Privacy Policy

WTNcloud (“we”, “us”) is the data controller for personal data processed via our website, dashboard, and iOS/Android apps. We process data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Contact: [email protected].

1. Data We Collect

• Account & company — name, email, hashed password, business name and address, waste carrier licence number.
• WTN data — waste descriptions, EWC codes, quantities, addresses, vehicle registration, signatures, optional photos, and date/time.
• Customer data — names, addresses, and contact details of waste producers that you enter.
• Billing — subscription history. Card details are handled by Stripe and never stored on our servers.
• Technical — IP address, browser/device info, and basic usage data.
• Free WTN Generator — email (required) plus the form data you submit; used to verify your address and deliver your PDF.

2. Legal Basis for Processing

Under UK GDPR Article 6 we rely on:

• Legal obligation — for storing WTN records, GPS coordinates, and signatures required by the Environmental Protection Act 1990 and the Waste (England and Wales) Regulations 2011.
• Contract performance — for running your account, processing payments, and delivering the Service.
• Consent — for mobile permissions, SMS notifications, Free WTN Generator submissions, and marketing emails.
• Legitimate interests — for security, fraud prevention, and service improvement.

3. Mobile App Permissions

Each permission is requested only when needed and used solely as described:

• Precise location (GPS) — captured only at the moment you create or sign a WTN, as audit-trail evidence. No background tracking.
• Camera & photo library — only to attach waste-load photos to a WTN.
• Biometric unlock — handled by your device’s secure enclave. Biometric data never reaches our servers.
• Push notifications — for signing requests, reminders, and sync status.

Drafts and pending records are held in an encrypted SQLite database on your device so the apps work offline, and sync to our servers when connectivity returns.

4. Data Sharing

To run the Service we share data with carefully selected sub-processors:

• Payments — Stripe.
• Email — Postmark (transactional and marketing).
• File storage — MEGA S4, an S3-compatible EU-based provider.
• PDF generation — api2pdf.
• AI document processing — OpenRouter, which routes scanned Waste Transfer Notes and Consignment Notes, and Ask AI queries, to third-party AI models for automated data extraction and search. We configure these requests to exclude providers that train on submitted data. Whether data is otherwise retained depends on the specific provider and model handling each request, until we enforce a stricter no-retention restriction across the board.
• Address & postcode lookup — goaddress.io and postcodes.io.
• Mobile push notifications — Expo.
• SMS delivery — our own self-hosted SMS gateway.
• Crash & error monitoring — Sentry.
• Rate-limiting infrastructure — Upstash.
• Operational alerts — Pushover (internal team notifications; company name and email only).
• Statutory submissions — DVSA (MOT lookups) and DEFRA (Digital Waste Tracking), where required by law.

Personal data is stored on EU-based infrastructure. Where any processor transfers data outside the UK or EU, we rely on Standard Contractual Clauses and the UK IDTA.

Optional integrations with QuickBooks and Xero are opt-in: nothing is shared until you authorise the connection, and OAuth tokens are encrypted at rest. We do not sell your personal data.

5. Data Retention

• WTN records — minimum 2 years from the date of transfer (UK statutory requirement), longer where a legal or regulatory obligation applies.
• Account data — deleted within 90 days of account closure, except where retention is required by law.
• Billing records — 7 years (UK tax law).
• Free WTN Generator — lead data up to 12 months; generated PDFs auto-deleted after 90 days.
• Technical logs — up to 90 days.

6. Your Rights

Under UK GDPR you have rights of access, rectification, erasure, restriction, objection, and data portability. Most can be exercised directly via your account settings. For anything else, email [email protected] — we respond within 30 days. You can lodge a complaint with the Information Commissioner’s Office (ICO).

7. Cookies & Security

We use strictly necessary session cookies to keep you signed in. With your consent, given via the cookie banner shown on your first visit, we also use Google Analytics and Microsoft Clarity to understand how the Service is used — no advertising cookies. You can change your choice at any time via “Cookie settings” in the footer, or your account settings if you’re signed in. Data is encrypted in transit (TLS) and at rest; passwords are hashed; access to personal data is restricted and logged.

8. Changes & Children

We may update this policy and will notify you of significant changes by email or in-app notice. WTNcloud is a B2B service and is not directed at individuals under 18.

Contact