Privacy Policy

Redwell (UK) Ltd t/a ClarusPM | Effective: October 2026 | Version 1.0

Redwell (UK) Ltd trading as ClarusPM (“ClarusPM”, “we”, “our” or “us”) provides a cloud-based construction project management platform operating at claruspm.com (“ClarusPM Platform”). This Privacy Policy explains how we collect, use, store, and share your personal data when you visit our website, create an account, or use our services.

Redwell (UK) Ltd is a company incorporated in England and Wales, company number 06342877, registered office: 7 Kings Head Centre, High Street, Maldon, Essex, CM9 5PN. We are the data controller for the purposes of UK GDPR and the Data Protection Act 2018.

Questions about this policy or requests to exercise your rights: hello@claruspm.com

1. Who This Policy Applies To

This policy applies to:

• Visitors to claruspm.com
• Registered account holders (Directors, Project Managers, Site Managers, Engineers, Estimators)
• Suppliers and business contacts of ClarusPM
• Prospective customers
• Any third-party organisation using the ClarusPM Platform

This policy does not apply to the personal data of children. We do not knowingly collect personal information from individuals under 18 years of age.

2. Data We Collect

We may collect and process the following categories of personal data:

• Identity Data: Name, job title, username, role within your organisation.
• Contact Data: Email address, telephone number, postal address.
• Financial and Transaction Data: Payment card details (processed by Stripe — we do not store card numbers), billing address, subscription details.
• Technical Log Data: IP address, device identifiers, browser type and version, operating system, login timestamps, page views.
• Profile Data: Username, password (stored as a one-way hash), preferences, support correspondence.
• Usage Data: How you use the ClarusPM Platform — features accessed, reports submitted, documents generated.
• Project and Site Data: Construction project records you create or upload, including daily reports, photographs, signatures, permit records, RAMS documents, and programme data. This data belongs to your organisation.
• Knowledge Base Data: anonymised document content extracted from library documents you upload, where you have not opted out. This contains no personal data — all identifying information is removed before storage.
• Location Data: Site coordinates you provide for weather forecasting. We do not track your device location.
• Cookie Data: See our Cookie Policy for full details.

3. How We Collect Your Data

• Directly from you when you register, set up a project, submit a form, or contact us.
• Automatically when you use the platform — technical log data, cookies, and usage analytics.
• From your team members — when a colleague invites you to join a project.
• From documents you upload — when you use the AI document extraction features.

4. How We Use Your Data

We use your personal data for the following purposes and on the following legal grounds:

5. Third Party Processors

We share your personal data with the following third party processors. Each is bound by data processing agreements and must handle your data only on our instructions. Where processors are based outside the UK, we rely on Standard Contractual Clauses as the lawful transfer mechanism under UK GDPR Article 46.

• Stripe Inc (United States) — Payment processing. Processes payment card details and billing information for subscription payments. Stripe is PCI DSS Level 1 certified. stripe.com/privacy
• Resend Inc (United States) — Transactional email delivery. Processes your email address and the content of emails sent to you on our behalf, including account notifications, daily reports, permit approvals, and safety alerts.
• Supabase Inc (United States (data hosted in EU — Sweden)) — Database hosting. Your project data, user records, and account information are stored on Supabase infrastructure located in the European Union.
• Anthropic PBC (United States) — Artificial intelligence processing. Powers document extraction, RAMS generation, and document adaptation features. When you upload a document for AI processing, its content is transmitted to Anthropic. Anthropic does not use your data to train its models. anthropic.com/privacy
• Cloudflare Inc (United States) — File storage (Cloudflare R2). Stores files you upload including photographs, drawings, documents, permit records, and operative signatures.
• Vercel Inc (United States) — Platform hosting. ClarusPM is hosted on Vercel infrastructure. Vercel processes technical log data including IP addresses and request metadata in the course of hosting our platform.
• Open-Meteo (Switzerland) — Weather data. Provides live weather forecasts on site manager screens. We transmit site coordinates to retrieve forecasts. No personal data is transmitted to Open-Meteo.

You may request a copy of the transfer safeguards applicable to any of the above by contacting us at hello@claruspm.com.

6. Data Retention

We retain your personal data for as long as your account is active and for a period of 7 years after termination of your subscription, to comply with our legal and accounting obligations. Project records (daily reports, permit records, RAMS documents, signatures) are retained for 7 years from the date of creation, in line with construction industry limitation periods. You may request deletion of your personal data at any time — see Your Rights below.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• All data transmitted to and from the ClarusPM Platform is encrypted using TLS 1.2 or higher.
• Passwords are stored as one-way hashes — we cannot read your password.
• Access to production systems is restricted to authorised personnel only.
• File uploads (photographs, documents, signatures) are stored in encrypted object storage.
• We have procedures to detect and respond to personal data breaches and will notify you and the ICO where required by law.

8. Marketing

We may use your email address to send you updates about ClarusPM features, new products, and relevant industry information. We rely on legitimate interests for this processing. You may opt out at any time by:

• Using the unsubscribe link in any marketing email.
• Emailing hello@claruspm.com with the subject “Unsubscribe”.
• Updating your preferences in your account settings.

We will never sell your personal data to third parties for marketing purposes.

9. Your Rights

Under UK GDPR you have the following rights in relation to your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data where there is no legitimate reason for us to continue processing it.
• Right to restriction: Request that we suspend processing of your personal data in certain circumstances.
• Right to portability: Request transfer of your data to another organisation in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Where we rely on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@claruspm.com. We will respond within one calendar month. We do not charge a fee for reasonable requests.

10. Complaints

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at any time: ico.org.uk | 0303 123 1113. We would appreciate the opportunity to address your concerns before you contact the ICO — please email hello@claruspm.com in the first instance.

11. Cookies

We use essential cookies to operate the ClarusPM Platform. See our Cookie Policy at claruspm.com/cookie-policy for full details of the cookies we use and how to manage them.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The current version is always available at claruspm.com/privacy.

Redwell (UK) Ltd t/a ClarusPM
Company No. 06342877 | VAT No. GB 913277234
7 Kings Head Centre, High Street, Maldon, Essex, CM9 5PN
hello@claruspm.com | claruspm.com
Registered in England and Wales