Who We Are
Baselign is a product of Gravity Works Limited, a company registered in England and Wales with company number 12557038. In this Privacy Policy, “Baselign”, “we”, “us”, and “our” refer to Gravity Works Limited.
You can contact us about this policy or your personal information at support@baselign.co.uk.
Scope
Baselign provides software for managing work orders, assets, forms, site activity, team communication, and related operational workflows. This Privacy Policy applies to information processed through our marketing website, the customer portal, the client dashboard that customers can share with their own clients, and our field engineer mobile applications for Android and iOS.
Our Role
Gravity Works Limited is the controller of personal information we collect for our own purposes, such as website enquiries, customer account administration, billing, security, and support.
Operational data that a customer organisation enters into Baselign, including information about its staff, its own clients, and their sites, is processed on behalf of that customer. For that data the customer is the controller and we act as its processor, processing the data only on the customer's instructions. If your employer or a company you work with uses Baselign, please contact them first about how they use your information.
Information We Collect
We collect information that is reasonably necessary to provide and support the service. Depending on how a customer uses Baselign, this may include:
- Account details such as names, work email addresses, phone numbers, job roles, profile photos, and organisation names.
- Sign-in and security information, including hashed passwords, two-factor authentication settings, session records, failed sign-in attempts, IP addresses, and browser or device type.
- Operational content submitted by customers, such as work orders, forms, asset and site records, notes, tasks, comments, messages, and support tickets.
- Photos, video, audio recordings, signatures, drawings, and documents uploaded to the service. This can include staff compliance documents such as certificates and their expiry dates.
- Details of a customer's own clients and site contacts, such as names, phone numbers, email addresses, site addresses, billing contacts, and VAT numbers.
- Location information, only when a user chooses to capture it: for example, recording a position in a map field or stamping a signature with the date and location. We do not track location in the background.
- An activity history of actions taken in the service, used for audit trails and security.
- Subscription details such as the plan chosen and Stripe customer and subscription references. Payment card details are entered directly with Stripe and are never received or stored by us.
- Support and bug reports you send us, and the name, organisation, phone number, email address, and message you submit through our website contact form.
How We Use Information
We use personal and business information to operate the service, maintain security, and respond to customer requests.
- To provision and manage customer accounts and subscriptions.
- To deliver portal, client dashboard, and mobile functionality, including syncing operational data between office and field teams.
- To send service emails, such as email verification, password resets, invitations, and trial and account notices, and the activity notification emails each user chooses to receive.
- To provide customer support and training, and to respond to enquiries submitted through our website.
- To protect the platform, keep audit records, investigate misuse, and enforce our contractual terms.
- To understand how visitors use our marketing website, where you have consented to analytics.
- To comply with applicable laws, regulations, and lawful requests.
Legal Bases for Processing
Where we act as controller, we rely on the following legal bases under UK data protection law:
- Contract: to provide the service and manage customer accounts and subscriptions.
- Legitimate interests: to secure and improve the service, keep audit records, respond to enquiries, and communicate with business contacts. We balance these interests against your rights.
- Legal obligation: to meet tax, accounting, and other legal requirements.
- Consent: for analytics on our marketing website. You can withdraw consent at any time.
Cookies and Similar Technologies
Our marketing website uses Google Analytics and Google Tag Manager to understand how visitors use the site, so we can improve it. These only run if you accept them in the cookie banner shown on your first visit — nothing is set before you choose, and rejecting is just as easy as accepting. You can change your choice at any time using the “Cookie Preferences” link in the site footer. Your choice is saved in your browser's local storage.
The website also sets a short-lived security cookie when you use the contact form, to help prevent spam. Product videos on the website are embedded from Vimeo with its “do not track” setting enabled.
The customer portal and client dashboard use essential cookies to keep you signed in, and store preferences such as theme, sidebar state, filters, and sort orders in your browser. These are necessary for the service to work, or to remember your settings, and are not used for advertising or analytics.
Mobile App Data
Baselign mobile apps are designed for operational users in the field. Information entered into the apps is processed on behalf of the customer organisation so that teams can complete jobs, inspections, forms, and related workflows.
The apps ask for device permissions only when you use a feature that needs them:
- Camera and photo library, to take or attach photos and video.
- Microphone, to record audio in forms.
- Location, while the app is in use, to capture a position in a map field. The apps do not access location in the background.
- Files, when you choose a document to upload.
So that engineers can keep working without signal, the apps store some data on the device, including your sign-in session, recent jobs, messages, form drafts, and uploads waiting to sync. You can remove cached data from Settings → Security & Data → Clear Offline Data. Customers should make sure devices used with Baselign are protected with a passcode.
Where push notifications are available, we use Firebase Cloud Messaging (provided by Google) to deliver them. Your device is given a token so notifications reach it, and you can turn them off in the app or your device settings. Where app analytics are available, we use Google Analytics for Firebase to understand how the apps are used, and only with your consent where the law requires it.
The apps do not contain advertising. Maps in the Android app are provided by Mapbox, and maps in the iOS app by Apple. Tapping for directions opens your device's maps app, which is governed by that provider's own privacy policy.
How We Share Information
We do not sell personal information. We share information with service providers who help us run Baselign, subject to appropriate contractual and confidentiality protections. Our main providers are:
- Hetzner, for server hosting and databases in the EU.
- Cloudflare, for storing uploaded files and media.
- Brevo, for sending service and notification emails.
- Stripe, for subscription billing and payment processing. Stripe processes payment details under its own privacy policy.
- Mapbox, for maps and for converting addresses into map locations.
- Google, for website analytics where you have consented, and for push notifications and app analytics through Firebase where those features are available; and Vimeo, for videos embedded on our website.
We may also share information with:
- Professional advisers where necessary for legal or compliance purposes.
- Authorities or other parties when required by law or to protect rights, safety, and security.
- A buyer or successor if our business, or part of it, is sold or reorganised, subject to this policy.
Within the service, customers control who can see their data. For example, a customer can invite its own clients to the client dashboard to view work order progress, download reports, and raise support requests.
International Transfers
Our servers and databases are hosted in the EU. Some of our other service providers, including Stripe, Mapbox, Google, and Vimeo, may process information outside the UK, including in the United States. Where personal information is transferred outside the UK, we rely on adequacy regulations, the UK International Data Transfer Agreement or Addendum, or other safeguards recognised under UK data protection law.
Data Retention
We retain information for as long as necessary to provide the service, meet contractual obligations, resolve disputes, maintain security records, and comply with legal requirements. Customer operational data is generally retained according to the customer agreement and the customer's instructions. If a trial or subscription ends, the account becomes read-only and data is kept so the customer can resubscribe.
Customers can request deletion of their account and data held within that account at any time. Accounts can be deleted directly from the Settings section of the portal, client dashboard, or mobile apps. Customers may also submit a deletion request using our support request form or contact us at support@baselign.co.uk for assistance with account or data deletion.
When data is deleted, the following applies:
- A team is deleted, including when its last member deletes their account: any paid subscription is cancelled, access ends immediately, and all of the team's data is then permanently erased. That covers members, clients, records, uploaded files, and activity history.
- A member leaves or is removed while the team continues: their account is closed, but their name stays on the records they created, submitted, or were assigned to. The same applies to client dashboard users. Those records belong to the customer organisation and are kept for record keeping and audit until the team itself is deleted.
- Individual records, such as a work order or a note, are removed from use immediately and permanently erased in a weekly cleanup.
- Inactive teams: if nobody signs in to a team for two years and it does not have an active paid subscription, we permanently delete the team and its data.
- Accounts not linked to any team, such as an abandoned sign-up, are deleted after 30 days.
- Billing records: Stripe retains invoices and payment records in line with its own legal and financial obligations, even after a team is deleted.
We back up our systems nightly and keep each backup for 7 days. Deleted data can therefore remain in backups for up to 7 days after it is erased from the live service, and is only restored to recover from an incident.
We keep website enquiries for as long as needed to respond and follow up with you.
Security
We use reasonable administrative, technical, and organisational safeguards to protect information against unauthorised access, loss, misuse, or alteration. These include encryption in transit, hashed passwords, optional two-factor authentication, sessions that can be revoked by signing out, and account lockout after repeated failed sign-in attempts. No system can guarantee absolute security, so customers should also maintain appropriate internal controls over user access, devices, and credentials.
Your Choices and Rights
Under UK data protection law you may have the right to access your personal information, and to ask us to correct, delete, or restrict it, to object to its processing, or to receive a copy of it in a portable format. Where we rely on consent, you can withdraw it at any time.
Where we process data on behalf of a customer organisation, that organisation is the primary point of contact for these requests, and we will help it respond. You can control which notification emails you receive in your account settings.
To exercise your rights, contact us at support@baselign.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), although we would appreciate the chance to address your concerns first.
Children
Baselign is intended for business use and is not directed to children. We do not knowingly collect personal information from children through the service.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect product changes, legal requirements, or operational updates. When we do, we will update the effective date shown above.