Privacy notice

Crane Parts Inventory (cranepartsinventory.com) is run by [Registered company name], company number [Company number], registered office [Registered office address]. ICO registration: [ICO registration number, or remove this line].

For anything about your personal data, write to [privacy contact email].

Controller for account data. We decide how the data needed to run your login and your company's account is used: your name, email address, sign-in codes and security records.

Processor for your company's records. What your company puts into the service (crane records, parts, suppliers, inspections, lifting equipment, engineers, documents) belongs to your company. Your company is the controller of any personal data in those records, and we process it only on your company's instructions, to provide the service. Questions about those records should go to your company first; we will help it answer them.

• Account details: email address, name, the company you belong to, your role and permissions, and your language setting.
• Sign-in and security: your password (stored only in hashed form by our authentication provider), one-time sign-in codes (kept only until used or expired), invitations, and records of sign-ins and changes made in the service (who did what and when).
• Records your company adds: these can include the names, email addresses and phone numbers of colleagues, engineers and supplier contacts; supplier addresses; inspection and examination records with photos and signatures; and documents your company uploads, such as purchase orders, price lists, certificates and parts books.
• Cookies: see "Cookies" below.

We do not use your data for advertising, we do not sell it, and we do not use tracking or analytics cookies.

• To provide the service to your company (sign-in, the records it keeps, emails it asks us to send): performance of our contract with your company, and our legitimate interest in providing the service to the people it authorises.
• To keep the service secure (sign-in codes, limiting access to your company's own data, the record of changes): legitimate interests in protecting the service and your company's data.
• To send service emails (invitations, sign-in codes, password resets, and lifting equipment notices your company turns on): performance of the contract. We do not send marketing emails.
• To meet legal obligations where the law requires us to keep or disclose information.

We use these service providers, each under a contract that limits them to acting on our instructions:

• Supabase: database and authentication.
• Cloudflare (R2): storage of uploaded files and documents.
• Vercel: hosting of the application.
• Resend: delivery of service emails.
• Anthropic: when your company uploads a parts book that our own readers cannot read, pages of that document may be sent to Anthropic's API to extract part numbers and descriptions. Parts books are technical documents and are not expected to contain personal data.

We may also disclose information where the law requires it, or to a buyer of our business under the same protections.

Your data is stored in [hosting region, e.g. EU (Frankfurt) or UK (London)]. Some of our providers are based in, or may access data from, the United States. Where data is transferred outside the UK, we rely on the UK International Data Transfer Addendum or other safeguards recognised under UK data protection law.

• Account details for as long as your account is active. When your company removes you, or deletes its account, your account data is deleted.
• One-time sign-in codes until they are used or expire.
• Your company's records for as long as your company keeps them in the service. When your company deletes its account, its records are deleted from the database and the files it uploaded are deleted from file storage at the same time. Files another company also uses, such as shared manufacturer manuals, are kept.
• Records of changes may be kept after a record is removed, where they are needed to show who did what (for example for inspection and lifting equipment history your company must be able to produce).
• Backups are overwritten on our providers' normal schedule.

Under UK data protection law you can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable form. Write to [privacy contact email]. We will reply within one month. If the data is in your company's records, we will pass your request to your company, which decides on it.

You can also complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to put things right first.

We use only cookies the service needs to work:

• Sign-in session cookies, set by our authentication provider, which keep you signed in.
• A sign-in verification cookie, set after you enter the code we email you, so the code is not asked for again on the same device for a while.
• A language cookie, which remembers the language you chose.
• A company cookie for platform staff who switch between companies they support.

These are strictly necessary, so we do not ask for consent to them. We do not use analytics, advertising or tracking cookies.

Each company's data is kept apart in the database, so one company cannot see another's. Files are stored privately and are reached only through short-lived links. Access within a company follows the roles and permissions its administrators set.

We will update this notice when what we do changes, and change the effective date above. Material changes will be announced in the service.