Privacy policy.
Who we are
SHINDI is operated by SCOPR Ltd, a company registered in England and Wales under company number 17177153, with its registered office at 66 Paul Street, , United Kingdom. SHINDI turns WhatsApp messages sent by site workers into timesheets, site diary entries and payroll-ready records for construction firms.
This page is written for whoever is doing due diligence on us, whether a main contractor, an insurer or a worker asking what is held about them, as much as for a subcontractor signing up. It covers this website, the office web app and the WhatsApp service.
Questions about this page, or a request about your data: privacy@shindi.ai, or in writing to SCOPR Ltd, 66 Paul Street, , United Kingdom.
Our role: controller and processor
SCOPR Ltd acts in two different capacities under the UK GDPR, depending on whose data it is.
We decide what is held about a customer account: who signed up, billing, support conversations and demo requests. For those people, this page is our privacy notice.
The firm that engages the worker is the controller. We hold and move worker messages only on that firm’s written instructions, and we do not use them for anything of our own. A worker asking for a copy or a deletion should ask their employer first; we help the employer answer.
What we hold
From workers, over WhatsApp:
- Phone number and WhatsApp display name
- What they send to the company number: text, voice notes, photos, documents, and the time each arrived
- The site a worker clocked in at, how they clocked in, and how confident we are in it. We do not keep a worker’s map position: it is used at the moment of the clock-in and then dropped, and it is only kept at all where a clock-in was queried, until that query is closed
- What we work out from all that: transcripts, translations, clock-in and clock-out times, hours, and anything that looks wrong and needs a person to look at it
From firms and their office staff:
- Name, work email, phone number, company and job title
- Sites, jobs, pay rates and who is on the books
- Billing records
- Support messages and demo requests
We do not ask for health data, or anything else in the special categories. Where a message happens to mention something like that, it is held as part of that message and kept no longer than the message is.
How we use it
- To turn messages into timesheets, diary entries, hours and alerts for the firm
- To transcribe and translate, so a worker can write in their own language and a manager can read it in theirs
- To run, secure and support the account, and to send messages about the service itself
- To invoice, and to keep the records the law requires us to keep
- To send product updates to firms, who can opt out at any time
We do not sell personal data, we do not use any of it for advertising, and we do not use customer or worker data to train general-purpose AI models.
WhatsApp and the models
WhatsApp. Messages reach us over the WhatsApp Business Platform run by Meta. Meta Platforms Ireland carries message content sent to and from the company number, and stores it for up to 30 days as part of delivering it. That is Meta’s own retention, not ours, and it is set out here because it is outside our control. Message routing is EU/UK, with the UK data region set on our account.
The models. Anthropic’s models read messages and photos to fill in the timesheet and the diary, so nobody has to type them in by hand. They run through Amazon Bedrock, in the EU. The model provider is contractually barred from keeping the data or training on it.
Automatic reading gets things wrong sometimes. Every entry stays linked to the message it came from, so it can be checked and corrected, and nothing that affects a worker’s pay is decided by software alone. A manager confirms it first.
Lawful basis
Where we are the controller, we rely on:
- Performance of a contract: providing the service to the firm that signed up
- Legitimate interests: keeping the service secure, preventing misuse, improving it, and business-to-business marketing to firms
- Legal obligation: tax, accounting and employment record-keeping
Where we are the processor of worker data, the firm decides the lawful basis, usually its contract with the worker, or its legitimate interest in running the site. A worker chooses whether to share a location at all; sharing one is never a condition of being paid.
How long we keep things
- Timesheets and site diary entries
- 6 years, to cover CIS and tax record-keeping rules
- Photos, voice notes and messages
- 2 years, unless a live dispute needs them kept longer
- A worker’s CSCS card photo
- While the worker is active, then 90 days
- A map position kept against a queried clock-in
- Deleted when the query is closed
- Account and billing records
- 6 years, for accounting law
A firm can ask us to keep its data for less time than this. Records the law requires us to hold, pay and working-time records in particular, are kept for as long as it says, whatever else is asked.
Where your data lives
Our hosting is in the United Kingdom: AWS, London. The models run in the EU. Message content passes through Meta’s WhatsApp infrastructure with the UK data region set on our account. Nothing in the product itself is stored outside the UK and EU. Email to the addresses published on this site is the exception: those mailboxes are carried by Google Workspace, and our plan does not pin their storage to a region. Mail that your firm forwards to its own SHINDI address is stored in AWS London, like the rest of the product.
Where a supplier’s own support or engineering staff are outside the UK, that transfer is covered by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with encryption in transit and at rest either way.
Security
- Encrypted in transit and at rest
- One firm’s data cannot be read from another firm’s account. That separation is enforced by the database itself, not by application code remembering to ask
- Staff access is limited to those who need it for a job of work, and is logged
- Automatic backups of the database
If personal data is ever breached, we will tell the affected firm without undue delay and, where the law requires it, the Information Commissioner’s Office within 72 hours of finding out.
A worker’s rights, and how to use them
Anyone can ask for a copy of what is held about them, ask for something wrong to be fixed, ask for it to be deleted once it is no longer needed for the reasons above, object to what we are doing with it, or ask for it in a form they can take elsewhere.
A worker should ask their employer first, because the employer is the controller. They can also write to us at privacy@shindi.ai and we will pass it on and help answer it.
We answer within one month. Anyone unhappy with the answer can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113.