Legal

Privacy Policy

Last updated: October 2026

This Privacy Policy explains how CDM Marketing Ltd (“we”, “us”, “our”), trading as AsbestoPlan, collects and processes your personal data when you use our website and application (the “Service”). We are the “controller” of your personal data under the UK GDPR and the Data Protection Act 2018.

Product usage analytics: with your analytics consent, we record browser events on our own systems — for example pricing page views, signup started, project created and export completed — to understand usage, improve onboarding and measure conversion. Fixed campaign codes can identify the published resource that led to signup. These do not track you across other websites. We do not record drawing contents, uploaded file names, client names or site details in analytics events.

1. Who we are

  • Controller: CDM Marketing Ltd, trading as AsbestoPlan
  • Company registration number: 14010841 (registered in England & Wales)
  • Registered address: 34 Clarence Street, Southend-on-Sea, England, SS1 1BD
  • ICO registration number: ZB580027
  • Data protection contact: support@asbestoplan.co.uk

2. The personal data we collect

  • Account data: name, email address and authentication metadata (e.g. login timestamps).
  • Project data: content you create in the editor — drawings, notes and any client or site details you choose to enter.
  • Billing data: subscription status, plan and the Stripe customer/ subscription identifiers. Card details are entered directly with Stripe and are never stored on our servers.
  • Communications: contact-form messages, earlier demo enquiries and support correspondence.
  • Technical data: limited operational logs (e.g. error reports) needed to keep the Service secure and reliable.
  • Product usage analytics: limited first-party events (e.g. pricing page views, signup started, project created, export completed), collected from your browser only after analytics consent, to improve onboarding and measure conversion. We do not record drawing contents, file names, client names or site details in these events.

Optional discovery question

You can choose to tell us how you first heard about AsbestoPlan during initial account setup or on the public contact form. We store this with your account or enquiry to understand which channels bring customers to us. You can skip it without affecting access or support. This answer is separate from automatic campaign tracking and does not subscribe you to marketing emails. Account answers are included in your data export and removed with your account; enquiry answers follow our contact-message retention period.

Product usage analytics

If you accept analytics, we also attach a broad arrival category (such as search, paid, email or referral) and a public landing-page path to browser product events. We keep this attribution in this tab's session storage for up to 30 minutes. We do not store the referring URL, search query or advertising click identifier in this attribution. Declining analytics disables this attribution; withdrawing consent clears its stored value.

We record limited first-party analytics events on our own systems — for example pricing page views, signup started, project created and export completed — to understand product usage, improve onboarding, measure conversion and detect errors. These events are not advertising cookies and do not track you across other websites. We do not record drawing contents, uploaded file names, client names or site details in analytics events.

With your consent, we use a random tab-session identifier and a fixed campaign code in session storage to understand product usage and published resources. Campaign codes do not contain recipient details or arbitrary URL parameters. A code can be recorded with your new account's signup event; signed-in events can be linked to your account. These records are personal data, not anonymous statistics. Rejecting analytics does not prevent signup or use of the Service. We separately keep server records of account creation, billing and operational activity without relying on browser analytics storage.

3. How we use your data and our lawful bases

Under the UK GDPR we rely on the following lawful bases (Article 6):

  • Performance of a contract: creating and operating your account, providing the editor, processing your subscription and providing support.
  • Legitimate interests: securing the Service, preventing fraud and abuse, keeping operational logs and server records of account and billing activity, and improving the product. We balance these against your rights.
  • Legal obligation: keeping records required by tax, accounting and other applicable laws.
  • Consent: where we ask for it (for example, optional marketing emails or browser analytics, campaign attribution and other non-essential storage). You can withdraw analytics consent using the controls in our Cookie Policy at any time.

4. Cookies

We use necessary cookies to keep you signed in and operate the Service securely. Optional browser analytics storage and Microsoft Clarity, where configured, require your consent. We do not use advertising cookies. See our Cookie Policy for details.

5. Who we share your data with

Contact and chatbot enquiry forms use Google reCAPTCHA to detect automated submissions. Google receives browser/device information and your IP address for this check; our verification request sends the challenge token, not your message or drawing. See Google's Privacy Policy. You can email support@asbestoplan.co.uk instead.

We do not sell your personal data. We share it only with the service providers (“processors”) needed to run the Service, under contracts that require them to protect it:

  • Supabase — database, authentication and file storage hosting.
  • Stripe — payment processing and subscription management.
  • Resend — sending transactional emails (confirmations, password resets, notifications).
  • Vercel — application hosting and content delivery.
  • Microsoft (Microsoft 365 / OneDrive for Business) — storage of our encrypted recovery backups. We encrypt database and uploaded-file backups (AES-256-GCM) before upload and keep the decryption key outside Microsoft. Microsoft receives the encrypted files and normal account and file metadata. Microsoft lists the United Kingdom as the current and committed location for this account's OneDrive customer data at rest. This does not cover all account metadata or support processing. The applicable Microsoft data protection terms for this account are still being confirmed; see the sub-processor list.
  • Microsoft Clarity — behavioural analytics (session replay / heatmaps), loaded only if you accept analytics cookies.
  • OpenAI and Anthropic — AI drafting and document extraction for enabled assistant, drawing, RAMS, SOP and site-assessment features. When you ask an assistant question, the configured provider receives your message, recent conversation context and relevant information that the feature is authorised to use. The public AsbestoPlan Chat receives published product/help content and the messages you submit; it cannot retrieve customer accounts, company records or private drawings.

See our sub-processor list for the current register, including what each provider processes and where. We may also disclose data where required by law or to protect our legal rights.

6. International transfers

Some of our processors (such as Stripe and Resend) may process data outside the UK, including in the United States. Where data is transferred outside the UK, we rely on appropriate safeguards — such as UK adequacy regulations, the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. We keep these safeguards under review as our processors update their infrastructure.

7. How long we keep your data

  • Assistant chats: public product chats are held in page memory and are cleared when you clear the chat or reload the page; we do not save their transcripts to your account. Providers process submitted messages under their applicable API data terms. Signed-in assistant conversations and drawing proposals are stored privately, with retention of up to 365 days; archived conversations are removed after 30 days by the retention job. Account deletion removes your assistant conversations and proposals. Full drawing snapshots held for AI previews are cleared after seven days; proposal summaries and hashes may remain for the audit period.
  • Public chatbot enquiries: when you request a reply using the separate enquiry form, we store your contact details, message and only the chat messages you choose to share for up to 365 days. We email the enquiry to our support team using Resend. The contact form details are not sent to our AI provider. Optional marketing consent is separate from requesting support; we record your choice, its wording and the submission time. You can withdraw that preference by contacting support. Anonymous chat usage records contain model, token and estimated cost information, not your conversation.
  • Account & project data: for as long as your account is active.
  • After deletion: when you delete your account, your profile, personal drawings and personal project data are removed from the live service. Records that belong to a shared organisation remain with that organisation, including any company drawings you created (with their history, issued revisions and files) and site-assessment photos. Your account is removed from those records, but anything typed into them, such as notes or labels, stays as written. Backup copies expire according to the applicable provider retention schedule.
  • Issued revisions: frozen drawing files are retained in private storage while their project exists. Deleting a personal project, or your account, removes the issued revisions of your personal drawings. Issued revisions of company drawings belong to the company: they stay when your account is deleted, and are removed when a workspace owner or admin deletes the drawing or the organisation is deleted. For your personal drawings, your account data export includes revision records and a storage file list; for company drawings it includes only attribution (ids, dates and revision labels). Download drawing files separately before deletion.
  • Billing records: retained for 6 years to meet UK tax and accounting obligations.

8. How we protect your data

Data is stored on encrypted infrastructure. Project data is private to your account and protected by row-level security. Access to production systems is restricted, and payment card data is handled entirely by Stripe (a PCI-DSS Level 1 provider).

9. Your rights

Under the UK GDPR you have the right to:

  • access a copy of your personal data;
  • have inaccurate data corrected;
  • have your data erased (“right to be forgotten”);
  • restrict or object to certain processing;
  • data portability (receive your data in a machine-readable format);
  • withdraw consent where processing is based on consent.

You can exercise the rights of access, portability and erasure yourself at any time from your Account & privacy page — download a structured JSON copy of your data (profile, personal drawings, billing, team memberships, the storage file list for your personal uploads, attribution only for company drawings, and more) or delete your account. For any other request, email support@asbestoplan.co.uk and we will respond within one month.

10. Complaints

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

11. Children

The Service is intended for use by businesses and professionals and is not directed at children under 18. We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. We will update the “last updated” date above and, where changes are significant, notify you by email or in the app.

13. Contact

For any privacy question or request, contact support@asbestoplan.co.uk.