Spanwise Privacy Notice

How Spanwise handles personal data in the documents you upload.

Last updated: 26 August 2026

Who we are

Spanwise is a trading name of Spanwise Technologies Ltd, a company registered in England and Wales, company number 17404129. We provide automated screening of structural calculation packages for building control teams. Contact: hello@spanwise.co.uk.

For documents uploaded by a council, the council is the data controller and Spanwise is the data processor acting under a data processing agreement. For your account details and enquiries via this website, Spanwise is the controller.

What we collect

• Account data: username, name, work email address (provided by your organisation when your account is created).
• Uploaded documents: structural calculation packages, which typically contain third-party personal data (applicant and engineer names, site addresses, contact details).
• Usage data: submissions made, screening results, processing costs.
• Enquiries: name, organisation, email and message from the contact form.

How we use it

• To run the screening service: reading the text and page images of your document, an AI review of it, and emailing the screening report to you.
• To improve screening quality: before anyone at Spanwise reads a document, an automated pass removes or blacks out the personal data it can find (names, addresses, postcodes, phone numbers, emails and planning references), and only that reduced copy is used for the review. The process is automated and is not guaranteed to be complete: personal data written by hand, or appearing only inside an image of a page, may survive it. So we do not treat these copies as anonymous. We continue to treat them as personal data, and everything in this notice applies to them.
• To respond to enquiries and administer accounts.

Lawful basis: performance of a contract with your organisation; legitimate interests (service improvement using the reduced copies described above, security); consent where required for enquiries.

AI processing and international transfers

Your documents are processed in the United States. All of our processors are US-based. We do not offer UK or EU-only processing, and we are not able to keep your documents in the UK or the EU. Transfers rely on the EU Standard Contractual Clauses together with the Information Commissioner's International Data Transfer Addendum, which is the mechanism UK law provides for sending personal data to the United States.

• OpenAI carries out the screening itself. The full text of your document is sent to OpenAI, and so are images of individual pages, which is how we read handwritten calculations. OpenAI does not use data sent through its API to train its models.
• Google does two things. It transcribes pages we cannot read as text, such as scans and handwritten sheets, so images of those pages are sent to Google. It also runs the pass that finds the personal data we then remove from our retained copies, which means the document's text is sent to Google as well. We use Google's paid service, under which Google does not use our content to improve its products and does not have people read it. It is logged briefly to check for misuse.
• Anthropic carries out supporting steps: pulling structured details such as member sizes out of the text for the report, re-transcribing any page Google is unable to read, standing in if the pass above fails, and powering the help chat on our website. Anthropic does not use this data to train its models by default, and retains it only briefly for abuse monitoring.
• Railway hosts the application and the database. Railway's own agreement states that its primary processing operations take place in the United States.
• Resend delivers report emails.

Because some pages are photographs of handwritten sheets, personal data on those pages (for example a site address or a signature) cannot be removed before processing.

How long we keep it

• Raw uploaded documents: deleted once a reduced copy exists and the record is more than 30 days old; processing records within 24 hours.
• At our AI processors: documents (text, and the page images described above) are held for up to 30 days for abuse monitoring under each provider's standard policy, and deleted after that. A legal preservation obligation on a provider can override its own deletion policy. Providers do not use data sent through their business interfaces to train their models, other than where their usage policies allow content flagged for review to be examined.
• Reduced copies (with the personal data we could find removed): retained for quality review for as long as our agreement with your organisation lasts, then deleted with everything else.
• Screening results and account data: for the duration of our agreement with your organisation.
• Contact enquiries: up to 12 months.

Your rights

You (and the individuals whose data appears in submitted documents) have the usual UK GDPR rights: access, rectification, erasure, restriction, portability and objection. Contact hello@spanwise.co.uk; where the council is the controller, we will pass the request on and assist. You may complain to the Information Commissioner's Office (ico.org.uk).

Security

Encryption in transit and at rest, hashed credentials and session tokens, per-user data isolation, automated PII redaction before internal review, and automatic deletion schedules. No document content is written to logs.

Cookies

Spanwise uses only essential session cookies for login. No analytics or advertising cookies.