Privacy Policy
This policy explains how G8 ONE Limited ("G8 ONE", "we", "us") handles personal data when you visit g8-one.com, contact us, or use the G8 ONE app at app.g8-one.com.
1. Who we are
G8 ONE Limited is registered in England and Wales (company number 17510021). Registered office: Hilden Park House, 79 Tonbridge Road, Hildenborough, Kent, England, TN11 9BH. Contact for anything about privacy: support@g8-one.com. We have not appointed a Data Protection Officer because the law does not require one for our business; privacy questions are handled by our directors.
2. Controller and processor
- Customer data (we are the processor). Businesses that subscribe to G8 ONE ("customers") decide what health and safety records they keep: RAMS, sign-offs, site sign-ins, permits, inspections, incidents, training, timesheets and so on, including details of their staff, operatives, subcontractors and visitors. For this data the customer is the controller and we act on its instructions under our Data Processing Agreement. If you're a worker and want to use your rights over these records, contact your employer; if you contact us, we'll pass your request to them.
- Our own data (we are the controller). Website visitors, people who fill in our demo form, our customers' account users (name, email, role, sign-in details), billing contacts and support enquiries.
3. What we collect and why
| Who / what | Data | Why we use it | Lawful basis |
|---|---|---|---|
| Website visitors | IP address and browser details in server logs; analytics identifiers only if you choose “Allow” | Run and secure the website; understand how it's used | Legitimate interests; consent for analytics |
| Demo and trial requests | Name, company, email, phone (optional), trade, team size, message | Reply to you, set up your trial or demo | Legitimate interests / steps before a contract |
| Account users | Name, work email, company, role, password (stored hashed by our authentication provider), two-factor settings, sign-in times, preferences | Provide and secure the service | Contract; legitimate interests (security) |
| Billing | Billing contact, company name, plan, invoices. Card and bank details are collected and held by Stripe – we only see the card brand, last four digits and expiry | Take payment, keep accounting records | Contract; legal obligation |
| Customer data | Whatever the customer records in G8 ONE (see section 2) | Provide the service to the customer | Processed on the customer's instructions |
| Location at site sign-in/out | If the employer switches it on: device location once at the moment of sign-in or sign-out, its accuracy and the distance to the site. Never tracked in the background | Confirm attendance and support emergency roll calls | Processed for the employer (controller); deleted after 90 days |
| AI features | The text, photos, video frames or documents you choose to send to an AI feature | Produce the suggestion you asked for | Processed for the customer; see section 5 |
| Support | Your emails and what you tell us | Answer questions and fix problems | Legitimate interests |
| Error monitoring | Technical error reports (browser, device type, page, error). Optional session replay with all text and inputs masked, only if a signed-in manager chooses “Allow” | Find and fix bugs, keep the service secure | Legitimate interests; consent for session replay |
We don't sell personal data, use it for advertising or make decisions about people based solely on automated processing that have legal or similarly significant effects.
4. Where data is stored and how it's protected
Customer data, account data and uploaded files are stored with Supabase in the EU (Ireland). The UK recognises the EU and EEA as providing adequate protection under the UK's adequacy regulations, so this does not need any extra transfer mechanism. Data is encrypted in transit (TLS) and at rest. Each customer's data is kept separate by database row-level security, access is role-based, and two-factor authentication is available for managers and admins. See our Security page for more.
Some of our providers are based in, or can access data from, the USA (for example Netlify, OpenAI, Stripe and the consent-based analytics tools). Where that happens we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK–US data bridge for certified providers.
5. AI features
When you use an AI feature, what you send is passed through Netlify's AI Gateway to OpenAI to generate a response. Under OpenAI's API terms this data is not used to train its models, and it may be kept by OpenAI for a limited period (up to 30 days) for abuse monitoring. Results are suggestions only and nothing is saved in G8 ONE until a person accepts it. Don't send health information or other sensitive personal data to AI features unless you need to.
6. Who we share data with
We use carefully chosen service providers ("sub-processors") to run G8 ONE. They may only use the data to provide their service to us. The full list, with locations and safeguards, is on our Sub-processors page. We may also share data if the law requires it, to protect our rights or users' safety, or with a buyer if our business is sold (in which case this policy continues to apply).
The main providers, what they do and where they process data:
- Supabase – Database, sign-in and authentication, file storage (photos, documents), server functions. All customer data and account data. Location: EU – Ireland (AWS eu-west-1).
- Netlify – Hosting of g8-one.com and app.g8-one.com, content delivery, serverless functions (billing, AI requests), website contact form, AI usage counters. Requests passing through (IP address, browser details), demo form entries, company IDs for usage counts. Customer records are not stored at Netlify. Location: USA, with a global delivery network.
- OpenAI (through Netlify AI Gateway) – AI features: site photo and video scans, Ask G8, AI search of the audit trail, drafting help for RAMS and COSHH, reading safety data sheets and surveys. Only what you send to an AI feature (text, photos, video frames, documents). Under OpenAI's API terms, this data is not used to train its models. Location: USA.
- Stripe – Subscriptions, card and Direct Debit payments, invoices, one-off purchases (AI credits). Billing contact name and email, company name, payment details (held by Stripe; we never see full card numbers). Location: UK, EU and USA.
- Resend – Sending account emails from noreply@g8-one.com: sign-in links, password resets, invitations, reminders. Recipient email address, name and email content. Location: EU – Ireland.
- Sentry – Error monitoring and performance; optional masked session replay. Technical error reports (browser, device type, page). Personal data collection is switched off and secret link codes are removed. Session replay only with your permission, with all text and inputs masked. Location: EU – Germany.
- Google Analytics – Visitor statistics – only if you choose “Allow” in the cookie banner. Pseudonymous identifiers, pages viewed, device and approximate location (IP anonymised). Location: EU and USA.
- Microsoft Clarity – Usage heatmaps and session insights – only if you choose “Allow”. Pseudonymous identifiers, clicks and scrolling; form inputs are masked. Location: USA.
- Google Fonts – Delivers the typefaces used in the app. IP address and browser details of the device loading the font. Location: Global.
- OpenStreetMap – Map tiles and address search (Nominatim) when you add or view a site on a map. The address or place you search for, IP address. Location: UK and EU.
- postcodes.io – Postcode lookup. The postcode only. Location: UK.
- SheetJS CDN – Delivers the spreadsheet library used for importing and exporting Excel files. IP address and browser details of the device loading the library. Your spreadsheets are processed on your device and are not sent to SheetJS. Location: USA / global.
- SDS library service (easycoshh.co.uk) – Searching for and fetching supplier safety data sheets. Product names and supplier names you search for. No personal data. Location: UK / EU (hosted on Netlify).
7. Cookies and similar technologies
We use essential storage to keep you signed in and remember your settings, and optional analytics (Google Analytics and Microsoft Clarity) only if you choose “Allow”. Details are in our Cookie Policy.
8. How long we keep data
- Account data: for the life of the account and 30 days afterwards.
- Customer data: while the customer's account is open. After a subscription ends the customer has 30 days to export its data, then we delete it from the live database. Backups age out within our provider's backup window.
- Location captured at sign-in/out: 90 days, then deleted automatically.
- Billing records: 6 years, to meet tax and accounting rules.
- Demo form entries and support emails: up to 2 years after our last contact.
- Error monitoring events: up to 90 days.
9. Your rights
Under UK data protection law you can ask for access to your personal data, and ask us to correct, delete, restrict or transfer it, or object to how we use it. Where we rely on consent you can withdraw it at any time (for analytics, use “Cookie settings” in the website footer or Settings › Account › Privacy choices in the app). Email support@g8-one.com; we'll reply within one month. We may need to confirm your identity first.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
10. Children
G8 ONE is a business service and is not intended for anyone under 16.
11. Changes to this policy
If we make material changes we'll update this page and, where appropriate, tell account owners by email before the change takes effect.