Privacy policy

This policy explains what personal data Modyx collects, how we use it, who we share it with, and what your rights are. It covers both the electricians who use Modyx and the customers whose details those electricians share with us in the course of using the service.

The short version:to turn a dictation into a certificate, we send the audio to OpenAI and the transcript to Anthropic — and that dictation usually describes somebody else’s home and its electrical faults. Both are in the United States. Neither trains on it. The detail is here. Our application and database are hosted in the European Economic Area — not the UK. We have removed an earlier claim that Modyx was “UK-hosted”; it was not accurate.

Who we are

Foreman is operated by Luke Pledger, a sole trader trading as “Foreman” from the United Kingdom. We are the data controller for the personal data described below.

We are registered with the UK Information Commissioner’s Office (ICO) as a data controller. Our registration reference is ZC133369.

Service address: 60 Tottenham Court Road, Office 1267, Fitzrovia, London W1T 2EW, United Kingdom.

Contact / data protection enquiries: hello@modyx.co. As a sole trader we are not required to appoint a Data Protection Officer; data-protection enquiries are handled by Luke Pledger and answered from this address.

The two kinds of people in our data

Foreman handles two distinct groups, with different relationships to us:

• Electricians— our customers. They sign up, subscribe, and use Foreman to draft electrical documents. We are the data controller for their account and usage data.
• End customers— the homeowners and businesses whose names, addresses, and installation details appear in the documents the electrician dictates. The electrician is the data controller for those records; Foreman processes them as a data processor acting on the electrician’s instructions to produce the requested draft.

If you are an end customer and want to exercise rights over your data, your first point of contact is the electrician who instructed the work — they are the data controller and will be best placed to locate and act on your records. You may also contact us directly at hello@modyx.co and we will assist or pass the request to the electrician as appropriate.

What data we collect

From electricians (when you sign up and use Foreman):

• Mobile number and email address (your account identifiers)
• Business name, day rate, and VAT details (if provided during onboarding)
• Voice notes, photos, and text you capture in the Modyx app to dictate observations, test results, and other job details (for example, photos of consumer units or an installation)
• The draft documents Foreman produces for you: EICR observation schedules, EICs, Minor Works certificates, remedial quotes, and invoices
• Billing data: Stripe customer ID and subscription status (your card details are held by Stripe, never by Foreman)
• Basic technical data: error reports and usage events used for product improvement and debugging

From end customers (indirectly, via content you share with Foreman):

• Names, addresses, and installation details that appear in the voice notes and photos you send — for example, the occupant’s name and the property address for an EICR, or the client and site address on a quote
• Any other personal data about your customers that you include when dictating a document: test results, fault descriptions, remedial observations

We do not independently collect data directly from your end customers. What we hold about them comes entirely from you.

How we use it

We use this data to:

• Provide the Foreman service — receiving your voice notes, photos, and typed notes, transcribing them, and producing draft documents
• Deliver drafted certificates to you in the Modyx app for review, and email the signed PDF to your customer when you choose to issue it
• Process your subscription payments through Stripe. Your card is stored when you sign up and is not charged that day: your first 5 certificates and 10 quotes/invoices are free. Modyx then costs £39/month, charged when you use that allowance up — not on a date — and renewing monthly. We email you before the first payment. You can cancel at any time. See clause 5 of the Terms of Service.
• Improve and debug the product (technical logs and limited product analytics, which you can switch off in Settings)
• Send service messages (billing receipts, subscription updates, policy change notices, and nudges if a certificate is left mid-dictation) — in the app, by email, by SMS, or over WhatsApp where you use that channel
• Comply with legal obligations (tax records, fraud prevention)

What we never do with your data:

• We do not sell personal data.
• We do not use your voice notes, photos, transcripts, or drafted documents to train AI models.
• We do not use Foreman data for advertising or marketing to third parties.

Lawful basis (UK GDPR Art. 6)

• Contract— to deliver Foreman to you under our Terms of Service: creating and operating your account, receiving and transcribing voice notes and photos, producing draft documents, and processing payments through Stripe.
• Legitimate interest— to keep the service secure, debug technical issues, and improve the product. Our legitimate interest does not override your privacy rights; you can object to this processing at any time.
• Legal obligation— to keep tax records (six years) and respond to lawful requests from regulators or authorities.
• Consent— for any optional marketing communications (none currently sent), withdrawn at any time.

What happens to a dictation — read this one

This is the part of the policy that matters most, so we are stating it plainly rather than burying it in a list.

When an electrician dictates a certificate, the recording is typically a description of somebody else’s home— the property address, and the condition and electrical faults of that property. To turn that into a certificate, we send it to two AI providers outside the UK:

• The raw audio is sent to OpenAI to be transcribed into text (we use the gpt-4o-transcribemodel). This is the actual recording of the electrician’s voice, including any address or occupant name spoken aloud.
• The resulting transcript, and any photos taken (for example of a consumer unit), are sent to Anthropic (the Claude models) to be turned into the structured certificate: observations, classification codes, and remedial actions.

Both providers process this data in the United States. Under our API terms with each of them, this content is not used to train their models, and it is sent over their business APIs rather than their consumer products.

If you are an electrician using Modyx, you should know this is happening, because youare the data controller for your customers’ information and it is your call whether that is an acceptable use of it. If you do not want a property’s address processed by an AI provider, do not speak it into the dictation — type it in afterwards, or use a job reference instead.

Who we share data with (sub-processors)

We use the third parties below to operate the service. Each is bound by a data processing agreement or equivalent contractual terms. We notify you in advance of any material addition or replacement of a sub-processor that handles personal data.

Sentry (error and crash monitoring) is live on our website and our servers, hosted in Sentry’s EU region (Germany). It receives error reports and performance traces — the page you were on, your browser, and an internal account ID. Login links are stripped from any URL before it is sent. It is not currently enabled in the iOS app, which sends no crash data at all. See the cookies policy for detail.

International transfers

We do not claim that Modyx is “UK-hosted”, and you should not rely on that. Our application and database run in the European Economic Area, and several sub-processors — including the two AI providers that see your dictations — are in the United States.

• Transfers to the EEA(our hosting) are permitted under the UK’s adequacy decision for the EEA. No additional transfer agreement is required.
• Transfers to the United States(OpenAI, Anthropic, Resend, Stripe, Expo, Meta) rely on a safeguard under UK GDPR Chapter V — either the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or the European Commission’s Standard Contractual Clauses read with the ICO’s International Data Transfer Addendum.

We will tell you which specific safeguard we rely on for any given sub-processor if you ask — email hello@modyx.co.

How long we keep it

• Active accounts— for as long as your account is active.
• After account deletion— your data is immediately deactivated at deletion. All account data (voice notes, photos, drafted documents, etc.) is permanently deleted within 30 days, after which database backups will have rotated. A hashed audit record of the deletion is retained for legal and accountability purposes (one-way hashes only — no identifying details).
• Voice notes and photos— retained for as long as the related drafted document is active on your account, and deleted on request or when your account is deleted.
• Document share links (PDF URLs)— the link generated for viewing or downloading a certificate PDF expires automatically 72 hours after it is issued. The link becomes inaccessible after that point; a fresh link can be generated on request, and the underlying file is deleted on request or when your account is deleted. A certificate you have signed is kept on your account beyond that window — only the shareable link expires.
• Billing records— Stripe retains transaction records for at least six years to meet UK tax requirements.
• Technical logs— application logs are retained by our hosting provider under its own retention settings and are deleted on that provider’s rotation schedule. We do not currently operate a separate fixed-period purge of application logs, and we would rather say so than quote you a number we do not enforce. Logs are not used for anything other than diagnosing faults.
• Data held by AI providers— OpenAI and Anthropic apply their own limited retention to API requests for abuse-monitoring purposes, under their commercial API terms, and do not train on this content. We do not control those retention periods.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw any consent you have given
• Lodge a complaint with the ICO at ico.org.uk/make-a-complaint, or by post at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

To exercise any right, or to request deletion of your account and data, email hello@modyx.co. We respond within 30 days.

Security

Data is encrypted in transit (HTTPS/TLS) and sensitive credentials are encrypted at rest. The database enforces tenant isolation at the row level — one account cannot read another’s data. Passwords, where set, are hashed with bcrypt. Sign-in links are single-use and expire after 15 minutes, and a signed-in session lasts up to 7 days before you need to sign in again. Webhook signatures are verified before any state change is processed.

Cookies

See our cookies policy for details on what we set and why.

Automated decision-making

Foreman uses AI to draft electrical documents from the voice notes and photos you send. This does not constitute solely automated decision-making that produces legal or similarly significant effects on you within the meaning of UK GDPR Article 22 — every draft must be reviewed and signed by you before it has any legal effect. You remain in control at all times.

Children

Foreman is intended for adults (18+) operating an electrical business. We do not knowingly collect data from children.

Changes to this policy

We will update this page and revise the “Last updated” date. Material changes will also be notified to active accounts via email at least 30 days before they take effect.

Contact

Questions, requests, or concerns: hello@modyx.co.