Privacy Policy

Last updated: 16 October 2026

WorkProof is a job-site documentation app for trades teams, available on iPhone, Android and as a web app for office staff. This policy explains what the app collects and how it is used. WorkProof is operated by Kontos Studio Ltd (company number 17526062, registered in England and Wales. Registered office: 3 Colesdale, Cuffley, Hertfordshire EN6 4LQ). For the accounts of the people who use WorkProof, Kontos Studio Ltd is the data controller. For the customer and job records a company keeps in WorkProof, that company is the controller and Kontos Studio Ltd processes them on its behalf. For anything about your data, contact hello@workproof.site.

What we collect

Account details — your email address and a display name, used to sign you in and identify you to your teammates.
Job records — photos, videos, voice notes, markups, plans, survey answers, unit registers, F-Gas and commissioning records, task lists, materials lists, bookings and messages that you and your team create inside the app.
Location — with your permission:
- photos are tagged with where they were taken, and the street address is looked up from that position;
- site log: the app records when you arrive at and leave the job sites you are booked on, using a geofence around each site. This works in the background, even when the app is closed or not in use, but only if you have allowed location "Always" (iPhone) or "Allow all the time" (Android). The app asks first, on a screen that explains this;
- on-site check-in (only if your company switches it on for you): while you are logged as on a site, the phone checks its position every few minutes so your departure time is still recorded if the geofence misses it. A notification shows while it runs;
- live location sharing (only when you turn it on, for a time you choose): your position, speed and direction are shared with your own company every few seconds until the time runs out or you stop it. A notification shows while it runs;
- to check the site log is right, a trail of location points is kept for one month and then deleted automatically.
Your location is only visible to people in your own company. You can turn location off at any time in your phone's settings.
Camera and microphone — used only when you actively take photos, record walkthrough videos or voice notes, or scan a rating plate, barcode or QR label. On Android, the room scan uses Google Play Services for AR (ARCore), which is provided by Google and processes data under Google's privacy policy.
Device details for notifications — a push-notification token for your phone, so the app can alert you about new jobs, messages and mentions. Notifications are delivered through Expo, Apple and Google.
WhatsApp messages — only if your company connects its WhatsApp Business number to WorkProof (see below).
Early-access requests — if you fill in the form on this website we keep your name, company, email, trade and team size so we can get in touch.

How it is used

Everything you capture is shared with the other members of your own company inside the app, and with nobody else.
Photos, video frames, narration and survey answers may be processed by an AI service (Anthropic's Claude API) solely to generate job briefs, survey drafts, materials lists and task lists for your team. This content is not used to train AI models.
Voice notes and walkthrough narration may be transcribed by OpenAI's speech-to-text service, solely so the text can go into the job brief. It is not used to train AI models.
If your company turns on customer updates, the customer's name, phone number and email are used to send booking confirmations, reminders and "on our way" messages by WhatsApp (if connected), SMS (Twilio) or email (sent through Cloudflare, or Resend if your company has set it up).
If your company connects Xero, customer names and contact details are looked up in, and added to, your company's own Xero account. If it connects Google Business Profile, only the job photos you choose are posted to your company's listing.
Addresses and maps use Google Maps Platform; the Google Maps software in the phone apps may send Google basic usage and crash information under Google's privacy policy. A photo's position may also be looked up with OpenStreetMap Nominatim to find its street address, and a site's position is sent to Open-Meteo to record the weather when you arrive. Only the position is sent, never your name.
We do not sell your data, show advertising, or share your data with third parties beyond the service providers named here.

A company can connect its own WhatsApp Business number to WorkProof through Meta's WhatsApp Business Platform, using Meta's own sign-in window. When it does:

Messages sent and received on that number — text, photos and documents, the sender's WhatsApp name and phone number, and delivery and read receipts — are received from Meta and stored in WorkProof so the company's office team can read and reply to them. If the company keeps using the WhatsApp Business app on its phone, WorkProof also receives copies of the messages sent from the phone and, once, up to the last six months of chat history, so the conversation is complete in both places.
WorkProof uses this only to show the company its own conversations, link them to the right customer and job, and send the job updates the company chooses (booking confirmations, reminders, "on our way"). Messages are visible only to that company's team.
The access token Meta issues for the number is stored encrypted and is used only to send and receive that company's messages and manage its message templates.
If a customer replies STOP, WorkProof stops sending them job updates.
When a company disconnects WhatsApp, WorkProof stops receiving its messages and removes the access token. The company can ask us to delete its stored WhatsApp messages at any time.

Meta processes WhatsApp messages under its own terms and privacy policy: WhatsApp Business Terms.

Who is responsible for what

Each company using WorkProof decides what it records about its own customers and jobs, and is the controller of that data. WorkProof processes it on the company's behalf to provide the service, and our support team only looks at a company's account to help it, with its permission.

Cookies and analytics

This website uses Google Analytics 4 to count visits and see which pages people read, but only if you click Accept on the cookie banner. If you click Reject, or ignore the banner, no analytics cookies are set and Google Analytics is not loaded. Google Analytics sets first-party cookies named _ga and _ga_* that last up to two years; IP addresses are not stored, and we do not use advertising or remarketing features. Your choice is remembered in your browser. You can change it at any time with Cookie settings.

Where it is stored

Data is stored securely with Supabase (database, in London) and Cloudflare (photos, videos and files). Access is restricted so that each company's team can only see its own data. This website and the web app are served by Cloudflare. Daily backups are kept for seven days.

Retention and deletion

Job records are kept for as long as your company uses WorkProof, since they form your team's record of work carried out. You can delete your own account at any time in the app (Admin → Me → Delete my account), or by emailing us — see how to delete your data. If the last person in a company deletes their account, the company's data is removed for good 30 days later.

Your rights

Under UK GDPR you may request access to, correction of, or deletion of your personal data. Email hello@workproof.site to exercise these rights.