Privacy policy
Version 2026-10-22. This explains what personal data Capstone collects, why, and your rights.
1. Who we are
Capstone is a job management service for grounds maintenance and landscaping businesses, run by Tredgold Digital Ltd (company number 16955781), registered at Tredgold Avenue, Leeds, LS16 9BS. We're registered with the Information Commissioner's Office (ICO) under number ZC156526.
Contact us about anything in this policy at hello@capstoneops.app.
2. When we're the controller and when we're the processor
We're the controller of the personal data in this policy: details of people who visit this website, request access, or hold a Capstone account, and how they use the service.
The businesses that use Capstone keep details of their own clients, sites and team in it, such as names, addresses, phone numbers, visit photos and timesheets. For that data the business is the controller and we're its processor, acting only on its instructions under our data processing agreement. If you're a client or employee of a business that uses Capstone, contact that business about your data. We'll help them answer you.
3. What we collect
- Request access form: your name, business name, email address, phone number (if you give it), team size and any message.
- Your account: your name, email address, phone number (if you add it), your password (stored only as a secure hash, never in readable form), your role, and the business you belong to.
- Records of what you accept: which version of this policy and of the data processing agreement you accepted, and when.
- Using the crew app: your location at the moment you clock in or out and when you take a photo, never in the background. This is part of the business's data, processed on its behalf.
- "Couldn't do this here" reports: what you were trying to do, and the page or screen you were on.
- Technical data: your IP address, browser and the pages you request, kept in our server logs for security and fault finding. Our logs leave out email addresses, sign-in and portal links, and the details in web addresses.
4. Cookies
We use only cookies that are strictly necessary for the service to work: one to keep you signed in, and one to protect forms against cross-site request forgery. We don't use advertising or analytics cookies, so we don't ask for cookie consent.
5. Why we use it, and our lawful basis
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Reply to a request for access and set up your account | Steps you asked for before a contract |
| Provide the service, sign you in, send emails the service needs (password resets, invites, enquiry alerts) | Contract |
| Keep the service secure, prevent abuse (for example rate limits on sign-in and forms), find and fix faults | Our legitimate interests in running a safe, reliable service |
| Use "Couldn't do this here" reports to decide what to build next | Our legitimate interests in improving the service |
| Keep records of what you accepted, and meet tax and legal duties | Legal obligation, and our legitimate interests in being able to show what was agreed |
We don't sell personal data, use it for advertising, or make decisions about you by automated means alone.
6. Who we share it with
We use a small number of suppliers (sub-processors) to run Capstone. Each is bound by contract to protect the data and use it only to provide their service to us.
| Supplier | What for | Where |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, database, file storage and email sending | Stockholm, Sweden (EU) |
| Anthropic, PBC | Smart import: reading spreadsheets and documents a business uploads, to suggest records for it to check. Anthropic doesn't train its models on this data. | United States |
| postcodes.io (Ideal Postcodes Ltd) | Turning a site's postcode into map coordinates. Only the postcode is sent. | United Kingdom |
| Google (Google Fonts) | Serving the typefaces the website uses. Your browser requests them, so Google receives your IP address. | Global |
Capstone is hosted in the European Union, which UK law recognises as giving adequate protection to personal data. Where data goes anywhere else outside the UK, we use the safeguards UK law requires, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. We may also share data if the law requires it, or with a buyer of our business, who would be bound by this policy.
7. How long we keep it
- Requests for access: 12 months after we last heard from you, unless you become a customer.
- Account details: while your account is open, then up to 90 days after it closes, except what we must keep longer by law.
- Records of what you accepted: 6 years after your account closes.
- Server logs: 30 days. Database backups: 7 days.
- Files uploaded for import: deleted 30 days after upload.
8. Your rights
Under UK data protection law you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to move it to another service. Email hello@capstoneops.app. We'll reply within one month. There's normally no charge.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We'd appreciate the chance to put it right first.
9. Keeping it safe
Data is encrypted in transit and at rest, each business can see only its own data, staff access is limited to what's needed, and we keep backups. If a breach puts your rights at risk, we'll tell you and the ICO as the law requires.
10. Children
Capstone is a business service and isn't meant for anyone under 16.
11. Changes to this policy
If we change this policy in a way that matters, we'll update the version date above and tell account holders by email or in the app before the change takes effect.