Privacy policy

Last updated: 11 May 2026

1. Who we are

Shield Index is a commercial-risk intelligence platform for UK construction subcontractors, operated by White Ace AI Ltd (a UK-registered company, "we", "us"). We are the data controller for personal data processed through this service. The Information Commissioner's Office (ICO) is our supervisory authority.

2. What data we collect

• Account data: email address, name, organisation name (collected via Clerk authentication).
• Project data: project names, client names, main contractor names you enter.
• Email data: emails forwarded to your project's Shield address (sender, recipient, subject, body, date, attachments).
• Site reports: daily notes, verbal-instruction records, photos uploaded by your team.
• Documents: contracts, drawings and other files you upload.
• Payment data: processed by Stripe — we store your Stripe customer ID, never your card details.
• Usage data: audit logs of system events (email received, classification completed, export generated).

3. How we use your data

• To deliver the Shield Index service: capturing, classifying and structuring project correspondence.
• To generate AI classifications of email content (via Anthropic's Claude AI).
• To generate dispute pack PDFs when you request them.
• To send notification emails for critical and high-severity flags.
• To process your subscription payments via Stripe.

We do not sell your data, share it with advertisers, or use it to train AI models.

4. AI processing

Email content is sent to Anthropic's API for classification. Anthropic does not use API inputs to train their models. Classifications are stored alongside the original email in your account database. AI output is indicative risk signal — not legal advice.

5. Legal basis (UK GDPR)

• Contract (Article 6(1)(b)) — processing necessary to deliver the service you've subscribed to.
• Legitimate interest (Article 6(1)(f)) — audit logging for evidence integrity, which both parties (you and Shield) require to make the product work.

6. Data storage and security

• Data stored in Supabase managed Postgres with row-level security (multi-tenant isolation enforced at the database).
• Application hosted on Fly.io, London (lhr) region.
• All connections TLS-encrypted in transit.
• Email content SHA-256 hashed at the moment of capture for evidence integrity.
• Audit logs are append-only — they cannot be modified or deleted.
• We do not log email content, subject lines, or sender addresses in application logs.

7. Data retention

Your data is retained for the duration of your subscription. After cancellation we retain it for 90 days so you can reactivate or export — after which it's permanently deleted. Deleted items within an active account are soft-deleted (marked as deleted, retained 90 days, then permanently removed).

8. Your rights under UK GDPR

• Access — export all your data via Settings → Export My Data (JSON format).
• Rectification — contact us to correct inaccurate data.
• Erasure — request deletion of your account and all associated data.
• Portability — download your data in JSON.
• Object — object to processing based on legitimate interest.
• Complain — to the ICO (ico.org.uk) if you believe we've mishandled your data.

9. Third-party processors

• Clerk — authentication (USA, SOC 2 compliant).
• Supabase — database and file storage.
• Anthropic — AI classification (USA, no training on API data).
• Stripe — payment processing (PCI DSS Level 1).
• Postmark — email ingestion and transactional email (USA).
• Fly.io — application hosting (London region).

10. International transfers

Where we transfer data outside the UK (e.g. to Anthropic and Stripe in the USA), we rely on the UK–US Data Bridge or Standard Contractual Clauses (SCCs) approved by the ICO.

11. Cookies and analytics

We use a minimum of strictly-necessary cookies for session management. We do not run third-party analytics, advertising trackers or fingerprinting scripts. Full detail on our cookies page.

12. Contact

For privacy enquiries or to exercise your rights, email privacy@shieldindex.app.