Security and privacy
The binding text is the privacy notice, the same notice the app shows under your account. This page is a guide to it. Every quoted paragraph below is copied word for word from version 6 of the notice (30 September 2026); where this page and the notice differ, the notice is right.
Who is responsible
KASQ is run by APPSTAR LTD (company number 17261860), 86 South Norwood Hill, London SE25 6AQ — the company responsible for your data under UK data protection law (the controller). Reach us at hello@kasq.uk.
Two kinds of information pass through KASQ. Your own — your email address, what you ask, which tools you used — is controlled by APPSTAR LTD. Your company's records — the workers on a site register, their certificates, audit photographs, names on a Take 5 — are controlled by your company, and KASQ holds them for it as processor.
We do not sell anything to anybody. We do not use your data, your documents or your photographs to train AI models. There are no advertising or analytics companies in this product.
Where it lives, and who else handles it
One server in Falkenstein, Germany, rented from Hetzner, and its backups on Hetzner storage in Finland.
The companies we hand any of this to, in full, and what each of them gets. Hetzner: everything on the server and in the backups, because the machine and the storage are theirs. OpenAI: what you ask, what you type into the AI tools, the text of a document you upload for a check, the pages of a certificate you ask Kit check to read, and a voice note to turn into text — to work out the answer. Resend: your email address and the words of the three emails above. Stripe: the card and billing details you type on its page, your email address, and the account number that joins a payment to your KASQ account. Cloudflare: every connection to KASQ passes through it, and it runs the bot check on sign-in. Google: the mailbox behind hello@kasq.uk, so an email you send us sits there. Google or Microsoft again, only if you choose to sign in with them: you sign in on their page, and they tell us your email address. Each of them runs on its own suppliers, named in their own notices.
Signing in
An email address and six digits, or one of the sign-in providers offered on the sign-in page (today Google and Microsoft). From a provider we take your email address and nothing else — no contacts, no calendar, no files. The six digits live in memory for ten minutes and are never written down. Sign-in is protected by Cloudflare's bot check.
If you sign in with Google or Microsoft, that company handles your data for sign-in too, and version 6 of the notice names both of them in its list of who else handles it:
Google or Microsoft again, only if you choose to sign in with them: you sign in on their page, and they tell us your email address.
Signing in has the details, including invite codes.
Documents you upload, and the AI provider
Documents you upload for a RAMS review, a COSHH assessment or a CPP check are different. They travel over an encrypted connection and, unless you have asked us to keep your RAMS (below), are never stored — not even their filenames — and are deleted as soon as the check finishes. That holds for a safety data sheet even when you save the assessment made from it: the sheet itself goes, and what stays is what we read out of it (see KEEPING YOUR COSHH ASSESSMENTS). Their TEXT is read by an external AI provider: that is how the check is done. The provider processes that text in the United States; the transfer is covered by standard contractual clauses with the UK addendum in our agreement with them — write to us for a copy of those safeguards. Email addresses, phone numbers and National Insurance numbers are stripped automatically before that happens. Names are not — removing them reliably is harder than a pattern match, and we would rather say so. Take out any names you would rather not send.
Keeping your RAMS, your toolbox talks and your COSHH assessments each has its own section in the notice. Each is something you accept before anything is kept, and anything you keep can be taken off the shelf again.
How long things are kept
The notice sets out every record. Among them:
- Questions to the site advisor and its answers: through the beta, and up to 90 days after it ends.
- The record of which tools you opened and used: 24 months.
- A site audit or a RAMS you have removed from your list: 6 years on a paid plan, 12 months on Free, from the day you remove it.
- Kit check registers and the Site register: what you put in them is kept while you keep it there.
- Documents uploaded for a check, and safety data sheets: not stored, unless you keep your RAMS.
- Voice recordings for dictation: never written to disk; only the words you choose to send are kept.
- Take 5, site signs, vibration and noise set-up: in your browser only.
An audit you have REMOVED FROM YOUR LIST is kept 6 years on a paid plan and 12 months on Free. The clock starts on the day you remove it, never on the day you sent the report, and a walk still on your list is not deleted however old it is.
Security
Connections are encrypted, and backups are encrypted before they leave the server — kept on a rolling year: 14 daily, 8 weekly, 12 monthly. We do not claim the server's own disk is encrypted, because today it is not; that needs the machine rebuilt, and until it is done we will not say otherwise.
- A photograph taken through KASQ is stripped of its embedded camera data — including the location the phone recorded — before it is stored.
- Card details go to Stripe and never to KASQ.
Closing your account
Deleting your account ends every session it has, and takes your email address off our disk. The clean-up that removes the lines is run by hand, so allow a few days for the last of it.
When you delete the account, the deletion screen counts the company records the account holds and asks whether they go with the account or stay. KASQ does not choose for you.
Your rights
Ask for a copy of what we hold about you, have it corrected or deleted, have its use restricted or object to it, or take a copy elsewhere — email hello@kasq.uk and we will act on it. If you think we have handled your data badly you have a right to complain to us — write to hello@kasq.uk and we will answer — and you have a separate right to complain to the Information Commissioner's Office at ico.org.uk. You do not have to come to us first.
Your account page also has Download my data.
This page as markdown · for AI tools: llms.txt · llms-full.txt