Privacy Policy

EssorAWD operates the EviDiary service and is responsible for the personal information described in this policy.

Privacy and support enquiries can be sent to Essorawd@gmail.com.

• Account information: email address, authentication information, account identifiers, account creation and sign-in information.
• Your workplace records: incidents, notes, case information, dates, locations, people or witnesses you choose to name, follow-ups and other text you enter.
• Evidence: files you choose to upload together with file metadata, storage references and integrity fingerprints such as SHA-256 hashes.
• Billing information: subscription or purchase status, payment-provider customer/session identifiers, plan, billing interval and transaction state. Full card numbers are handled by the payment provider and are not stored in EviDiary's application database.
• Purchase-consent records: when you choose a paid option, EviDiary may record the selected product, approved GBP amount, relevant case for a Case Pack, payment environment, acceptance timestamp and the versions of the Terms, Privacy Policy and Refund Policy you were shown. This provides an auditable record of the checkout you authorised.
• Technical and security information: information needed to operate, secure and troubleshoot the service, such as session information, error information and security events.
• Communications: information you provide when contacting support or using account emails such as confirmation and password-reset messages.

Your diary may contain sensitive personal information about you or other people. Only record information that is relevant to your legitimate workplace record and avoid unnecessary sensitive detail.

• to create and authenticate your account;
• to store, display, organise, search, export and protect the records you choose to create;
• to provide paid features, process entitlement changes and manage subscriptions or one-off purchases;
• to record the purchase terms you accepted and help resolve billing, refund or payment disputes;
• to send essential account and security communications;
• to prevent misuse, investigate faults and keep the service secure;
• to comply with legal, tax, accounting or regulatory obligations where they apply.

Depending on the activity, our lawful bases under UK data-protection law may include performance of our contract with you, our legitimate interests in operating and securing EviDiary, compliance with legal obligations, and consent where consent is specifically requested. Where information requires an additional condition under applicable law, we will rely on an appropriate condition for the relevant processing.

We use service providers where necessary to run EviDiary. These can include hosting, database, authentication, email, monitoring and payment infrastructure. EviDiary currently uses Lovable-managed infrastructure and Supabase services for application/database functions, and Stripe through Lovable's managed payment system for payment processing.

Providers process information only for the services they supply to us and under their own applicable security and privacy obligations. We may also disclose information where required by law, to protect legal rights or security, or as part of a genuine business transfer subject to appropriate safeguards.

We do not sell your workplace diary contents or payment data to advertisers.

Some technology providers may process information outside the United Kingdom. Where data-protection law requires safeguards for an international transfer, we rely on the safeguards made available by the relevant provider, such as adequacy regulations or approved contractual protections.

Your diary records and evidence are generally retained while your account remains active, unless you delete them or delete your account. Account deletion removes application records in accordance with the deletion workflow, subject to information that must be retained for legal, fraud-prevention, tax, accounting or dispute purposes.

Payment and purchase-consent records may need to be retained for a reasonable period where necessary for accounting, tax, fraud prevention, refunds, chargebacks or legal claims. Payment providers may also retain transaction records under their own legal obligations. Security logs and backups may be retained for limited operational periods before deletion or overwrite.

EviDiary uses account-based access controls and private evidence storage. The service includes measures such as row-level database security, authenticated access and integrity fingerprints for uploaded evidence. No internet service can guarantee absolute security, so you should also protect your password and device.

Evidence hashes and Case Freeze records help identify whether stored material has changed. They do not independently prove that the underlying workplace event occurred.

EviDiary uses cookies, local storage or similar browser technologies where needed for authentication, security, app installation and essential preferences such as onboarding state. The current service does not use workplace diary content for targeted advertising.

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict or object to processing of your personal information, and to receive certain information in a portable form. Where processing is based on consent, you may withdraw that consent for future processing.

EviDiary includes account export and deletion controls to help you exercise these rights. You can also contact Essorawd@gmail.com.

You may also complain to the UK Information Commissioner's Office if you believe your data-protection rights have been infringed.

We may update this policy when the service, providers or legal requirements change. Material changes will be reflected by an updated date on this page and, where appropriate, an in-app or account notice.