Policies
Privacy notice
This notice explains what personal data we hold when you use StrataScope or this website, why we hold it, who else receives it, how long we keep it, and what you can do about it. It is written for the people who use StrataScope at work: ground investigation contractors and their clients.
1Who we are
StrataScope is provided by MTE Solutions Ltd ("we", "us"). The company details are in the footer of every page. For anything about your personal data, email [email protected].
We have not appointed a data protection officer. [TO CONFIRM: solicitor, that one is not required for our size and activity]
If we offer StrataScope to organisations in the European Union, including Ireland, we may need a representative there. [TO CONFIRM: whether the service will be offered in the EU, and if so the representative's details]
2Our two roles
We decide how your account data is used. For your sign-in details, the record of what you did in the tool, and any enquiry you send us, we are the controller under the UK GDPR.
We act for our customers on job data. The files and records you put into a job (AGS files, borehole logs, laboratory results, photographs, schedules, report details) belong to the organisation that uploads them. For any personal data in them, for example the name of the logger, driller or engineer on a log, that organisation is the controller and we process it only on their instructions. The terms covering that processing are [TO COMPLETE: data processing terms, to be agreed with each customer]. If you want to use your rights over a job's content, ask the organisation that holds the job first; we will help them answer.
3What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Email address, role (contractor or client), the access code issued to you, whether the account is switched on | You, or the administrator who set up access. A contractor sharing a job names the client account it is shared with. |
| Sign-in details you give | Name and company, if you enter them at sign-in | You |
| Activity record | Time and email of each sign-in, each AI read you ask for, and your acceptance of the terms with the version you accepted | The tool, as you use it |
| Security data | Your IP address, held in the server's memory only to slow repeated failed sign-ins, and not written to disk. Hosting and network logs [TO CONFIRM: what the hosting provider and Cloudflare log, and for how long] | Your browser's connection |
| Job content (processed for our customer) | Names, initials and signatures on logs and certificates, client and site names, site addresses and positions | The organisation that uploads the files |
| Enquiries | Your name, email, company and what you wrote | You |
This website (the landing and policy pages) sets no cookies, runs no analytics and loads nothing from any other company: its fonts and images are served from the site itself. The tool's cookies and browser storage are listed on the cookies page.
We do not ask for special category data (such as health or ethnicity), and you should not upload it.
4Why, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Setting up your account, signing you in, and providing the tool | Contract, where you are our customer. Where your employer is our customer, our legitimate interest in providing the service they asked for. |
| Keeping the service secure: limiting sign-in attempts, investigating misuse | Legitimate interests (security of the service and its users) |
| Recording that you accepted the terms, and counting AI reads (each one costs us money) | Legitimate interests (evidence of acceptance; controlling cost) |
| Answering an enquiry | Legitimate interests (replying to you) |
| Keeping business and tax records | Legal obligation |
We do not send marketing email, and we do not sell personal data. Where we rely on legitimate interests you can object (see your rights).
6Transfers outside the UK
Anthropic is based in the United States, so a file sent for reading leaves the UK. Anthropic's Data Processing Addendum, which forms part of its Commercial Terms, includes the European Commission's standard contractual clauses with the UK addendum for such transfers. [TO CONFIRM: solicitor, the transfer mechanism we rely on and the transfer risk assessment]
Where the rest of our data is stored depends on the hosting region. [TO CONFIRM: hosting region; if outside the UK, the safeguard]
7How long we keep it
| Data | How long |
|---|---|
| Account details | While the account is open, then [TO CONFIRM: period] |
| Activity record | [TO CONFIRM: period]. Today the record has no automatic expiry. |
| Job content | As long as our customer keeps the job, then [TO CONFIRM: period]. Today, deleting a project from the shelf withdraws it and its sharing. A project that never issued a document is erased from the server at once. A project that issued documents keeps its folder on the server, so that an issued register is never destroyed by accident; ask us and we will delete it. |
| Files sent to Anthropic for reading | Anthropic's published policy is to delete API inputs and outputs within 30 days, longer only where needed to enforce its usage policy or where the law requires. |
| Sign-in attempt counts (IP address) | In memory only; gone when the server restarts |
| Enquiries | [TO CONFIRM: period] |
| Business and tax records | As the law requires |
8AI and automated decisions
StrataScope uses an AI model to read documents about the ground, not to make decisions about people. Nothing it does has a legal or similarly significant effect on you, and there is no profiling. Neither we nor Anthropic train AI models on the content you upload. The details are on how we use AI.
9Your rights
Under the UK GDPR you can ask us to:
- give you a copy of your personal data (access);
- correct it (rectification);
- delete it (erasure);
- limit how we use it (restriction);
- stop using it where we rely on legitimate interests (objection);
- give it to you, or another provider, in a machine-readable form (portability).
Email [email protected]. We may ask you to confirm who you are. We will answer within one month, and tell you if we need longer and why. These rights are free to use.
10Complaints
If you are unhappy with how we have used your personal data, tell us first at [email protected]. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
You can also complain to the Information Commissioner's Office, the UK regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
11Keeping it secure
Sign-in cookies are signed and cannot be read by page scripts; each job's record is kept apart from every other; a client sees only the jobs shared with that one account; the AI key never reaches a browser. The security page says more, and how to report a weakness.
12Changes to this notice
When we change this notice we change the date and version at the top. If a change matters to how your data is used, we will tell account holders before it takes effect.