Privacy policy

This policy explains what personal data Foreman collects, how we use it, who we share it with, and what your rights are. It covers both the electricians who use Foreman and the customers whose details those electricians share with us in the course of using the service.

Who we are

Foreman is operated by Luke Pledger, a sole trader trading as “Foreman” from the United Kingdom. We are the data controller for the personal data described below.

We are registered with the UK Information Commissioner’s Office (ICO) as a data controller. Our registration reference is ZC133369.

Service address: 60 Tottenham Court Road, Office 1267, Fitzrovia, London W1T 2EW, United Kingdom.

Contact / data protection enquiries: hello@foremanai.trade. As a sole trader we are not required to appoint a Data Protection Officer; data-protection enquiries are handled by Luke Pledger and answered from this address.

The two kinds of people in our data

Foreman handles two distinct groups, with different relationships to us:

• Electricians — our customers. They sign up, buy credits, and use Foreman to draft electrical documents. We are the data controller for their account and usage data.
• End customers — the homeowners and businesses whose names, addresses, and installation details appear in the documents the electrician dictates. The electrician is the data controller for those records; Foreman processes them as a data processor acting on the electrician’s instructions to produce the requested draft.

If you are an end customer and want to exercise rights over your data, your first point of contact is the electrician who instructed the work — they are the data controller and will be best placed to locate and act on your records. You may also contact us directly at hello@foremanai.trade and we will assist or pass the request to the electrician as appropriate.

What data we collect

From electricians (when you sign up and use Foreman):

• WhatsApp number (your account identifier)
• Business name, day rate, and VAT details (if provided during onboarding)
• Voice notes you send via WhatsApp to dictate observations, test results, and other job details
• Photos you send via WhatsApp (for example, of consumer units or an installation)
• The draft documents Foreman produces for you: EICR observation schedules, EICs, Minor Works certificates, remedial quotes, and invoices
• Billing data: Stripe customer ID and credit balance (your card details are held by Stripe, never by Foreman)
• Basic technical data: error reports and usage events used for product improvement and debugging

From end customers (indirectly, via content you share with Foreman):

• Names, addresses, and installation details that appear in the voice notes and photos you send — for example, the occupant’s name and the property address for an EICR, or the client and site address on a quote
• Any other personal data about your customers that you include when dictating a document: test results, fault descriptions, remedial observations

We do not independently collect data directly from your end customers. What we hold about them comes entirely from you.

How we use it

We use this data to:

• Provide the Foreman service — receiving your voice notes and photos, transcribing them, and producing draft documents
• Deliver drafted PDFs back to you via WhatsApp
• Process payments and manage your credit balance through Stripe
• Improve and debug the product (technical logs, error reports, limited product analytics)
• Send service messages (billing receipts, credit balance updates, policy change notices) via WhatsApp
• Comply with legal obligations (tax records, fraud prevention)

What we never do with your data:

• We do not sell personal data.
• We do not use your voice notes, photos, transcripts, or drafted documents to train AI models.
• We do not use Foreman data for advertising or marketing to third parties.

Lawful basis (UK GDPR Art. 6)

• Contract — to deliver Foreman to you under our Terms of Service: creating and operating your account, receiving and transcribing voice notes and photos, producing draft documents, and processing payments through Stripe.
• Legitimate interest — to keep the service secure, debug technical issues, and improve the product. Our legitimate interest does not override your privacy rights; you can object to this processing at any time.
• Legal obligation — to keep tax records (six years) and respond to lawful requests from regulators or authorities.
• Consent — for any optional marketing communications (none currently sent), withdrawn at any time.

Who we share data with (sub-processors)

Foreman uses the following third parties to operate the service. Each is bound by a data processing agreement or equivalent contractual terms. We notify you in advance of any material addition or replacement of a sub-processor that processes personal data. Data may be processed outside the UK under the appropriate safeguards described below.

• Anthropic (US) — runs the AI that drafts electrical documents from your voice-note transcripts and photos. Your content is sent to Anthropic’s API for inference. Anthropic does not use this data to train its models.
• OpenAI (US) — automatic speech-to-text for voice-note transcription. Audio is sent to OpenAI’s Whisper API. OpenAI does not use this data to train its models.
• Meta / WhatsApp (US, EU) — the messaging platform through which all documents, voice notes, photos, and service messages are exchanged. Meta processes messages in transit in line with its Business Messaging policy and terms.
• Stripe (US, UK, EU) — processes one-off credit pack payments. Holds card data; we do not.
• Railway (US) — hosts the application and database. All data at rest is encrypted. Tenant data is isolated at the row level so one account cannot access another’s data.
• Sentry (EU — Frankfurt) — error and crash reporting. Sensitive fields are redacted before transmission.
• PostHog (EU — Frankfurt) — privacy-respecting product analytics. Event names and account identifiers only; no document content.

International transfers

Some sub-processors are based in the United States. Where data is transferred outside the UK, the transfer is covered by an appropriate safeguard under UK GDPR Chapter V — typically the European Commission’s Standard Contractual Clauses read with the UK International Data Transfer Addendum, the UK International Data Transfer Agreement, or an adequacy decision (such as the UK-US Data Bridge for certified US providers).

Details of the specific safeguards relied on for any given sub-processor can be provided on request — email hello@foremanai.trade.

How long we keep it

• Active accounts — for as long as your account is active.
• After account deletion — your data is immediately deactivated at deletion. All account data (voice notes, photos, drafted documents, etc.) is permanently deleted within 30 days, after which database backups will have rotated. A hashed audit record of the deletion is retained for legal and accountability purposes (one-way hashes only — no identifying details).
• Voice notes and photos — retained for as long as the related drafted document is active on your account, and deleted on request or when your account is deleted.
• Document share links (PDF URLs) — the public link generated when Foreman sends you a PDF via WhatsApp expires automatically after 72 hours. The link becomes inaccessible after that point; a fresh link can be generated on request, and the underlying file is deleted on request or when your account is deleted.
• Billing records — Stripe retains transaction records for at least six years to meet UK tax requirements.
• Technical logs — retained for up to 90 days, then automatically purged.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw any consent you have given
• Lodge a complaint with the ICO at ico.org.uk/make-a-complaint, or by post at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

To exercise any right, or to request deletion of your account and data, email hello@foremanai.trade. We respond within 30 days.

Security

Data is encrypted in transit (HTTPS) and sensitive credentials are encrypted at rest. The database enforces tenant isolation at the row level — one account cannot read another’s data. Webhook signatures are verified before any state change is processed.

Cookies

See our cookies policy for details on what we set and why.

Automated decision-making

Foreman uses AI to draft electrical documents from the voice notes and photos you send. This does not constitute solely automated decision-making that produces legal or similarly significant effects on you within the meaning of UK GDPR Article 22 — every draft must be reviewed and signed by you before it has any legal effect. You remain in control at all times.

Children

Foreman is intended for adults (18+) operating an electrical business. We do not knowingly collect data from children.

Changes to this policy

We will update this page and revise the “Last updated” date. Material changes will also be notified to active accounts via WhatsApp at least 30 days before they take effect.

Contact

Questions, requests, or concerns: hello@foremanai.trade.