This notice is for people who use the Amberhold product: the iPhone and Android apps, and the same product in a browser. It says what is recorded about you, why, where it is kept, who else handles it and how to ask for a copy or for deletion. It is described against what the system actually does, not what would sound best.

Who is responsible

Amberhold is Amberhold Ltd, a company registered in England and Wales (company number 17485301), registered office 128 City Road, London, EC1V 2NX. You can reach us at hello@amberhold.com.

Inside the product, your employer (the site that uses Amberhold) decides what is recorded and why. They are the controller of that information; Amberhold Ltd processes it on their instructions under a written agreement. If you want to know why your site records something, or want a record corrected, ask your employer first; we help them answer you. For people who contact us through the website, the separate website privacy notice applies.

What the app records

The app records only what is needed to produce the operational record your site asked for:

Who you are.Your name, work email address and a user identifier, from the account your employer created for you (either through your employer's Microsoft Entra ID sign-in or an Amberhold account). You cannot create an account in the app yourself.
What you record. Readings, answers, skips, notes, temporary controls, handover entries and the time each was captured, all attributed to you by name. This is the record your employer uses.
Photographs you choose to take as evidence for a reading. The app uses the camera only when you tap to scan a tag or take a photo; it never reads your photo library.
Tag scans. When you scan a QR code or NFC tag on equipment, the app records which tag was read and when, so the record shows which equipment the reading is about.

The app does not record your location, your contacts, your other apps, or how you use your phone. It contains no advertising and no analytics or tracking libraries. Microsoft and Google sign-in services may use your IP address and device type for security while you sign in; that is their security processing, not a record we keep.

Where it is kept and who else handles it

Operational records and photographsare stored in Google Cloud's London region (europe-west2), on infrastructure run by Google as our processor.
Sign-in identifiers(email address, user identifier and, for Amberhold accounts, a password hash) are held by Google's Firebase Authentication service, which stores them in the United States under Google's standard data-transfer terms. If your employer uses Microsoft Entra ID, Microsoft handles your sign-in under your employer's own Microsoft agreement.
Email such as an invitation or a password reset is sent through Microsoft 365.

We do not sell or share this information with anyone else, and we do not use it for advertising. We disclose it only to your employer (it is their record) and to the processors above, or where the law requires.

What stays on your phone

Readings and photographs you capture are held on the phone until they have been sent to the server, then they are removed from the phone. If you lose signal part-way through a walk, what you have already recorded stays on the phone and is sent when signal returns, with the time it was captured. Starting a new walk needs a connection. The app also keeps a copy of the plan it last synced so it can open without a signal.

How long it is kept

The operational record is kept for as long as your employer's agreement with us says, which they set to match their own retention duties. Records are append-only: a reading is not edited or deleted afterwards, because that is what makes the record trustworthy. When an agreement ends, the site's data is exported to the employer on request and then deleted on the schedule in the agreement, including from backups, which are kept for a limited period in London.

Your rights, and how to ask

You may have the right to ask for a copy of the information held about you, to have it corrected, to have it deleted, to restrict how it is used, or to object. Because your employer is the controller of the operational record, ask them first; they can see and export everything recorded against your name. You can also ask us directly at hello@amberhold.com and we will respond within one month, working with your employer where the record is theirs.

To ask for deletion of your account or your data: email hello@amberhold.comfrom the address on your account, or ask your site administrator. Your account is removed and sign-in identifiers are deleted. Operational records you created stay in your employer's record, attributed to you, because they are evidence your employer must keep; your employer decides on those under their own retention duties.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, or call 0303 123 1113. You can complain to us first, but you do not have to.