Privacy Policy

Who is responsible for your data

When an organisation uses Arbrium to manage its assets and surveys, that organisation decides what data is held and who can see it, and acts as the controller of that data. We process it on the organisation's behalf as its processor. For data about visitors to this website and people who contact us directly, we are the controller.

What we collect

• Account details: name, email address, organisation and role.
• Survey and asset data entered by users, including photographs, locations, notes and the name of the person who recorded or changed each record.
• Location data from your device when you choose to capture a position, and location and camera metadata held in photographs you upload.
• Technical data needed to run the service securely, such as sign-in sessions and error logs.
• Billing details handled by our payment provider; we do not store full card numbers.
• Anything you send us when you contact us or register interest in the Arbrium Air pilot programme.

How we use it

• To provide the platform: storing surveys, showing maps, producing exports and reports.
• To keep an audit trail of who created or changed each record, which organisations rely on.
• To secure the service, prevent misuse and fix faults.
• To respond to enquiries and, where you've asked us to, contact you about the product.

We rely on the performance of our contract with your organisation, our legitimate interests in running a secure and reliable service, and, where required, your consent.

Service providers

We use a small number of providers to run Arbrium. They process data only to provide their service to us:

• Lovable Cloud — application hosting, database, file storage, authentication and email delivery.
• Mapbox — map display.
• what3words — converting locations to three-word addresses when requested.
• Open-Meteo — weather conditions recorded against surveys (location only).
• Paddle — payment processing for subscriptions.
• AI services accessed through our hosting provider — preparing draft survey observations for professional review.

Sharing

We do not sell personal data. Within Arbrium, data is visible only to people your organisation has given access to. An organisation may choose to grant its clients read-only access to specific projects.

How long we keep it

Survey and asset records are kept for as long as the organisation that owns them keeps its account, because the history of an asset is the point of the record. Organisations can export their data at any time. When an account closes, we delete or return the organisation's data as agreed with it.

Your rights

Under UK data protection law you can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable format. Where your data is held on behalf of an organisation, we'll pass your request to that organisation. You can also complain to the Information Commissioner's Office (ico.org.uk).

Changes

We'll update this page when our practices change and revise the date at the top.