Privacy notice

Kaleido Ltd, a company registered in England and Wales, company number 17516332, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ is the data controller for the account you open and the records you keep in it.

For anything in this notice, write to support@getskiplog.com.

The full list, kept current because the product is built from it:

• Your name, email address and a hashed passwordTo sign you in and to send password resets and registration expiry reminders
• Your site's details: name, address and postcode, permit or exemption number, region, a contact email and phone, any position statement, and your return columnsTo head every note and return with the yard, to give Defra the receiver's details on every load, and to build returns in your area office's columns. Only the name starts an account
• Every transfer note you record: the waste, its codes and weight, when it came in, form and containers, POPs and hazard details, carrier and vehicle, destinationThese are the records the waste tracking rules require your site to keep, and the fields Defra's receipt of waste service asks for on every load
• On the device you use Skiplog on: notes you record while offline, and a copy of the screens you have already openedSo a load can be recorded in a black spot and sent when the signal comes back. Signing out gives up that device's queue and clears the saved screens from it
• Accounts for the people you add to your site, and the email addresses and invite links of anyone you have invitedSo the weighbridge and the office each sign in as themselves and every note names who wrote it, instead of the yard sharing one login
• Carrier, broker and dealer registrations you track, with their expiry datesTo warn you before a registration lapses: on the registrations screen, by email, and in any calendar you subscribe to the dates from
• Generated quarterly returns and their totalsSo a return you have already sent to the EA can be re-downloaded unchanged
• Receipts batches for Defra's waste tracking service, each note's reported mark, its Defra reference, and the date and reason from a rejection noticeA batch records its dates, note count and who confirmed or undid it; the reference proves a load is in Defra's system, and a rejection's date sets the two-working-day correction deadline
• A record of each correction to a note Defra had already accepted: the reference it went in under, and the old and new value of what changedSo the correction can be made in Defra's service inside the month it allows, and shown later with the reference the load was accepted under
• Subscription status and a Stripe customer reference, never card detailsTo know the account is paid without asking Stripe on every page
• The last time you used the signed-in app, and which core actions you completed and when: a note recorded, a queue synced, a return exportedSo we can see whether Skiplog is doing its job for your yard. Recorded in Skiplog's own database only, kept for 16 weeks, and no third party analyses it
• The network address and browser of each signed-in sessionTo keep you signed in and to spot a session that is not yours

Nothing else. No advertising trackers, no analytics scripts, and the only cookies are the ones that keep you signed in.

Most of this is processed to perform our contract with you: you cannot write a transfer note without an account, a site and the note itself. Session details (network address and browser) rest on our legitimate interest in keeping accounts secure. Where you invite someone to your site, we process their email address to deliver the invite they are expecting.

Amazon Web Services; the application and its Postgres database are deployed there through SST.

Three services process data on our behalf, each for one job:

• Amazon Web Services: Hosts the application and the database, and sends Skiplog's email: password resets, registration expiry reminders and invites to join a site.
• Stripe: Takes card payments; card details never touch Skiplog.

We do not sell your data and we do not share it for marketing.

Everything is kept while the account is open, because waste records have to span quarters and inspections. A transfer note you remove comes off your register and returns but stays on file for the two years the regulations require. A lapsed trial does not lock the records away: they stay readable and exportable. Deleting the account removes it all at once.

Open the site screen in the app and use Delete my account: type your email to confirm, and your account, your site and every record on it are removed at once, with a live subscription cancelled first. Export my data on the same screen downloads it all as a file first. If you have added other people to your site, remove them there first, so a yard's records are never deleted out from under them.

UK GDPR gives you the right to see the personal data we hold about you, correct it, have it deleted, take a copy away, and object to or restrict how it is used. Most of that you can do yourself: your records export as CSV from the app, and account deletion is a button on the billing screen. For anything else, email us and we will answer within a month.

If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather hear it from you first.

Said plainly, because a notice that hides its gaps is worth less than one that names them:

• An independent security audit or penetration test
• ISO 27001, Cyber Essentials or any other certification
• Single sign-on (SSO); accounts are email and password
• Two-factor authentication
• A signed data processing agreement
• A stated backup retention schedule after deletion

If what we store or who touches it changes, this page changes in the same release, and the date at the top moves. The terms of service cover the rest of the agreement.