Legal
Privacy policy
Last updated 14 Nov 2026
RAMSdoc is operated by Signal Solutions Ltd ("we", "us"), registered in England and Wales with company number 12478841. Our registered office is Sentinel House, Ancells Business Park, Harvest Crescent, Fleet, Hampshire GU51 2UZ. We are registered with the Information Commissioner's Office under number ZB358515. This policy explains what personal data we collect, why, and what your rights are. It covers this website, the RAMSdoc web app, the mobile app and the Claude connector.
Questions about this policy or your data: hello@ramsdoc.com.
Controller or processor?
It depends on whose data it is.
- Your account and billing details, and anything you send us through this website — we are the controller.
- The content your organisation puts into RAMSdoc — documents, projects, sites, the names, signatures, competencies and locations of your workers and contractors, incident reports, photos and anything a member of the public submits through a site QR code — your organisation is the controller and we process it on your instructions under our terms. If you are a worker or contractor whose details are in RAMSdoc, the organisation that invited you is responsible for that data; contact them first, and we will help them respond.
What we collect
| Data | Where from | Why | Lawful basis |
|---|---|---|---|
| Name, email, password (hashed), job role, organisation | You, when you register or are invited | To run your account | Contract |
| Billing name, address, VAT number, payment card (held by Stripe, not us) | You, at checkout | To take payment and issue invoices | Contract; legal obligation (tax records) |
| Documents, projects, sites, hazards, photos, incident reports and other content | Your organisation and its users | To provide the service | Processed on your organisation's instructions |
| Sign-off records: name, company, signature image, time, and GPS position if the signer allows it | Workers signing a briefing | To evidence who was briefed, as required by your organisation | Processed on your organisation's instructions |
| Competency records: card and certificate types, numbers and expiry dates | Your organisation | To check competency against document requirements | Processed on your organisation's instructions |
| Activity log: who did what and when in the app | Generated as you use the service | Audit trail, security | Contract; legitimate interests |
| Device and usage data: IP address, browser, pages, errors | Generated as you use the service | Security, fixing faults | Legitimate interests |
| Push notification token | The mobile app, if you allow notifications | To send notifications you've asked for | Consent |
| Contact form: name, email, company, message | You, on this website | To reply | Legitimate interests |
AI processing
When you use an AI feature — drafting a document, suggesting hazards, checking compliance, analysing an incident or a what-if scenario — the text you provide for that action is sent to an AI provider to generate the result. A photo attached to a concern reported from a site QR code is checked the same way. We send only what the feature needs. Our providers are contracted not to train their models on your content. AI output is a draft for a competent person to review; see the terms.
Who we share data with
We use these processors, each under a contract that restricts them to acting on our instructions:
- Hosting — DigitalOcean, for our application servers and database, in the UK.
- Backblaze — daily backups of the database, stored in the EU.
- Cloudflare — DNS, security, and R2 storage for generated documents, uploads and photos.
- Netlify — hosting for this website and the web app, and the contact form.
- Stripe — payments. We never see your full card number.
- AI providers — Anthropic (Claude models, reached through our own AI gateway) and TypeSafe, for the AI features above.
- Met Office — we send site postcodes or coordinates to fetch forecasts. No personal data.
- Expo, Google and Apple — push notification delivery for the mobile app.
- Email delivery — Resend, for account and notification emails.
Error reports go to an error-reporting service we run ourselves, not to a third party. They may include your IP address and account ID.
A few things load straight from another company to your device, so that company sees your IP address: fonts from Google Fonts on this website and in the web app, maps from Google in the Android app and from Apple in the iPhone and iPad app, and the OpenStreetMap map on a permit in the web app.
We also share data when the law requires it, or with your organisation's administrators (who can see what their users do in RAMSdoc). We do not sell personal data.
Anonymised, aggregated statistics — for example how often a hazard appears across all documents in an industry — are used to improve the hazard library and may be shown to other customers as benchmarks. They never identify an organisation, a person or a document.
International transfers
Our servers are in the UK. Some processors (for example Anthropic, Resend, Expo, Google and Apple) process data in the United States under the UK International Data Transfer Agreement or the UK Extension to the EU-US Data Privacy Framework. TypeSafe also stores the data we send it in the United States.
How long we keep it
- Your account and your organisation's content: for as long as the organisation exists in RAMSdoc. That includes after a trial or subscription ends, when the account becomes read-only.
- The Owner can delete the organisation at any time from Settings. Everyone in it is signed out straight away and its data is permanently deleted 30 days later. Until then we can restore it if the Owner asks.
- What stays after an organisation is deleted: documents it had already submitted to another organisation (that organisation's copy, with the versions it reviewed), its people's entries on another organisation's site register, and records we must keep by law (for example invoices, for 6 years).
- Sign-off, permit and incident records are health and safety records; your organisation decides how long to keep them, and the law may require several years.
- Exported PDF and Word files: deleted automatically after 90 days.
- Error reports and server logs: only for as long as we need them to find and fix faults.
- Contact form messages: while we deal with your enquiry. Ask us and we'll delete them.
Security
Data is encrypted in transit (TLS). Access inside RAMSdoc is controlled by organisation and role. Our staff access customer content only to support you or to fix a fault.
Your rights
Under UK GDPR you can ask us to access, correct, delete or restrict the use of your personal data, object to processing based on legitimate interests, and receive your data in a portable format. Where we rely on consent, you can withdraw it at any time. Email hello@ramsdoc.com and we'll respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
Cookies
See the cookie policy.
Changes
We'll post changes here and update the date at the top. For significant changes we'll email account holders.