Privacy Policy

SmartCore Technology ("SmartCore", "we", "us") operates the SmartCore platform, available at smartcoretechnology.co.uk. We are committed to being transparent about how we handle your data.

For any data-related queries, you can reach us at support@smartcoretechnology.co.uk.

This policy applies to all personal data we collect when you:

• Visit our website at smartcoretechnology.co.uk
• Create an account or subscribe to SmartCore
• Use any SmartCore module or feature
• Contact us by email or through our support channels
• Make a purchase through our shop

If you're a business using SmartCore to manage your own employees or clients, we also process personal data on your behalf as a data processor. That relationship is covered by our Data Processing Agreement, which applies automatically alongside our Terms of Service.

3.1 Information You Give Us

• Account details — your name, email address, company name, and password when you register
• Payment information — billing details processed securely through Stripe; we never see or store your raw card number
• Employee data — where you use SmartCore HR modules, data about your staff (names, contact details, job information, emergency contacts) that you upload yourself
• Client data — where you use CRM or client-facing modules, information about your clients
• Internal chat messages — where you use SmartCore Chat, the messages, files, images and video your staff send each other on the platform, and the metadata of any voice or video calls they place (who called whom, when, and for how long — never the audio or video itself). See Section 6b.
• Support communications — emails and messages you send us
• Preferences — theme settings, notification preferences, and other customisations you make within the platform

3.2 Information Collected Automatically

• Usage data — which pages and modules you visit, when, and how often, to help us improve the platform
• Device & browser information — browser type, operating system, and screen size for compatibility purposes
• IP address — used for security monitoring and fraud prevention; not linked to your personal profile
• Cookies & local storage — see Section 6 for full details

3.3 Information from Third Parties

We may receive limited information from Stripe (payment confirmation) and from other integrated services you choose to connect. We don't purchase or obtain personal data from data brokers.

We use your data to:

• Provide the Service — run your account, process payments, and give you access to the modules you've subscribed to
• Communicate with you — send order confirmations, invoices, important account updates, and replies to your support requests
• Improve SmartCore — understand how people use the platform so we can fix issues and build better features
• Keep things secure — detect and prevent fraud, abuse, and unauthorised access
• Meet legal obligations — retain records as required by law, respond to legal requests

We do not use your data for:

• Selling or renting it to third parties
• Advertising or profiling for marketing by others
• Automated decision-making that significantly affects you

We may occasionally send you product updates or news about new SmartCore modules. You can opt out of these at any time by emailing support@smartcoretechnology.co.uk or using the unsubscribe link in any email we send.

Under the UK GDPR, we rely on the following legal bases:

• Contract — processing necessary to provide the Service you've subscribed to (e.g. running your account, processing payments)
• Legitimate interests — improving the platform, fraud prevention, and security monitoring, where our interests don't override your rights
• Legal obligation — where we're required to retain data by law
• Consent — for optional communications such as product updates, which you can withdraw at any time

We use a small number of cookies and browser local storage to make SmartCore work properly. We keep this minimal.

Essential (always on)

• Authentication session — keeps you logged in across pages
• Theme preference (sc_theme) — remembers whether you've set dark or light mode
• Basket & order state — stores your current shop basket locally so it persists across page loads

Analytics

We may use lightweight, privacy-respecting analytics to understand how people navigate the platform. This does not involve tracking you across other websites or creating advertising profiles.

Managing Cookies

You can clear cookies and local storage data through your browser settings at any time. Clearing essential cookies will log you out and reset your preferences.

SmartCore Flexi is a personal training and coaching module. Where a business uses Flexi to manage its clients, the system may process special category data under UK GDPR Article 9, including:

• Medical notes and health screening / PAR-Q information
• Progress photos and body measurements (weight, body fat %, etc.)
• Nutrition, dietary, and habit-tracking data
• Signed waivers and liability/health declarations

This data belongs to, and is controlled by, the trainer/business using Flexi — SmartCore Technology acts only as a data processor on their behalf, as described in Section 2.

Legal basis — processing of this special category data relies on the client's explicit consent, captured when a client signs a waiver in the Flexi client portal, in addition to the general legal bases in Section 5 that also apply.

Storage — all Flexi client photos, waivers, and health-related files are stored in a private, non-public storage bucket, accessible only to the client themselves and their trainer's business.

Retention — a client's data is retained only while they remain active. If a trainer archives a client, or a client requests deletion of their account via "My Data & Privacy" in the Flexi portal, that client's data is scheduled for permanent deletion 90 days later (unless reactivated sooner) — the same 90-day window described in Section 8.

Your rights — Flexi clients can download a full copy of their data, or request deletion of their account, at any time from "My Data & Privacy" in the Flexi client portal — see Section 9 for the full list of rights this supports.

SmartCore Chat is an internal messaging module: your staff messaging each other on your company's own SmartCore account. Where a business uses it, SmartCore Technology acts only as a data processor and your employer is the data controller for what is said on it, as described in Section 2.

What is stored

• Messages — the text of every message sent in a channel or direct message, who sent it, when, and whether it was later edited or deleted. A deleted message is retained as a record that a message was deleted, with its content removed.
• Attachments — files, images, audio and video shared in a conversation, held in a private storage location reachable only through short-lived signed links, never a public URL.
• Reactions, pinned messages and saved messages. Messages you save for yourself are private to you and are not visible to your colleagues or to an administrator.
• Activity data — read positions, online/away status and last-seen time, typing indicators (which are transient and never written to the database), and per-conversation notification settings.
• Call records — who called whom, when, whether the call connected, how it ended, and how many people took part. No audio, video or transcript of a call is ever recorded or stored — see "Voice and video calls" below.

Administrator access to a conversation

Your company's owner and administrators have a restricted tool for reading the direct messages between two named employees, and for exporting that conversation as a transcript or as structured data. It exists because your employer is the controller of what is said on its own systems and may genuinely need to look — a grievance, a disciplinary matter, or a regulator's request. It is deliberately narrow:

• It is a lookup, not a list. There is no way to browse everybody's messages. An administrator must name both employees, so every use answers the question "why were you looking at that conversation?".
• Every use is permanently recorded — who looked, whose conversation, when, whether they took a copy away, and the reason they gave. That record cannot be edited or deleted by anyone, including the person who created it, and it is visible to your company's other administrators and to its owner.
• Administrators' and owners' conversations are excluded. If either person in a conversation holds an administrator or owner role, the tool refuses to open it — whoever is asking, including the owner. One administrator can never use it to read another administrator's or the owner's messages. It works only for employee and supervisor conversations.
• Exports are subject to the same restrictions and the same record.
• Direct messages cannot be moderated. An administrator can remove a message from a shared channel, which is recorded along with what the message said; they cannot remove or alter a message inside two colleagues' private conversation.

If you want to know whether this has ever been used on a conversation involving you, it is included in the data you can download about yourself — see "Your own data" below.

Retention

Your employer chooses one company-wide setting for how long chat history is kept: 3, 6, 12 or 24 months, or indefinitely. Where a window is set, a daily automated job permanently deletes messages older than it, together with any files attached to them. Your employer's current setting is shown to you in the module and in your own data export.

Two things that setting deliberately does not delete: the record of administrators using the conversation lookup, and the log of administrator actions on channels and messages. Those are records of your employer's own conduct rather than operational messages, so a short message-retention window cannot be used to erase them. They are kept for 2 years, matching the support-access log described in Section 10.

Voice and video calls

Voice and video calls are peer-to-peer. The audio and video travel directly between the people on the call, and are never sent to a third-party calling or conferencing provider — there is no such provider involved at any point.

Where a participant's network blocks a direct connection (common on corporate and some mobile networks), the call is relayed through a server SmartCore runs itself. On that path the media passes through SmartCore's infrastructure as encrypted, opaque traffic in order to reach the other participant; it is not decrypted, inspected, recorded or retained at any point, and the relay is used only for the connections that cannot be made directly.

Group calls connect every participant directly to every other, which is why they are limited to six people.

Notifications

Notifications are sent to the devices you have signed in on, using Apple's push service on iPhone and iPad and your browser's push service on Android and desktop. You can mute any individual conversation, and turn notifications off entirely per device. Where your employer also uses Holiday Management, you receive no chat notifications at all while you are on approved leave; this resumes automatically on the day your leave ends.

Your own data

You can download everything SmartCore Chat holds about you at any time, from Settings inside the module: the messages you wrote, your reactions, saved messages, conversation settings, tasks, call history, and any administrator views of conversations involving you. Messages written by other people are not included, even in a one-to-one conversation with you — those are that person's personal data as much as yours, and a self-service export that handed every employee a copy of their colleagues' words would not be a data right. A request whose scope genuinely extends to both sides of a conversation is a decision for your employer as the controller.

Because your employer is the controller, deletion of your chat data runs through them: it is deleted when your employee record is archived or deleted in SmartCore Central, and when your company's subscription ends and its 90-day window closes (Section 8).

We share data only where necessary to run the platform:

• Stripe — payment processing. Your card details go directly to Stripe; we only receive a payment confirmation token. Stripe's privacy policy.
• Supabase — our cloud database and authentication provider. Your data is stored securely on their infrastructure. Supabase's privacy policy.
• Cloudflare — our hosting and content delivery provider. Traffic to smartcoretechnology.co.uk passes through Cloudflare's network. Cloudflare's privacy policy.
• Resend — transactional email delivery (invoices, order confirmations, notifications). Resend's privacy policy.
• Anthropic — AI processing that powers SmartCore's in-app AI features, including chat/support assistants (such as Nova, CRM support chat, and general platform support chat) and SiteSnap's floor-plan analysis tool. Content you submit to these features — messages, and uploaded images or sketches — is sent to Anthropic for processing. Anthropic's privacy policy.
• Legal or regulatory bodies — where we're required to disclose data by law, court order, or regulatory authority

We do not share your data with advertisers, social media companies, or data brokers. We never sell your data.

We keep your data for as long as your account is active, plus a reasonable period after to handle any queries, disputes, or legal obligations.

• Active accounts — data retained for the duration of your subscription
• After cancellation — data retained for 90 days, then permanently deleted. You can export your data during this window.
• Payment records — retained for 7 years to meet HMRC requirements
• Internal chat history — retained for as long as your company's own chat retention setting allows (3, 6, 12 or 24 months, or indefinitely), then permanently deleted by a daily job. See Section 6b.
• Support communications — retained for up to 2 years

If you'd like your data deleted sooner, just contact us at support@smartcoretechnology.co.uk and we'll handle it promptly.

For the exact retention period and deletion trigger for every category of data we hold, see our Data Retention Schedule.

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct any inaccurate or incomplete data
• Erasure — ask us to delete your data ("right to be forgotten"), subject to any legal obligations we have to retain it
• Restriction — ask us to limit how we process your data in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent (e.g. marketing emails), you can withdraw it at any time

To exercise any of these rights, email us at support@smartcoretechnology.co.uk. We'll respond within 30 days and won't charge you for reasonable requests.

We take security seriously and use a layered approach to protect your data:

• All data is encrypted in transit using TLS/HTTPS
• Data at rest is encrypted at the database level
• Access to production systems is restricted and logged
• Passwords are never stored in plain text
• We use row-level security policies in our database so users can only access data they're authorised for
• We monitor for suspicious activity and unauthorised access attempts

If we become aware of a data breach that is likely to affect your rights, we will notify you and the relevant authority as required by law.

Our Breach Response Process

If we discover a personal data breach, we will:

1. Contain and investigate the breach immediately, and assess what data and how many people are affected
2. Where the breach is likely to result in a risk to your rights and freedoms, notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it
3. Where the breach is likely to result in a high risk to you specifically, notify affected individuals directly and without undue delay, describing what happened, what data was involved, and what we're doing about it
4. Where you are a business client using SmartCore for your own employees or customers, notify you as the data controller promptly so you can meet your own notification obligations
5. Record every breach, its effects, and the remedial action taken, regardless of whether it met the threshold for notification

Support Access to Your Account

To diagnose and fix problems you report, a small number of authorised SmartCore staff (company owners/admins only) can sign in as one of your employees to see and reproduce exactly what they're seeing, rather than working from a description alone. This is only ever used for legitimate support or maintenance purposes, requires the staff member to record a reason before it can start, and every such session is logged (who, who as, why, and when) in an internal audit record we can make available to you on request. It is never used to browse accounts without a reason, and staff are bound by confidentiality obligations covering anything they see this way. See our Data Processing Agreement for the full detail.

SmartCore is a business platform. It is not directed at or designed for personal use by children. If you are setting up an account on behalf of a business that employs young workers, you remain responsible for ensuring that any personal data you upload about those individuals is handled appropriately and in compliance with applicable law.

Your data is primarily stored and processed within the UK and European Economic Area. Where it is transferred outside these areas — for example, to US-based service providers like Stripe and Supabase — we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

We may update this policy as our platform evolves or as legal requirements change. When we make significant changes, we'll let you know by email or by a notice on the platform before the changes take effect.

The date at the top of this page always reflects the most recent revision.

If you have any questions about this policy or how we handle your data, please get in touch:

• Email: support@smartcoretechnology.co.uk
• Website: smartcoretechnology.co.uk
• ICO registration reference: ZC233982

If you're not happy with how we've handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk — though we'd appreciate the chance to address your concern first.

All of our legal and data protection documents, including this policy, are also available together at smartcoretechnology.co.uk/legal.