Privacy Policy
Also see our Terms of Service, Data Processing Agreement and Privacy Policy. Questions: info@kirby-projects.com.
1. Who we are
Kirby Projects is a construction and engineering project management platform operated by Kirby Digital Ltd, a company registered in England and Wales (company number 17309006) with its registered office at 106 Poynter House, Holland Park, London, W11 4TB ("Kirby", "we", "us"). We are the controller of the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO) under registration reference ZC199826.
You can contact us about privacy at info@kirby-projects.com.
2. What this policy covers
This policy explains how we handle personal data when you visit kirby-projects.com, contact us, register interest, attend a demo, or use an account on the Kirby Projects platform — that is, where we decide how and why your data is used. The Service is intended for business users and is not directed at children.
3. Project data belongs to our customers
If your details appear inside a customer's project records on the platform — for example, you are named on a permit, a quality record, a document, or a site record uploaded by one of our customers — that customer is the controller of that data and we process it on their instructions as their processor, under our Data Processing Agreement. Questions or requests about that data should be directed to the organisation running the project; we will refer any request we receive to them.
4. The data we collect
Account data — name, work email address, organisation, role, login and security data (such as authentication tokens), and the settings you choose.
Contact and enquiry data — your name, email, organisation and message when you contact us, request a demo, or use the contact form on our website.
Billing data — billing contact details, subscription plan, invoices and payment status. Card details are collected and processed by our payment provider (Stripe) and do not touch our servers.
Usage and technical data — log data such as IP address, browser type, pages visited and actions taken, used for security, debugging and service improvement.
Correspondence — emails and support messages you exchange with us.
5. Why we use it and our lawful bases
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Providing and administering accounts and the platform | Performance of a contract |
| Responding to enquiries and providing support | Legitimate interests (running our business) or steps prior to a contract |
| Billing, invoicing and account management | Performance of a contract; legal obligation (tax and accounting records) |
| Securing the service, preventing fraud and abuse, debugging | Legitimate interests (protecting our service and customers) |
| Sending service communications (e.g. changes to terms, security notices) | Performance of a contract; legal obligation |
| Marketing our services to existing customers and to business contacts who have enquired (always with an unsubscribe in every message) | Legitimate interests |
| Newsletters and marketing to new contacts who sign up to receive them | Consent |
| Improving the service using aggregated, anonymised usage information | Legitimate interests |
We do not sell personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects.
6. Who we share it with
We use a small number of service providers to run Kirby Projects: Supabase (database, authentication and storage), Vercel (application hosting), Cloudflare (DNS, security and content delivery), Resend (transactional email), Google Workspace (business email), and Stripe (payments). We share data with them only as needed for them to provide their services to us, under contracts that protect it. Our providers may change from time to time, and we will update this policy when they do. We may also share data where required by law, to protect our rights, or as part of a business sale or reorganisation (with safeguards).
7. International transfers
We aim to keep service data hosted in the UK/EU. Where a provider processes personal data outside the UK or EEA, we rely on UK adequacy regulations or appropriate safeguards such as the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. If a provider changes its processing locations, we will ensure an appropriate safeguard is in place before the change takes effect.
8. How long we keep it
Account data — for the life of the account and up to 90 days after closure (backups clear on our normal cycle).
Enquiry and marketing contact data — up to 24 months after our last interaction with you.
Billing and tax records — 6 years plus the current financial year, as required by law.
Security and technical logs — typically 12 months or less.
Retention periods may be extended where reasonably necessary for litigation, a regulatory investigation, or the establishment or defence of legal claims.
9. Security
We protect personal data with technical and organisational measures including encryption in transit and at rest, role-based access controls, multi-factor authentication on administrative accounts, and appropriate backup procedures. No system is perfectly secure, but we take the protection of your data seriously and review our measures as the service grows.
10. Cookies
Our marketing website is designed to work without non-essential cookies. The platform uses strictly necessary cookies and similar technologies to keep you signed in and to keep the service secure. If we introduce analytics or other non-essential cookies, we will publish a separate Cookie Policy and ask for your consent first.
11. Your rights
Under UK data protection law you have rights to access your personal data, to have it corrected or erased, to restrict or object to our processing of it, to data portability, and to withdraw consent where consent is our basis. To exercise any right, email info@kirby-projects.com; we may need to verify your identity before acting on a request, and we will respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), though we would welcome the chance to resolve any concern first.
12. Changes to this policy
We will update this policy as the service evolves and will post the new version on our website, with notice to account holders for material changes. This version is dated 16 July 2026.