Privacy Policy

Alpha Controls LDN Ltd (“we”, “us”, “our”) is a Building Management Systems (BMS) contractor based in Gravesend, Kent, United Kingdom. We install, commission, and maintain building controls systems for commercial and public sector clients.

We also operate govnr.ai, a SaaS platform for contractor workforce management, shift scheduling, compliance tracking, and project administration. This privacy policy covers both the Alpha Controls website (alphacontrols.io) and the govnr.ai platform.

Alpha Controls LDN Ltd is the data controller for the purposes of UK GDPR and the Data Protection Act 2018.

We collect and process the following categories of personal data:

Personal information

• Full name, email address, and phone number
• Emergency contact details
• Profile photograph

Professional data

• CSCS card number and type
• Professional certifications and qualifications
• Skill level and trade classifications

Work and attendance data

• Shift attendance and timesheet records
• Work locations and site assignments
• GPS location data (when signing into or out of site)
• Hours worked and overtime
• Photographs (site evidence, progress photos)

Financial data

• Bank details (for payroll processing)
• CIS tax status and UTR number
• Day rate and payment information

Compliance data

• Digital signatures on compliance documents (RAMS, method statements, inductions)

Communication data

• Call recordings made through our AI phone system for quality assurance and record-keeping
• SMS notification logs

Business data

• Quotation and invoice records
• Project details and associated documentation

Contact form and quote requests

• Full name, email address, and phone number
• Company name
• Message content and project details

Blog and newsletter subscribers

• Email address

Technical data

• IP address, browser type, and device information
• Usage data and analytics collected through our website
• Cookies (see Section 9 below)

We only process your personal data where we have a lawful basis to do so under UK GDPR. The bases we rely on are:

Legitimate interest

• Managing employment and contractor relationships
• Scheduling shifts and tracking attendance
• Processing payroll and invoicing
• Maintaining health and safety compliance records
• Quality assurance through call recordings
• Improving our services through analytics

Contractual necessity

• Providing access to the govnr.ai platform
• Delivering BMS contracting services
• Processing quotes and invoices

Legal obligation

• HMRC record-keeping requirements for financial data
• Health and safety compliance documentation
• Construction industry verification (CSCS checks)

Consent

• Optional AI-powered features (estimation tools, SMS parsing, intelligent scheduling)
• Marketing communications (where applicable)
• Non-essential cookies

Where we rely on consent, you may withdraw it at any time by contacting us or adjusting your account settings.

• Shift management: scheduling operatives, tracking attendance, and managing site assignments
• Payroll and finance: calculating hours worked, generating invoices, and processing payments
• Compliance: recording digital signatures on safety documents, verifying CSCS credentials, and maintaining audit trails
• AI-powered features: automated project estimation, intelligent SMS parsing for shift confirmations, and AI-assisted phone call handling
• Communication: sending shift notifications, updates, and reminders via SMS and email
• Platform improvement: analysing usage patterns to improve the govnr.ai platform
• Quality assurance: reviewing call recordings to improve service delivery

We share your data with the following sub-processors, each of which has their own privacy policy and data processing agreements in place:

We do not sell your personal data to any third party. We may also share data with professional advisors (accountants, legal counsel) and regulatory authorities where required by law.

Some of our sub-processors are based outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place:

• Supabase: hosted in London, UK (eu-west-2)
• Vercel: global CDN with edge locations worldwide; data processing governed by standard contractual clauses
• Anthropic, Twilio, Retell AI: US-based; transfers rely on standard contractual clauses (SCCs) and supplementary measures as required by UK GDPR
• Stripe: certified under international data transfer frameworks with standard contractual clauses
• OpenAI, Google Cloud: US-based; transfers governed by standard contractual clauses and data processing addendums
• GoCardless: EU/UK-based; acts as an independent data controller for payment data
• Upstash: US-based company; transfers rely on the EU-US Data Privacy Framework and its UK Extension, with standard contractual clauses and the UK Addendum as a fallback
• Better Stack: transfers rely on standard contractual clauses with the UK Addendum
• Sentry: account and organisation data is held in the US; transfers rely on the provider’s data processing agreement

We retain your data only for as long as necessary for the purposes for which it was collected:

• Active data: retained for as long as we have an active business relationship with you or as long as needed to provide our services
• Financial records (invoices, payment records, timesheets used for payroll): 6 years from the end of the financial year, as required by HMRC
• Operational data (shift records, attendance, project assignments): duration of your engagement with us, plus 12 months
• Call recordings: 30 days from the date of recording, unless a longer retention is required for dispute resolution
• Compliance documents (signed RAMS, induction records): duration of the relevant project, plus 6 years. Records involving hazardous substances are retained for 40 years as required by COSHH regulations
• Account data: until you delete your account or request erasure
• Analytics data: aggregated and anonymised; retained indefinitely

When data is deleted, it moves to a recycle bin and is retained for 90 days in case of accidental deletion. After 90 days, it is permanently and irreversibly purged.

When data is no longer needed, it is securely deleted or anonymised.

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your personal data (subject to legal retention obligations)
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interest
• Right to restrict processing: request that we limit how we use your data
• Right to withdraw consent: where processing is based on consent, withdraw it at any time

How to exercise your rights

You can exercise your rights by:

• Emailing us at info@alphacontrols.io
• Deleting your account directly through the govnr.ai portal
• Writing to us at the address listed in the Contact section below

We will respond to your request within one month. In complex cases, we may extend this by a further two months, in which case we will notify you.

Our website uses cookies to provide essential functionality (such as authentication sessions and user preferences) and to collect anonymised analytics data through Vercel Analytics.

For full details on the cookies we use and how to manage them, please see our Cookie Policy.

Our services and platform are not designed for or directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a person under 18, please contact us immediately and we will take steps to delete it.

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the “Last updated” date at the top of this page. For significant changes, we will notify you via email or through a notice on our platform. We encourage you to review this policy periodically.

If you are unhappy with how we have handled your personal data, we would appreciate the chance to resolve your concerns directly. Please contact us using the details below.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

If you have any questions about this privacy policy or how we handle your data, please contact us:

• Company: Alpha Controls LDN Ltd
• Email: info@alphacontrols.io
• Address: Gravesend, Kent, United Kingdom

This section applies only if you use the GUVNR plugin inside ChatGPT. The plugin connects ChatGPT to a GUVNR service at mcp.guvnr.ai that offers five tools for construction tenders: analysing a tender, drafting RFIs, building a pricing schedule, checking a quote against tender scope, and laying out a tender pack spreadsheet. Where this section differs from the rest of this policy, this section applies to the plugin.

No account, and no access to GUVNR accounts

The five tools are anonymous. You do not sign in to GUVNR to use them, and the plugin does not read from or write to any GUVNR account, project, tender or quote.

What the service receives

• The fields ChatGPT sends in a tool call. These are short structured items that ChatGPT has prepared from your conversation: for example statements about the tender, document names and clause references, short excerpts, quantities, and any rates you gave. They can include commercial information and, if it appears in what you shared, personal information.
• Not your files. The tender documents, drawings and other files you share with ChatGPT are not uploaded to this service. It is not built to receive or fetch files.
• Technical data. Your request reaches us through OpenAI, so the IP address we see may be OpenAI’s rather than yours. ChatGPT may also send an anonymised identifier for the ChatGPT user making the call, an anonymised conversation identifier, an organisation identifier, an approximate location, the browser or app version, and your language setting. The service uses only the user identifier, which it hashes as described below. It does not use or log the others.

What we do with it

• The service checks and organises the fields it was sent and returns the result to ChatGPT. It does this with fixed rules. These five tools do not send your content to any AI model on our side.
• The content of a tool call is held in memory while the request is handled. The service does not save it to the GUVNR database and does not write it to our application logs.
• The tender pack spreadsheet. The tender pack tool returns a layout only: the sheets, columns and rows, built from the fields sent in that request. ChatGPT creates the spreadsheet file from that layout on OpenAI’s side. We do not create, store or host the file, and nothing is saved to a GUVNR account.
• We do not use the content of tool calls for marketing, and we do not sell it.

What we log

To run the service, keep it secure and understand how it is used, we record operational information about each request:

• the kind of request, which tool was called, whether it succeeded, the type of any error, and whether a usage limit was applied;
• how long the request took and the size of the request in bytes;
• a one-way hash of the anonymised ChatGPT user identifier, where ChatGPT sends one. We use it to apply usage limits and to count repeat use. We cannot turn it back into the identifier, and we do not hold anything that links it to your name or email address;
• the time of the request.

Our rate limiting uses the calling IP address and the hashed identifier to count requests over a short window. Our hosting provider also keeps its own request logs for the service, as it does for the rest of our website; the technical data described in Section 2 applies to those.

Who is involved

• OpenAI. Your conversation, your files and the results the tools return are handled by OpenAI under OpenAI’s own terms and privacy policy. For that processing OpenAI is not acting on our behalf, and this policy does not cover it.
• Our service providers. Vercel hosts the service, so requests pass through its infrastructure while they are handled. Upstash holds the rate-limit counters, which are keyed by the calling IP address or the hashed identifier; if it is unavailable, the counters are held briefly in the service’s own memory instead. Better Stack receives the operational log records described above. Sentry receives error and performance reports, which are configured to leave out request content. This service does not send the content of tool calls to Upstash, Better Stack or Sentry.

How long we keep it

• Content of tool calls: not kept after the request has been answered.
• Rate-limit counters: short-lived; they are only needed while the counting window is open.
• Operational log records: kept by the providers named above for their log retention periods. We do not copy them into the GUVNR database.

Your choices

• You choose what to share in a conversation, and you can disconnect the plugin in ChatGPT at any time.
• Because the tools are anonymous and we do not keep the content of tool calls, we will usually be unable to find records relating to you. You can still contact us using the details in Section 13, and your rights in Section 8 apply to any personal data we do hold.
• For your conversation history and files in ChatGPT, use the controls OpenAI provides.