12 hours, ending after an hour unused; the second, ten minutes |
| The job list you are working on | Kept in your browser so that a reload does not lose your work, including decisions not yet sent. It is not sent to us. | Until you close the tab |
| Your layout | The widths you drag the planning screen's panels to, kept in your browser and never sent to us | Until you press "Reset layout" at the foot of the planning screen, or clear your browser's data for the site |
WorkOS sets its own cookies on its sign-in pages, to sign you in and to protect against attacks. We do not use analytics, advertising or tracking cookies.
11. Changes to this notice
We will update this notice when what we do changes, give each version a number and date, and tell you by email or in the service before a change that matters to you.
This version: 1, published 27 October 2026.