Privacy policy

1. Who we are

MyHeavyPlantMate (the iPhone and Android apps, the web app and this website) is provided by Purple Loop Limited, a company registered in England and Wales with company number 08069332, whose registered office is at 195 High Street, Lye, Stourbridge, DY9 8LH.

We are the data controller for the personal data described in this policy. That means we decide how and why it is used, and we are responsible for looking after it.

If you have any questions about this policy or your data, email [email protected].

2. What we collect

Your account

• Email address: to identify your account, sign you in and send you account emails (see below). We also record whether you have confirmed it.
• Display name: the name you choose to show in the app.
• Password: if you sign up with email, we store only a secure one-way hash of your password, never the password itself.
• Apple or Google sign-in: if you choose Sign in with Apple or Sign in with Google, we receive and store the unique account identifier that Apple or Google gives us for you, together with the email address and, if they share it, the name they provide (which we use as your display name). If you use Apple’s “Hide My Email”, we receive Apple’s relay address instead of your real one. We do not receive your Apple or Google password.
• Account settings: your account name and your preferred units and currency.

Your machine records

Everything you choose to enter about your machines and how you use them, so that we can store it and sync it between your devices. This includes:

• machines (name, type, make, model, year, serial number, road registration, CESAR or Datatag id, fleet number, operating weight, what’s fitted, base yard, current site, notes, and whether you have reported it stolen) and their engines (make, model, serial number, fuel type, power);
• engine hour-meter readings and engine running times;
• shifts (start and end times, the site, the operator, weather, notes, and the start and end positions if you allow them, see Location below);
• daily pre-use checks and other checklists, and the checks you have run, including which items passed, failed or were not needed;
• defects (what was found, when, by whom, how serious, and how it was resolved);
• maintenance jobs and service records (what was done, when, who did it, cost, parts, notes);
• fuel entries (date, fuel type, quantity, cost, hour meter reading);
• attachments such as buckets, breakers and forks (name, type, make, model, serial number, which machine they are fitted to);
• hire periods (the customer’s name, site and contact phone number, dates, rate, notes);
• your operators (see below);
• document details (type, title, reference number, issuer, issue and expiry dates, notes);
• photos and PDF files you add, and their details such as the file name, type and size (see below).

Some fields are free text, so they will contain whatever you type into them. If you record information about other people (for example a hire customer’s contact details or the engineer who serviced your machine), please only include what you need and what they would be comfortable with.

Your operators

You can keep a list of the people who run your machines (you, your employees, hired-in drivers): their name, and if you choose to add them, their phone number, email address and notes, plus documents such as a CPCS, NPORS, IPAF or CSCS card with its number and expiry date. An operator’s name is recorded against the shifts they run and the defects they report, so your records show who did what. Operators do not have their own sign-in and cannot see the app; the information is held in your account, and you are responsible for telling them what you record and for keeping it accurate. We only use it to provide the app to you.

Photos and files

When you add a photo or PDF to a document, service record, defect, shift, attachment, machine or other item, it is uploaded and stored with your account, so you can open it on your other devices and in the web app. Your files are only available to you, through your signed-in account; they are never made public. Before a photo is uploaded, the app resizes and converts it, which also removes any location information stored inside the photo. The phone apps keep a copy of your files on the phone so they work offline. The app only uses your camera or photo library when you choose to add a file.

Location

Only the iPhone and Android apps use location, and only while the app is open on screen and only if you have given it permission. It does not track you in the background, does not record your route, and does not collect location at any other time.

• Start and end position: when you start or end a shift, the app can save one position at the start and one at the end, stored with the shift. The first time you start a shift, a “Save start and end position” switch lets you choose. Once you have allowed the app to use your location, it saves these two positions for each shift.
• “Use my current location”: the Site field of a shift has a button that fills in the name of the place you are at. Only when you tap it, the app gets your current position and asks your phone’s built-in location service (Google on Android, Apple on iOS) for the place name. That means your position is sent to Google or Apple at that moment, under their own privacy policies. Only the place name is filled in, and you can edit it.

You can refuse or withdraw location permission in your phone’s settings at any time; shifts work without it. The web app never uses your location, though it will show positions saved on your phone. If you choose to open a saved position on a map, it opens on the OpenStreetMap website, which then receives that position. If you report a machine stolen and use “Share details”, the summary you share includes the last shift’s end position as a map link; it goes only where you send it.

Your devices

When you sign in, the app registers the device with your account so it can keep you signed in and sync correctly. For each device we store:

• a random identifier created by the app when it is first installed (not a hardware or advertising identifier);
• the device name (the name you have given your phone, such as “Sam’s iPhone”, or otherwise its make and model; in a web browser, simply “Web browser”);
• the platform (iOS, Android or web) and the app version;
• when the device was last seen.

We also keep secure sign-in tokens for each signed-in device (stored in a hashed form) so you don’t have to enter your password every time.

Error reports

If the app or our servers run into an error or crash, a report is sent to our error-monitoring service so we can fix the problem. It describes what went wrong, together with technical details such as the app version, the type of device and its operating system. It is set up not to include personal data such as your name, email address or the contents of your records.

Technical information

Like any online service, our servers necessarily receive your device’s IP address when the app connects to them. We use it to limit repeated sign-in and password-reset attempts, which protects accounts from being guessed. Our hosting and network providers may also record IP addresses and request details in short-lived technical and security logs.

When you contact us

If you email us, we will have your email address and whatever you include in your message.

3. What we don’t do

• We don’t show adverts, and we don’t use your data for advertising.
• We don’t include any third-party analytics, tracking or advertising tools in the apps or on this website.
• We don’t sell or rent your personal data to anyone.
• We don’t use your data to make automated decisions that have legal or similarly significant effects on you.
• We don’t send marketing emails. We only send emails about your account: confirming your email address, password resets, security notices, and notices about your free trial, subscription and data.

4. How we use it, and our lawful bases

UK data protection law requires us to have a lawful basis for each way we use personal data. Ours are:

Reminders and alerts (such as a service coming due, a LOLER report about to expire, an open defect or a hire that is overdue) are worked out by the app on your own device from your records. The audit pack PDF for a machine is made on our servers from your records when you ask for it, and is sent only to you. On the phone they are delivered as notifications scheduled on the device itself; we don’t send them from our servers.

5. Who we share it with

We only share personal data with organisations that help us run MyHeavyPlantMate, and only as much as they need. They act on our instructions and must keep it secure.

• Our hosting provider (servers in the UK): runs the servers that store your account, machine records, photos and files, and their backups.
• Our website hosting provider (in the EU): hosts this website and the web app.
• A network and security provider: delivers our websites and service to you and protects them against attacks, so it processes connection details such as your IP address and the requests your device makes.
• An email delivery provider (in the EU): sends account emails such as email confirmation, password resets, security notices, and notices about your free trial, subscription and data, so it processes your email address and the content of those emails.
• An error-monitoring service (in the EU): receives the error reports described above, and is set up not to receive personal data.

A current list of these service providers is available on request: email [email protected].

Some other organisations are involved in ways they control themselves:

• Apple and Google: if you choose to sign in with Apple or Google, they confirm your identity to us. When you tap “Use my current location”, your phone’s built-in location service from Apple or Google looks up the site name (see Location above). The apps are also distributed through the App Store and Google Play, which collect information under their own privacy policies.
• Authorities: we may disclose information if we are legally required to, or to protect the rights, property or safety of our users, the public or ourselves.
• A new owner: if MyHeavyPlantMate or our business is ever sold or reorganised, your data may transfer to the new owner, who must continue to protect it in line with this policy. We will tell you before that happens.

6. Where your data is stored

Your account, machine records, photos and files are stored on servers in the UK. This website and the web app are hosted in the EU, and our email delivery and error-monitoring services are in the EU. Our network and security provider operates internationally. If any of our providers process personal data outside the UK, we make sure it is protected by an adequacy decision or by appropriate safeguards such as the UK International Data Transfer Agreement or Addendum.

The phone apps also keep a copy of your records and files on your phone so they work offline. The web app keeps a copy of your records in your browser’s memory while it is open.

7. How long we keep it

• Your account, machine records, photos and files are kept for as long as you have an account, and deleted when you delete your account.
• If your free trial or subscription ends and you don’t subscribe again, your account becomes read-only and your data is kept for 12 months, so you can come back to it or export it. After that it is deleted automatically. We email you 30 days and 7 days before.
• Items you delete in the app disappear from all your devices. When you delete a photo or file, the file itself is deleted from our storage. So that a deletion can reach every device you use, a record that the item was deleted is kept on our servers until you delete your account.
• Backups are kept for a limited period (up to 14 days) and then deleted. Data you delete may remain in a backup until it expires, but we won’t restore it into the live service except to recover from a serious failure, and we would delete it again straight away.
• Sign-in tokens expire after 60 days without use, and are removed when you delete your account.
• Technical logs and error reports are kept only for as long as needed for security and troubleshooting, and are deleted after a limited period.
• Emails you send us are kept for as long as we need them to deal with your request.
• Data on your phone stays there until you sign out, delete your account in the app, or uninstall the app. Signing out or deleting your account removes your records and files from that device.

8. Deleting your account

You can delete your account at any time:

• In the app: go to More → Your data → Delete account. This takes effect immediately.
• Online: follow the steps on our delete your account page.
• By email: email [email protected] with the subject “Delete my account” from the email address on your account. We will delete it within 30 days.

Deleting your account permanently removes your account, your sign-in details, your registered devices, all of your machine records (including your operators, attachments, defects, fuel entries and hire periods) and all the photos and files you have added from our live systems. Copies in our backups are deleted as the backups expire, within 14 days. It cannot be undone.

9. Keeping it secure

We protect your data with measures including encrypted connections (HTTPS) between the apps and our servers, one-way hashing of passwords and sign-in tokens, short-lived access tokens, files that can only be opened through your signed-in account, secure storage on your phone for the token that keeps you signed in, and a secure, browser-protected cookie for the same purpose on the web. Access to our systems is limited to people who need it. No system is perfectly secure, but if a breach affecting your data ever happens, we will act quickly and tell you and the ICO where the law requires.

10. Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018), you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected (you can edit most of it yourself in the app);
• have your data erased;
• restrict how we use your data in some circumstances;
• object to us using your data where we rely on legitimate interests;
• data portability: receive the data you gave us in a structured, machine-readable format (in the app: More → Your data → Export);
• withdraw consent at any time where we rely on it (for location, by changing your phone’s settings).

To exercise any of these rights, email [email protected]. We may need to confirm it’s really you, usually by asking you to write from the email address on your account. We will reply within one month. There is normally no charge.

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: visit ico.org.uk/make-a-complaint or call 0303 123 1113.

11. Children

MyHeavyPlantMate is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has created an account, please contact us and we will delete it.

12. This website

We don’t set any cookies on this website, and it doesn’t use analytics or any third-party scripts, fonts or services. Our website hosting provider and our network and security provider receive your IP address and basic request details when you visit, as any website host does, and may keep them briefly in security logs.

The MyHeavyPlantMate web app (a separate site) uses one strictly necessary cookie to keep you signed in, and stores a random device identifier and a few preferences, such as the alerts you have dismissed, in your browser’s local storage. It doesn’t use any tracking or advertising cookies. A machine’s QR tag links to the web app; scanning it only opens that machine if you are signed in to the account it belongs to.

13. Changes to this policy

We will update this policy if the app or the way we use data changes. We will change the “last updated” date at the top, and if the changes are significant we will tell you in the app or by email before they take effect.

14. Contact us

For anything about this policy or your data, email [email protected].