Privacy Policy

01Scope

This policy covers personal data handled by ScopeQS when you visit the site, create an account, are invited to a company tenant, or use the platform.

Where a company tenant uploads project material about its own staff or third parties, that organization decides why and how the data is used and ScopeQS processes it on their behalf.

02What we collect

We collect only what the platform needs to operate:

• Account details — name, email address, mobile number and country, provided at signup or when accepting an invitation.
• Company provisioning details — legal name, commercial registration number, and the name, email and phone number of the authorized representative.
• Authentication data — a hashed password and session identifiers. Passwords are never stored in readable form.
• Governance records — the roles you hold, who assigned them, who confirmed them, and the invitations sent to you.
• Activity records — an audit entry for each governed action, recording the actor, the role acted under, the affected record and the time.
• Work content — drawings, bills of quantities, rates and project records you upload.
• Approximate country, derived from the network address of your request, used to preselect the country and dialling code on the signup form. It is not stored.

03Why we hold it

Account and authentication data is held to give you access and keep that access secure. Provisioning details are held to verify an organization before a tenant is created — a deliberate control, not a marketing exercise. Governance and audit records exist so that every action taken under a role can be attributed, which is the core purpose of the platform. Work content is held to provide the service you are using.

04Who processes it

ScopeQS uses a small number of processors, each handling data only to deliver its part of the service:

• Supabase — database, authentication and file storage.
• MailerSend — delivery of transactional email such as invitations, confirmations and activation notices.
• The hosting provider serving this deployment.

05How it is separated and secured

Tenants are isolated at the database level, and that isolation is asserted by an automated test rather than assumed. Platform administration is a separate authority from customer data access: platform staff can see provisioning metadata and counts, and are not granted access to tenant business records.

Authority is re-read from the database on every request rather than trusted from a token, so a forged credential cannot widen what an account can reach.

06Retention

Account and work content is retained while the account is active. Governed records are deactivated or archived rather than erased, so history stays coherent.

Audit entries are append-only: they cannot be edited or deleted by any role, including platform administrators and ScopeQS itself. This is a deliberate integrity property, and it limits what can be removed on request — see the next section.

07Your rights

Subject to local law, you may request access to your personal data, correction of inaccurate data, a copy in portable form, or deletion.

Deletion requests are honoured for account and content data. They cannot remove audit entries, which record that an action occurred and by whom; where the law requires erasure we will discuss what can be minimised without destroying the integrity of the trail.

If you were invited to a company tenant, address requests about that organization's records to the organization; we will support them in responding.

08Cookies

ScopeQS sets a session cookie to keep you signed in, and a cookie recording which role a session is currently acting as. Both are necessary for the platform to function. No advertising or third-party tracking cookies are set.

09International transfers

Data may be processed in the regions where our processors operate. The operating entity is responsible for confirming the transfer mechanism applicable to its customers before this policy is relied upon.

10Contact

Questions, or a request about your data, can be sent to sales@scopeqs.com. A named data controller and, where required, a data protection representative must be stated here before this policy is published for real customers.