Privacy Policy

This Privacy Policy explains how Curcle Ltd (company number 17260381), a company registered in England & Wales and a wholly-owned subsidiary of Herridge Ventures ("Curcle", "we", "us"), collects and uses personal data in connection with the Curcle field-service management platform, comprising the Curcle web application and the Curcle mobile app (the "Service"). For the personal data of our own account holders we act as a data controller under the UK GDPR and the Data Protection Act 2018. Where we process personal data within a customer's business records on that customer's behalf, we act as a processor, and that processing is governed by our Data Processing Agreement.

1. Who we are

Curcle Ltd, Crown Chambers, 7 Market Place, Melksham, SN12 6ES, United Kingdom. Email: support@curcle.co.uk. Telephone: +44 7860 503886.

2. Who the Service is for

The Service is a private business tool used by the staff, approved sub-contractors and customer-portal users of businesses that subscribe to Curcle. It is not intended for general public use and requires an account to access any functional area.

3. What we collect

• Account information: name, email address, telephone number, role, employer, and profile photo (if uploaded).
• Job & compliance data: jobs assigned to you, site addresses you attend, test results, certificates, timesheets, signatures, notes, photos and documents you capture.
• Location: precise GPS coordinates only at the moments you check in to or out of a job, and during lone-worker shifts you have opted into. We do not background-track location.
• Device & session information: IP address, browser / device type, session cookies, and last-active timestamp.
• Audit logs: records of security-relevant actions (logins, permission changes, deletions) for compliance.

4. Why we process it (lawful basis)

• Contract: to provide the Service to our subscribers, their staff, sub-contractors and customers.
• Legitimate interests: securing the platform, preventing fraud, and producing management reports.
• Legal obligation: retaining safety certificates and financial records for the periods required by UK law.
• Consent: for optional features such as lone-worker check-ins, which you can withdraw at any time.

5. Who we share it with

We do not sell your data and we do not share it with third-party advertisers. We use a small number of trusted processors to run the Service:

• Replit, Inc. — application hosting and managed database.
• Google Cloud Storage (via Replit) — encrypted file storage.
• Stripe — subscription payment processing.
• Resend — outbound transactional email.
• Google Maps — optional in-app map view.

Customer-facing certificates and invoices are shared with the customer they relate to. Where required, data may be shared with accountants, auditors or regulators. Some of these processors are located outside the UK; where data is transferred internationally we rely on appropriate safeguards such as the UK International Data Transfer Agreement or equivalent mechanisms.

Website product adviser: the optional adviser uses reviewed public product answers. To interpret some questions, it sends the latest question with obvious contact details and credential assignments removed, plus approved prior-topic references, to an AI provider; prior visitor messages and arbitrary assistant text are not sent as history. It has no access to Curcle customer accounts or business records. Curcle does not save adviser transcripts; the conversation and optional fit answers are held only in your browser's memory until you clear them, reload or leave. We retain anonymous topic and fixed-choice feedback counts to improve public information. A short-lived answer receipt prevents duplicate feedback; it is not a visitor identity. If you choose to send an enquiry and tick the consent box, only the editable details you submit are saved through our standard lead process so we can reply; this does not enrol you in any newsletter. Fit details or a question summary are included only if you choose to add them.

6. How long we keep it

• Active account data — for the life of your account.
• Job and certificate records — a minimum of 6 years where required by law.
• Audit logs — configurable, with a default of 365 days.
• Anonymised analytics — retained indefinitely as they no longer identify you.

7. Your rights

You have the right to access, correct, export or delete your personal data, to restrict or object to processing, and to lodge a complaint with the UK Information Commissioner's Office (ICO). Logged-in users can export or request deletion of their data from the in-app Privacy & GDPR page. Otherwise, please email support@curcle.co.uk.

8. Security

All traffic is encrypted in transit over TLS. Passwords are hashed with bcrypt. Sessions expire after 30 minutes of inactivity. Role-based access controls limit who can see what, and all security-relevant actions are written to an audit log.

9. Children

The Service is not intended for, and is not knowingly used by, anyone under 16.

10. Changes to this policy

We will update this policy if the way we handle personal data changes. Material changes will be notified inside the app.

11. Contact

Questions about this policy or about your personal data should be directed to support@curcle.co.uk.