Privacy Notice

1. Who we are

VariationDesk Ltd is a company registered in England and Wales. This notice explains how we handle personal data when people use our website, create a workspace, use the application, receive support or are invited into a customer workspace.

For privacy questions, contact info@variationdesk.co.uk. If a customer has a separate signed agreement with us, that agreement may contain additional data-processing terms.

2. Our role

For account administration, marketing, sales, billing and support data, VariationDesk normally acts as a data controller.

For personal data uploaded into a customer workspace, such as technician details, site representative details, signatures, photographs, project references and commercial evidence, the customer normally acts as controller and VariationDesk acts as processor, unless otherwise agreed in writing.

3. Data we process

We may process user account details, names, business email addresses, company names, roles, login/session records, billing metadata, support messages and product usage information.

For B2B prospecting, we may process limited business information from public or business-facing sources such as Companies House, company websites and published professional contact details. We may use a search service to locate a likely official company website and an email-validation service to check a published professional address before outreach. This can include company name and number, trade/activity, business location, a decision-maker’s name, role and business email, factual source excerpts and URLs, validation status, outreach history, replies and marketing-objection status. We do not need special-category data for this purpose and do not intentionally collect it for prospecting.

Customer workspace data may include project details, client/main-contractor details, SOR/rate-card rows, variation records, descriptions of works, quantities, notes, photographs, voice recordings and transcripts, AI-assisted draft suggestions, user-confirmed values, signatures, PDF evidence sheets, export metadata and audit logs.

4. Why we process data

We process data to provide the VariationDesk service, authenticate users, maintain team permissions, record site variation evidence, generate evidence documents, support invoice preparation, improve reliability, prevent misuse, respond to enquiries and comply with legal obligations.

For a small early-customer learning cohort, we may use account milestones, workflow outcomes, support history and short feedback check-ins to understand onboarding, usability and business-flow improvements. We aim to derive this from normal product use rather than add unnecessary tracking or long surveys.

Taking part in product learning does not give VariationDesk permission to publish a customer's identity, logo, quote or results. If we want to create an identifiable testimonial or case study, we ask separately and record what the customer has approved. A customer can decline or withdraw that publicity permission without affecting use of the service.

We may also use limited business contact details to identify potentially relevant corporate customers and send proportionate founder-led B2B communications about VariationDesk. We record where prospect information came from, keep outreach limited, stop a sequence when the recipient replies or objects, and do not use prospecting data to make decisions that produce legal or similarly significant effects. People can ask us to stop direct marketing at any time.

5. Location, photos, voice records and signatures

VariationDesk is designed to record evidence at the point a technician takes a site photo, records an optional voice note, signs on-screen or taps submit. When location permission is granted, the app records location only for those foreground actions and does not continuously track technicians in the background. Voice recording starts only after the user chooses the voice-capture action and grants microphone permission; VariationDesk does not continuously record audio or use the microphone in the background.

Offline evidence, including a voice recording created by the user, can be saved locally on the device and synced later when connectivity returns. Session tokens are stored using protected device storage where supported. The sync process uploads data already captured by the user and does not start background location or audio capture. Confirmed voice recordings are retained as evidence with their transcript and processing history subject to the same project/evidence retention controls; an unlinked draft recording may be removed earlier under the applicable retention policy.

6. Manager magic links and verification codes

Secure manager sign-off links, email one-time codes and SMS one-time codes are service messages used to verify and complete a requested variation sign-off. They are not marketing messages.

When a manager signs through a secure link, VariationDesk may record the manager name, role, signature, timestamp, device or browser details, IP address and verification result as part of the audit trail for that variation.

7. Lawful bases

Depending on the context, we rely on contract, legitimate interests, legal obligation and consent. Contract covers providing the service. Legitimate interests covers security, product improvement, customer support, fraud prevention and proportionate B2B communications to corporate contacts where appropriate. We balance that interest against the person’s privacy rights and honour objections. Consent is used where required, for example certain optional cookies or marketing preferences. We do not treat sole traders or other individual subscribers as if they were corporate subscribers for unsolicited automated outreach.

8. Customers must control what they upload

Customers are responsible for making sure their users have authority to upload project data, photographs, names, signatures and site information. Customers should avoid uploading unnecessary personal data, sensitive data or confidential third-party information that is not needed for the variation record.

VariationDesk is not responsible for the accuracy, legality or contractual suitability of customer-entered project references, descriptions, quantities, rates, VAT treatment, signatory details or uploaded evidence.

9. Contractor Hub cross-organisation sharing

Contractor Hub lets a subcontractor workspace share controlled project and variation information with a separate main-contractor workspace. Creating a Contractor Hub account does not give the main contractor general access to a subcontractor's workspace. An authorised subcontractor owner or administrator must approve the project relationship, and each variation must then be separately released before it becomes visible to the main contractor.

A release can include the permitted variation snapshot, selected commercial values, quotation information and evidence. VariationDesk uses immutable numbered submission revisions so later internal changes are not silently exposed through an earlier release. Contractor decisions such as accepted, information requested or declined are recorded and made visible back to the relevant subcontractor as part of the commercial audit trail.

Unrelated subcontractor projects, users, accounting connections, internal comments and records that have not been expressly shared are not made available through Contractor Hub. Access can be paused or revoked at the project relationship level while retained commercial evidence remains subject to the applicable retention requirements.

A main contractor may upload or enter business contact details for its subcontractor supply chain so VariationDesk can send connection and project invitations. We use exact business-email matching where possible to identify an existing VariationDesk supplier workspace. We do not automatically connect companies merely because names look similar. A contractor-supplied supplier reference can be used to consolidate entries only inside that contractor's own supply-chain directory. If the invited email does not match the supplier's existing VariationDesk login, an authorised owner or administrator can sign in and deliberately connect the correct existing workspace.

Where an invited subcontractor does not already use VariationDesk, it may create contractor-sponsored Connected Supplier access. This is a restricted workspace limited to connected main-contractor projects and is not a full paid VariationDesk subscription. Connected Supplier workspaces can later be upgraded in place so the same company workspace and relevant collaboration history can be retained. If paid full-workspace access later ends, an eligible contractor-connected workspace may return to restricted network mode so contractor-sponsored project collaboration can continue without exposing unrelated paid-only workspace functions.

10. Optional AI Assist and voice variation intake

VariationDesk may offer optional AI drafting tools and optional voice variation intake. AI suggestions do not automatically approve, submit, send or overwrite a commercial record. A user must deliberately invoke the feature and review or confirm the result before it becomes part of a submitted variation.

When an authorised mobile user chooses Speak instead, VariationDesk can securely upload the recording, send that recording to the configured speech-to-text provider, and send the resulting transcript with limited project/form context to the configured structured-extraction provider. The original recording is retained privately as evidence, the raw transcript and AI-extracted draft remain distinguishable from the user-confirmed values, and a failed AI step does not require the original evidence to be discarded.

The voice extraction flow is designed to leave unstated information missing rather than invent people, quantities, dates, instructions, rates or commercial values. Where the workspace already contains approved SOR/rate-card data, VariationDesk may compare extracted resources against that trusted customer-controlled data and show optional match/value suggestions; the language model does not invent or supply the commercial rate. To improve construction-term recognition, VariationDesk may include a small set of approved rate-card item names as transcription vocabulary hints, but never the stored rate values. VariationDesk may also ask a small number of concise follow-up questions for important missing details. Those answers are explicit user-provided facts and remain distinguishable from the raw transcript and AI extraction. AI provider requests are made server-side, and supported response-generation requests are configured not to store the generated response for model-side application history. Customers should avoid recording unnecessary sensitive personal data, confidential third-party material or intellectual property they are not authorised to process, and remain responsible for checking the final record before submission.

11. Sharing and suppliers

We may share data with trusted suppliers who help us provide hosting, authentication, storage, email delivery, payment processing, analytics, support, accounting and security services. For B2B prospecting, a search provider may receive a limited company-level query, an email-validation provider may receive the professional email address being checked, and the dedicated outbound-mail provider may receive the minimum contact, message and reply data needed to deliver and process the founder-led sequence. VariationDesk keeps this outbound path separate from transactional customer email. Suppliers must only process data for authorised purposes.

We may disclose information if required by law, regulator, court order, professional adviser, corporate transaction, or to protect VariationDesk, our customers, users or the public.

12. International transfers

Some suppliers may process data outside the United Kingdom. Where required, we use recognised safeguards such as adequacy arrangements, standard contractual clauses, international data transfer agreements or equivalent protections.

13. Retention

We keep personal data only for as long as needed for the purposes described in this notice, including providing the service, maintaining evidence records, resolving disputes, complying with law, enforcing agreements, security monitoring and legitimate business records.

Customers are responsible for deciding how long variation evidence and site records must be retained for their own contractual, insurance, legal and accounting purposes.

B2B prospect and contact records are reviewed periodically for relevance and accuracy. We may delete or anonymise stale prospecting content while retaining a minimal suppression record, such as an email address, domain or company number, where that is necessary to make sure we respect a previous objection and do not contact the person or company again.

14. Account deletion and retention requests

Users can start an account deletion request from the mobile app settings screen or from the public account deletion page linked on this site. VariationDesk logs the request immediately and may need to verify identity, workspace authority or contractual ownership before completing deletion.

Some commercial evidence, finance records, audit logs or tax records may need to be retained for legal, contractual, fraud-prevention or accounting reasons before final erasure is completed.

15. Cookies and similar technologies

We may use essential cookies and local storage to keep users signed in, protect sessions and operate the website. Optional analytics or marketing cookies should only be used where appropriate notices and choices are provided.

16. Your rights

Individuals may have rights to access, correct, erase, restrict, object to processing, request portability and complain to the Information Commissioner's Office. You can object to direct marketing at any time; we will stop marketing to you and may retain only the minimum suppression information needed to respect that choice. Some other rights depend on the legal basis and context. If your data is inside your employer's or contractor's workspace, we may direct the request to that customer as controller.

17. SMTRY products

SMTRY is a trading name and software brand operated by VariationDesk Ltd. SMTRY Amend for WooCommerce stores order-change request information within the merchant's own WordPress and WooCommerce database. This may include customer contact details, shipping-address corrections, delivery instructions, order information, requested item or quantity changes and customer-provided messages.

SMTRY Amend does not transmit this order information to VariationDesk Ltd or SMTRY, does not include advertising or behavioural tracking and does not use its own external analytics service. Emails generated by the extension are sent through the merchant's configured WordPress email system.

Merchants using SMTRY Amend normally act as controller for information stored on their website and remain responsible for their privacy notices, lawful basis, retention periods, access controls, data-subject requests and any suppliers they configure to handle email, hosting or backups.

18. Changes

We may update this notice as the service, suppliers, legal requirements and product features develop. The latest version will be published on this page.