Legal

Privacy notice

Last updated November 1, 2026

This privacy notice explains how Hovermarks ("we", "us") handles personal data when you use our websites at hovermarks.com / hovermarks.co.uk or the Hovermarks platform.

Who we are

Hovermarks is a product of BrainBoxIT Limited, a company registered in England and Wales (company number 11703272) with registered office at 6 Range Green, Portsmouth, PO2 8RE, United Kingdom. Throughout this notice, "we" and "us" refer to BrainBoxIT Limited, trading as Hovermarks.

BrainBoxIT Limited is registered with the Information Commissioner's Office (ICO) as a data controller, registration reference ZC151486. Our data-protection contact is listed at the bottom of this page.

For data processed inside the platform on behalf of customers, we act as the data processor and you (our customer) are the data controller. Our customers' end-users should refer to their employer's privacy notice in the first instance.

For data we collect through our website, recruitment, sales, and support functions, we act as a data controller.

What we collect, website visitors

Cookies and analytics. See the dedicated Cookies section below for the full list of cookies we set and what each does.
Contact form submissions. Name, work email, company, employee count, how you heard about us (optional), and the message you send us. Used solely to respond to your enquiry and follow it up. The form is delivered to our Microsoft 365 mailbox.
Bot checks on our forms. The contact and waitlist forms use Cloudflare Turnstile, which receives your IP address and browser details to check the form is being sent by a person. Cloudflare's edge network may also set a security cookie (cf_clearance or __cf_bm) if it challenges a request.
Waitlist consent record. Where you tick the consent box on the waitlist form, we record the email address, the timestamp, and the verbatim wording shown to you, as proof of consent.
Server logs. IP address, request URL, user agent, retained 30 days for security and abuse prevention.

Cookies

We follow UK PECR regulation 6 and the ICO's guidance on storage and access technologies. The full list of cookies and similar technologies on our websites and in the platform, with what each does and how long it lasts, is in our cookie policy.

In short: your first visit shows a consent window where Reject all and Accept all are equally prominent. Until you choose, only strictly necessary storage is used (load-balancer and security cookies, the Cloudflare Turnstile bot check on our forms, and the record of your choice). Analytics (Plausible, cookieless) loads only if you tick Analytics. Google Ads conversion measurement loads only if you tick Marketing; it then sets Google cookies (on our domain and on Google's doubleclick.net) and records a conversion when you start a trial, send the contact form or join the waitlist. It sends no page views and we have switched off remarketing and ad personalisation. Your choice is remembered for 12 months. You can change it, or withdraw consent, at any time from Cookie preferences in the footer of every page; withdrawing deletes the Google Ads cookies on our domain.

We do not run remarketing audiences, cross-site behavioural tracking pixels (no Meta Pixel, no LinkedIn Insight, no HubSpot, no Hotjar) or Google Analytics, and we do not share visitor data with third-party advertisers.

Anonymous fault reports

When you scan an asset's QR code, our customer (the organisation that printed the sticker) may allow you to submit a fault report without creating an account. If you choose to use that form, we collect:

The description and photos you provide.
Optionally, the name and email you choose to enter.
Your IP address and browser user-agent, these are stored on the report row and are used solely for abuse triage (rate-limiting, spam filtering, and identifying coordinated misuse). They are not used for marketing or analytics. The only third party that receives them is Cloudflare, whose Turnstile bot check starts when you begin filling in the report form, not when the page opens (see "Sharing").
The submission timestamp.

The legal basis for processing IP and user-agent is legitimate interest, specifically, protecting our customers and our infrastructure from abuse of an anonymous public-facing endpoint. You can submit without entering name or email; the IP / user-agent capture is required and not optional.

Scanning a QR code

Whenever anyone opens an asset's public scan page, whether or not they report a fault, we record the scan with the time, the IP address and the browser user-agent. We use these records only to detect abuse and unusual scanning patterns (for example, a sticker copied onto the wrong equipment), on the basis of our legitimate interest in keeping the service secure. Scan records are deleted after 12 months.

If you include personal information about other people in your description or photos (for example, a colleague visible in a photo), please consider that the report will be visible to the asset owner's facilities team. Don't submit material that's better handled through a whistleblowing or grievance channel, the public fault-report form is for reporting asset faults only.

Children

Hovermarks is a workplace tool intended for adult professionals. The service is not intended for, and we do not knowingly collect personal data from, individuals under 18. If you are a parent or guardian and believe your child has used Hovermarks, contact us at privacy@hovermarks.com and we will delete the relevant data promptly. Where the UK GDPR / EU GDPR Article 8 minimum age applies (13 in the UK / 16 in most EU member states), this is the floor; practical operation of Hovermarks remains at 18+.

What we collect, customers and prospects

Account data. Names, work emails, job titles of users administering the platform.
Billing data. Company name, billing address, your VAT number if you give it to us, payment method tokens. Card numbers are handled directly by our PCI-DSS certified billing provider (Stripe, see the sub-processor list); we never see them.
Communications. Email correspondence, support tickets, demo recordings if you consented.
Inspection data processed for customers. Asset records, inspection answers, photos, signatures, and the device's GPS location when an inspection is submitted (where the device allows it). We process this as a processor on our customer's behalf, under the Data Processing Agreement at /legal/dpa.
Error and crash reports. When something goes wrong in the platform, we record technical details so we can find and fix it. For an error on our servers: the API route, the error type and message, and where in our code it happened. For a crash in your browser: the page address (without anything after a ? or #), the error message and technical stack, your browser name and version, the app version, and whether you were signed in and with which role. Email addresses, access tokens and passwords are removed before anything is stored, and form contents and photos are never included. Only Hovermarks staff see these reports. They are stored in Microsoft Azure in the UK (UK South).

Lawful basis

Contract, for everything we do to deliver the service to a paying customer.
Legitimate interest, for sales follow-up, product improvement analytics, security monitoring, and error and crash monitoring that keeps the service working. You can object at any time.
Consent, for any marketing emails to non-customers. Always opt-in, always one-click unsubscribe.
Legal obligation, for tax records and statutory retention.

How we use AI

Hovermarks offers a small set of opt-in AI features. They are available during the free trial and on every paid plan, except certificate text extraction, which is part of certificate management on Professional and Enterprise:

Photo quality gate, Azure AI Vision checks each new inspection photo and, when it can't confidently recognise anything in the frame (typically a blurred, dark or blank shot), asks the inspector to retake it; the rejected photo isn't saved. If the check can't run, the photo is accepted.
Serial-plate reading, Azure AI Vision reads a photo of an asset's nameplate, and Azure OpenAI Service suggests the manufacturer, model and serial for a new asset.
Certificate text extraction (Professional and Enterprise), Azure AI Document Intelligence reads an uploaded certificate, and Azure OpenAI Service suggests the certificate type, dates and holder.
Natural-language asset search, lets administrators query the asset register in plain English. Runs on Azure OpenAI Service.
AI report summary, Azure OpenAI Service writes a short plain-English summary of the report you're viewing.
Checklist generator, Azure OpenAI Service drafts checklist questions from a short description, for you to review before saving.

How customer data flows through these features:

All AI services are Azure-native, and our Azure AI resources are in UK South. Azure AI Vision and Azure AI Document Intelligence process photos and documents in UK South. Azure OpenAI uses Microsoft's Global Standard deployment type, so the text we send it may be processed in any Azure region where the model runs, but never the photos themselves. Nothing is stored outside the UK.
Microsoft's standard abuse monitoring applies to Azure OpenAI; prompts and outputs are never used to train models.
Customer data is not used to train any model. Azure OpenAI operates under Microsoft's standard data-handling commitments for enterprise customers, your data is not used for training, cross-customer learning, or any model fine-tuning.
Per the EU AI Act (Regulation 2024/1689) Article 50 transparency obligations: when a feature uses AI, the dashboard surfaces a visible "AI" badge so the operator knows they are interacting with an automated system.

AI features are off by default on every plan tier and must be explicitly opted in by a TenantAdmin in Settings → AI Features. They can be turned off again at any time, and the next call simply won't be made to the AI service. AI usage is metered and monthly costs are capped per plan to prevent runaway spend.

Where we process data

Inside the platform, customer data is processed in Microsoft Azure (UK). The exception is the opt-in Azure OpenAI features described above, whose prompts may be processed in other Azure regions. We never replicate primary customer data outside the UK without your written consent. US hosting is available on request: it is not set up by default, and we only arrange it in writing with an organisation that asks for it.

For our own corporate use of CRM, helpdesk, and email tools, data may transit through EU and US data centres operated by sub-processors listed in our DPA at /legal/dpa. Where transfers leave the UK, we rely on UK International Data Transfer Agreements.

Sharing

We do not sell personal data. We share it with the sub-processors listed below, strictly to deliver the service. The platform sub-processors are mirrored in our DPA at /legal/dpa and in the version-controlled register at /legal/subprocessors. Google Ads, listed below, is used on our marketing website only, never receives data from inside the platform, and so does not appear in the DPA.

Sub-processor	Purpose	Region
Microsoft Azure	Hosting, storage, identity	UK
Microsoft Entra External ID	Customer authentication / SSO	UK / EU
Microsoft Entra ID	Platform-admin authentication / SSO	UK / EU
Microsoft Graph	Transactional and notification email via Microsoft 365	UK / EU
Azure AI Vision	Inspection photo quality gate and serial-plate reading (opt-in AI features)	UK
Azure AI Document Intelligence	Certificate text extraction (opt-in AI feature)	UK
Azure OpenAI Service	Serial-plate reading, certificate text extraction, natural-language asset search, AI report summary and checklist generator (opt-in AI features). Microsoft's standard abuse monitoring applies; prompts and outputs are never used to train models.	Resource in UK South; Global Standard deployment, so processing may take place in other Azure regions
Plausible Analytics	Marketing-site analytics ONLY (the in-app dashboard does not run Plausible)	EU
Cloudflare, Inc.	DNS, edge proxy, Turnstile bot-protection on the public fault-report form and the website contact and waitlist forms	EU / US
Stripe, Inc.	Payment processing (PCI-DSS Level 1 certified). Live for all paying customers.	US / EU
Google LLC (Google Ads)	Marketing-site only. Conversion measurement when you start a trial, submit the contact form, or join the waitlist, gated on Marketing consent.	US / EU

Cloudflare, Inc., Provides Turnstile, an invisible bot-protection challenge on the public fault-report form and on the contact and waitlist forms on our websites. Your IP address and browser fingerprint are sent to Cloudflare to determine whether the submission is human-driven. Cloudflare's privacy policy: cloudflare.com/privacypolicy.

Google LLC (Google Ads). Used only on the marketing site, and only when you have ticked Marketing in our cookie preferences. Until you give that consent, Google's tag is not loaded at all, so your browser makes no request to Google. After consent, Google's tag sets its cookies and we fire a single conversion event when you start a trial, submit the contact form, or join the waitlist, so we can measure which Google Ads led to enquiries. The tag is configured to send no page views and with ad personalisation switched off, so your visit is not added to remarketing audiences. We do not use Google Analytics or any other Google tracking pixel. Google's privacy policy: policies.google.com/privacy.

We will share data with law enforcement only on lawful, written request, and we will notify the affected customer unless legally prohibited.

Retention

Website contact form submissions: 24 months after last interaction.
Website waitlist sign-ups: until we send the launch email or you unsubscribe; the record of your consent is kept for as long as we may need to show it was given.
Public scan records (time, IP address, user-agent): 12 months.
Customer account data: for as long as your organisation's account exists. After a trial ends, or a subscription is cancelled or unpaid, the account becomes read-only. From 9 December 2026 a read-only organisation is deleted automatically: 90 days after a trial ends without a plan, or 12 months after a cancelled or unpaid subscription became read-only. See "Deleting an organisation" below.
Users removed by an administrator: restorable for 30 days; their email address, phone numbers and sign-in details are then deleted, and their name (plus, for statutory reports, the qualifications and address the report must show) stays on the records they made for as long as the organisation keeps them.
Audit logs: 7 years on every plan, applied automatically by a weekly retention sweep.
Error and crash reports: up to 90 days in our logs. A summary of each distinct problem (its description, the page or route, how often it happened and when) is deleted 90 days after the problem last occurred.
Backups: encrypted database backups with point-in-time restore over a 7-day window, copied to a second UK region. Deleted files are recoverable for 30 days. Both then expire automatically.

Anonymous fault reports are retained on this per-plan schedule:

Plan	Fault-report retention
Trial	90 days
Starter	90 days
Professional	13 months
Enterprise	7 years

Photos uploaded with reports are stored in private blob storage and are deleted on the same schedule (with a 30-day soft-delete window after the row delete).

Deleting an organisation

Cancelling a subscription does not delete your data straight away. Your organisation becomes read-only when a trial ends, when a cancelled subscription reaches the end of the period you have paid for, or when a renewal is still unpaid 7 days after it was due. While it is read-only you can still sign in, view your data and export it (CSV and PDF exports and the auditor pack), and we will provide a full export on request. You can't make changes until a plan is active again.

From 9 December 2026, a read-only organisation is deleted automatically:

A trial that never becomes a subscription: 90 days after the trial ends.
A cancelled or unpaid subscription: 12 months after the organisation became read-only (the end of the last period paid for, or 7 days after a renewal that was not paid). Choosing a plan again stops this; if the subscription later ends again, a new 12 months starts.

We email the organisation's admins 30 days and again 7 days before the deletion date, and always give at least 30 days' notice. We may delay a deletion while we check that it won't affect work the organisation's people do for other organisations on Hovermarks. To keep your data, choose a plan before the deletion date; to keep a copy, export it or ask us. You can also ask us to delete your organisation sooner at any time.

When an organisation is deleted, access stops immediately and its data is held for 30 days, during which we can restore it on request. It is then permanently erased, including stored files and user accounts. Recoverable copies then expire: database backups within 7 days and deleted-file storage within 30 days, so all of the organisation's data is gone within about 60 days of deletion. If you ask us to erase your data under Article 17, we can skip the 30-day restore period.

If an administrator removes an individual user, that user can be restored for 30 days. Their personal details (email address, phone numbers and sign-in details) are then deleted, and the email address can be used for a new account. Their name stays on the records they made, for as long as the organisation keeps those records. Where they carried out or authenticated a LOLER, PUWER or PSSR report, the qualifications and address that report must show are kept with it.

We keep a minimal record that a deletion happened (organisation name, reference number, dates and the reason). This lets us demonstrate the erasure and ensures a restored backup can never bring the data back.

Your rights, UK and EU

Under the UK GDPR (and EU GDPR where it applies), you have the right to access, correct, port, restrict, object to, or erase your personal data. To exercise any of these, email us at the address below. We respond within one calendar month.

You can complain to the Information Commissioner's Office (ICO) if you're not happy with how we've handled a request.

Your rights, US residents

Even though our trading entity is in the UK and customer data is hosted in the UK, US-resident visitors to hovermarks.com (and US tenants of the platform) have rights under their state's privacy law where one applies. The list of US states with comprehensive privacy laws is expanding, as of 2026 this includes California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, Minnesota, Kentucky, Rhode Island, and others. Specific rights vary by state but generally include:

Right to know / access, what personal data we hold about you and how it's used.
Right to delete, request deletion of your personal data, subject to legal-retention exceptions.
Right to correct, fix inaccurate data we hold about you.
Right to portability, receive your data in a machine-readable format.
Right to opt out of "sale" and of "sharing" for targeted advertising, see the dedicated note below.
Right to opt out of profiling that produces legal or similarly significant effects (where the state law extends to this).
Right to non-discrimination for exercising any of the above.

To exercise any of these, email privacy@hovermarks.com with your state of residence and the right you wish to exercise. We respond within 45 days (most state laws' default), with one 45-day extension where the request is complex.

"Do Not Sell or Share My Personal Information"

We do not sell personal data and do not share personal data for cross-context behavioural advertising as those terms are defined by the California CCPA / CPRA. Because we don't engage in those activities, the "Do Not Sell or Share" choice is effectively the default, there is nothing to opt out of. If we ever introduce practices that would constitute "selling" or "sharing" under any US state law, we will publish a clear opt-out mechanism on this page and honour Global Privacy Control (GPC) browser signals.

California-specific addenda

California residents additionally have:

Right to limit use of sensitive personal information under CPRA. We do not use sensitive personal information for any purpose beyond what's strictly necessary to deliver the service (e.g., authentication via Microsoft Entra External ID).
Right to opt out of automated decision-making technology where we use it to make decisions with significant effects on you. We currently do not use ADM in this manner.
Authorised agent, you can designate an authorised agent to exercise these rights on your behalf, with proof of authorisation.

To complain about our handling of a request, you can contact your state attorney general's privacy enforcement office. For California specifically, the California Privacy Protection Agency at cppa.ca.gov is the relevant regulator.

Contact us

Data protection contact: privacy@hovermarks.com
Postal correspondence: BrainBoxIT Limited, 6 Range Green, Portsmouth, PO2 8RE, United Kingdom (mark for the attention of "Hovermarks Data Protection")
ICO registration reference: ZC151486 (BrainBoxIT Limited).

You can also raise a complaint directly with the Information Commissioner's Office at ico.org.uk/make-a-complaint.

This notice was last updated on 1 November 2026.

Material changes in scope (new sub-processors, new AI features, change of trading entity) will be notified to controllers under the DPA's 30-day prior-notice clause.