1. Who we are

Cabledox is operated by Cabledox Solutions Ltd ("Cabledox", "we", "us"), a company registered in England and Wales under company number 17265232, with its registered office at [REGISTERED OFFICE ADDRESS].

We are registered with the Information Commissioner's Office under registration number ZC218363.

For any privacy question, or to exercise the rights described in section 9, contact us at admin@cabledox.co.uk. We are happy to deal with all enquiries in writing.

2. Our two roles

We handle personal data in two different capacities, and the distinction matters for your rights.

As a controller — for information about visitors to our website, people who contact us or request early access, and the individual users of customer accounts (name, email, role, login records).

As a processor — for the project content that a customer uploads into the platform. Cable schedules, drawings, test results, checklists, photographs and handover records belong to the customer. Where those documents contain personal data, the customer is the controller and we process it on their instructions under our agreement with them.

3. Information we collect

Account information. Name, email address, username, role, employer or client organisation, password (stored hashed), and records of when you accepted our Terms and this policy.

Customer content. Cable schedules, drawings, cable and core records, test results, checklists, snags, site issues, QA attachments and handover documents uploaded or created by users of a customer account. This may incidentally include names of the people who carried out or signed off work.

Support messages. When you use the in-app "Contact Cabledox" feature we record your message together with your user account, role, the page you were on, the job you were viewing, and basic device information, so we can reproduce the problem.

Website and product enquiries. Contact form submissions, early access requests, and information entered into our savings or ROI calculator.

Technical and usage data. IP address, browser and device type, pages viewed, and in-product activity events, collected for security, diagnostics and to understand how the product is used.

Audit records. The platform records who performed significant actions such as importing a schedule, signing off an area or closing a job. This is a deliberate feature: the resulting record is part of the quality evidence our customers rely on.

Marketing preferences. If you opt in, your consent to receive product updates from us.

4. Why we use it, and our lawful basis

• To provide the service — performance of a contract with you or your employer.
• To authenticate users and keep accounts secure — performance of a contract, and our legitimate interest in protecting the platform.
• To respond to support requests and enquiries — performance of a contract, or our legitimate interest in answering people who contact us.
• To diagnose faults and improve the product — our legitimate interest in providing a working and improving service.
• To maintain audit and quality records — performance of a contract, and the legitimate interests of our customers in holding reliable evidence of the work carried out.
• To send marketing communications — your consent, which you can withdraw at any time.
• To meet legal, tax and regulatory obligations — compliance with a legal obligation.

We do not sell personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects.

5. AI-assisted features

Cabledox can read a PDF cable schedule and extract its contents automatically. To do this, the document you upload is sent to the Anthropic Claude API for processing. This may include the contents of your project documents.

Anthropic processes that content in order to return a result to us and does not use it to train its models. We retain a copy of the raw response for a limited period so that extraction faults can be diagnosed, and delete it after 30 days.

Extraction is always presented for review. Where the software is not confident about a value it flags it for a person to resolve rather than filling in a guess. Nothing extracted by AI is treated as verified until a user confirms it.

If you would prefer not to use this feature, cable schedules can be imported from spreadsheet or CSV files instead, which involves no AI processing and no transfer to Anthropic.

6. Who we share information with

We use a small number of service providers who process data on our behalf. We do not share your information with anyone else except where required by law, or where necessary to establish, exercise or defend legal claims.

• Supabase — database and file storage. Frankfurt, Germany.
• Render — application hosting. Frankfurt, Germany.
• IONOS — domain, DNS and email. Germany and the United Kingdom.
• Anthropic — AI document extraction, as described in section 5. United States.
• Tawk.to — website live chat. United States.
• cron-job.org — scheduled task triggering. Germany. This service receives no personal data.
• Stripe — payment processing, where a paid subscription applies. Ireland and the United States. We do not receive or store your full card details.

We will update this list before adding any new provider that processes personal data.

7. International transfers

Our database, file storage and application hosting are located in Germany. Transfers from the United Kingdom to the European Economic Area are covered by the UK's adequacy regulations.

Transfers to providers in the United States, including Anthropic, Tawk.to and Stripe, are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with any additional safeguards we consider appropriate.

8. How long we keep it

Customer content is retained for as long as the customer's account is active. On termination, the customer may export their data, and we will delete or return it within 30 days unless we are required to keep it by law. Where a customer's own retention obligations require a longer period, we will agree that with them in writing.

Account records are kept for the life of the account and for 12 months afterwards.

Support messages are kept for 24 months.

Audit records are retained alongside the job they relate to, because their value is that they survive to handover and beyond.

Technical logs and analytics are kept for 12 months.

Marketing consent records are kept until you withdraw consent, and for a short period afterwards to evidence that you did.

9. Your rights

Under UK data protection law you have the right to access a copy of your personal data, to have inaccurate data corrected, to have data erased in certain circumstances, to restrict or object to processing, to data portability, and to withdraw consent where consent is our basis for processing.

If we hold your data as a processor on behalf of one of our customers, we will pass your request to that customer and support them in responding.

To make a request, contact us using the details in section 1. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you raised it with us first so we have a chance to put it right.

10. Security, and what we do not promise

Access to the platform requires an account, and permissions restrict users to the jobs they are assigned to. Data is encrypted in transit. Passwords are stored hashed and are never visible to us.

We take regular backups of the database. Uploaded files, including drawings and photographs, are stored separately and are not covered by those database backups. We are working to change that, but until we confirm otherwise you should keep your own copies of any document you upload. We will not claim a level of protection we do not have.

No system is completely secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the ICO and, where required, you.

11. Cookies

We use cookies that are necessary for the site and application to function, including for login sessions and security. We also use a small number of cookies for our own analytics, and our live chat provider sets its own. We do not use advertising cookies and we do not share data with advertising networks.

12. Changes to this policy

We may update this policy. The version number at the top of this page changes whenever we do. Where a change is material we will tell existing users and, where appropriate, ask them to accept the new version before continuing to use the service.