App privacy notice

AECAI LTD ("AECAI", "we", "us") is a company registered in Northern Ireland, number NI736281, whose registered office is 78 Chapel Street, Newry, Northern Ireland, BT34 2DN. We provide software for inspecting structures and writing inspection reports, through our website, our web console (app.aecai.co.uk) and our mobile app.

For any question about this notice or your data, email [email protected] or write to the address above.

• We are the controller for: our website and its enquiry forms; the accounts of people who use AECAI; billing; security records; and de-identified training data where a customer has opted in (section 6).
• We are a processor for the inspection data our customers put into AECAI: photographs, answers, findings and reports. The customer (usually an engineering firm) is the controller of that data and decides what is collected and why. If your personal data appears in a customer's inspection records, please contact that customer first; we will help them respond to you.

The website (aecai.co.uk)

Pages you request and your IP address, held briefly in the logs of our hosting provider (Netlify) and of Cloudflare, which sits in front of the site. We use no analytics or advertising tools and the website sets no cookies. If you use the contact form we hold your name, work email, company, phone number if you give it, the topic and your message.

The web console (app.aecai.co.uk)

For each user (staff of our customers): name, work email, role, workspace membership; sign-in records (the one-time code, the device and browser you chose to trust, your IP address in security logs); what you do in AECAI (an audit log); support messages. We are the controller of this account data.

For the inspection data users enter: whatever the customer records, commonly site contacts' and inspectors' names, notes, answers, reports, and photographs of sites, which can show people or vehicles by chance. We are the processor of this data.

The console's map asks OpenStreetMap's servers for map pictures, so your IP address and the area you are looking at reach OpenStreetMap. When you type a postcode, it is sent to postcodes.io to find the place. The console sets only the cookies it needs to keep you signed in (see the Cookie Policy).

The phone app

The app asks for your camera and photos (to add photographs to an inspection) and, if you allow it, your location (to record where a photograph was taken). You can refuse or turn these off in your phone's settings and the app still works. Work captured offline is stored on your phone until it uploads, then removed from the phone after a retention period. We are the processor of what the app captures for the customer.

Billing contacts

Name, email, company, billing address and invoices. Card details are held by Stripe, never by us.

We do not knowingly collect data about children. AECAI is a professional tool for businesses, and accounts are created only by invitation.

We do not sell personal data, and we do not send marketing emails. If that changes we will ask for your consent first where the law requires it, and every marketing email will let you unsubscribe.

AECAI uses artificial intelligence to help engineers: to sort photographs into the right part of an inspection, to look for defects in photographs, to draft report wording, and to detect cracks and spalling with our own computer-vision models.

• The AI drafts and suggests; people decide. AECAI makes no decisions about people that have legal or similarly significant effects. The product has an optional approval step. We do not require that any report is approved or reviewed, and we do not check it; that is for the firm that issues the report.
• To do this, inspection photographs and text are sent to an AI provider. A firm can connect its own account with a provider (its own "key"); then the data goes to that provider under the firm's own agreement with it, and the firm chooses the provider. Some providers on offer are outside the UK and EU, and five are in China; the console shows where each is.
• If a firm has no key of its own, we use our own account with Google (Gemini), up to a monthly limit. Google is then our sub-processor.
• We use the providers' business services.

Our crack and spalling models improve when engineers review their detections. We use that review work only from workspaces whose customer has opted in. The setting is off by default, can be changed at any time, and every change is logged. Before anything is used for training:

• the photograph is copied under an anonymous name, with its embedded details (such as location and camera) removed;
• faces and vehicle number plates are blurred by automatic detection, which can miss some;
• the training set carries no workspace, inspection, site or person names, only a coarse type of location.

For this de-identified data we are the controller.

We use service providers ("sub-processors") to run AECAI. The full list, with what each does, what data it sees and where, is in Annex 3 of our Data Processing Agreement. In short: Supabase (database and files, Ireland), Vercel (console hosting), Google Gemini (AI, included key), RunPod (computer vision), Resend (email), Sentry (error reports), Stripe (payments), Cloudflare and Netlify (website), Google Workspace (company email), and OpenStreetMap and postcodes.io (map pictures and postcode lookup, contacted by your browser). Where a firm uses its own AI key, the provider it chooses is also involved.

We may also share data with professional advisers, insurers, or authorities where the law requires it, and with a buyer of our business, who would be bound by this notice.

Some providers are in the USA, and our computer-vision models can run in RunPod data centres outside the UK and EU. Where personal data leaves the UK we rely on the UK's adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, for providers certified under it) or on the UK International Data Transfer Agreement or Addendum, with a transfer risk assessment. Annex 3 of our Data Processing Agreement shows the basis for each provider. You can ask us for a copy of the relevant safeguards.

Each customer's data is kept separate from every other customer's at database level. Files are stored privately and shown to users only through links that expire within an hour. Data is encrypted in transit and at rest. Sign-in needs a password and an emailed one-time code, and access is limited to invited accounts. Details are in our Data Processing Agreement. If a breach affects you, we follow the steps in our breach process: we tell the customer without undue delay when we are the processor, and the Information Commissioner within 72 hours when we are the controller and the breach puts people at risk.

You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, and to take it elsewhere. Where we rely on consent you can withdraw it at any time. Email [email protected]. We will reply within one month.

If your data is in a customer's inspection records, we will pass your request to that customer, who decides on it, and help them.

You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to put things right first.

We will update this notice when our practices change and show the date at the top. If a change matters, we will tell our customers before it takes effect.