1. Who we are
Civvio is provided by [LEGAL ENTITY NAME], a company registered in [GOVERNING LAW: Scotland / England & Wales — TO CONFIRM] under number [COMPANY NUMBER], registered office [REGISTERED ADDRESS]. ICO registration number: [ICO REGISTRATION NUMBER]. Contact: hello@civvio.ai.
We have two roles:
- Controller for website visitors, enquiries, demo sign-ups and account holders' contact and account details.
- Processor for the project content customers upload or create — drawings, specifications, contracts, RAMS, diaries, RFIs, allocation records and similar. The customer company is the controller for that content, and our Data Processing Addendum applies.
2. What we collect and why
| Purpose | Data | Lawful basis |
|---|---|---|
| Answering enquiries and demo requests | Name, work email, phone (optional), company, role, message | Legitimate interests (responding to business enquiries) |
| Public demo access | Work email, name, company; questions asked and usage in the demo for 7 days | Legitimate interests (offering and improving a product demo) |
| Civvio update emails, when you ask to be kept updated | Email address and the page you signed up on | Consent — unsubscribe any time using the link in any update, or by emailing us |
| Providing accounts | Name, email, password (stored hashed by our auth provider) or Google sign-in, organisation, role and access level | Contract |
| Running the service | Project content and records customers add | Contract (as processor, on the customer's instructions) |
| Usage allowances and fair use | Counts of answers, voice minutes, pages and drafts per organisation | Contract and legitimate interests |
| Security and abuse prevention | Sign-in events, technical logs, rate-limit counters | Legitimate interests |
| Legal obligations | Records we must keep by law | Legal obligation |
We do not sell personal data and we do not use it for advertising.
3. How AI processing works
To produce an answer or draft, relevant parts of a customer's project content are sent to our AI providers — Anthropic (primary) or OpenAI (fallback), listed on the sub-processors page — and to no other AI service, only to produce that answer or draft for that customer.
If a typed question can't be answered from the project documents and the customer's company allows it, Civvio may search a fixed list of official UK websites through Anthropic. Only a short general question with project, company, client and location names removed is searched — never project documents, records, contract terms or RAMS. We record only how many searches ran and which websites were cited, not the question or answer.
Our AI providers do not use customer data to train their models. Providers may keep inputs for a limited period for abuse and safety monitoring under their own terms.
Civvio's output is a draft for a competent person to check. Nothing is sent, issued or approved automatically.
5. International transfers
Our main database and file storage are hosted in the EU (Ireland), which the UK recognises as adequate. Some providers, including AI providers, may process data outside the UK and EU, mainly in the USA (see the sub-processors page for each provider). Where they do, we rely on [UK IDTA / UK Addendum to the EU SCCs / UK–US Data Bridge — TO CONFIRM PER PROVIDER].
6. How long we keep data
- Demo visitors: demo sign-in accounts, questions, voice sessions and notifications are deleted automatically by a daily clean-up 7 days after sign-up. A summary of demo activity is kept with the related enquiry.
- Enquiries: kept until we delete them [ENQUIRY RETENTION PERIOD — TO CONFIRM]. There is no automatic deletion today.
- Civvio Engineer projects: "Delete project" removes the project, its uploaded files and its search index.
- Accounts and company data: kept while the account is active. On request, or at the end of a subscription, we delete or return customer data within [30 DAYS — TO CONFIRM]. There is no self-service account deletion yet; email hello@civvio.ai.
- Backups: deleted data may remain in backups for [BACKUP RETENTION — TO CONFIRM].
7. Security
- Encrypted connections (HTTPS) for all traffic.
- Database row-level security separating every organisation and project, with Admin, Management and Site access levels enforced in the database and on the server.
- Commercial information hidden from Site users at database level.
- Private file storage; download links are created on the server after an access check and expire.
- Approved RAMS and signatures cannot be edited.
- Offline copies on a device hold record details only — not files, contract text or sign-in tokens.
8. Your rights
You can ask to access, correct, delete or restrict your personal data, object to processing, or receive a portable copy. Email hello@civvio.ai. If your data is in a customer's project content, we will pass your request to that customer, as they are the controller.
9. Complaints
Please contact us first at hello@civvio.ai. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
11. Changes to this policy
We will update this page when our practices change and show the new date at the top. Significant changes will be notified to account holders by email.