Privacy Policy
Last updated: 4 July 2026 · Applies to the Rekkord website, web application and the Rekkord iOS and Android applications.
Who we are
Rekkord is a trading name and product of Proja AI Ltd, a company registered in England and Wales. Company No. 16963746. Registered office: 128 City Road, London, EC1V 2NX, United Kingdom. Proja AI Ltd is the controller for personal data processed through the Rekkord website and for account data. Where your organisation subscribes to Rekkord, your organisation is the controller of the workspace content (evidence, events, claims, project records) and Proja AI Ltd acts as its processor.
What we collect
- Account and business contact information — name, work email, job role, organisation, and authentication metadata.
- Organisation and workspace data — organisation name, sites, contracts, users, roles and workspace settings.
- Photos and videos — images and video you capture or select as evidence.
- Voice notes and audio — recordings you choose to attach to a record.
- Precise location and GPS evidence — a location fix captured at the moment you record an event or attach evidence, used to geotag and verify the record. We never track your location in the background.
- Timestamps and device information — capture times, device model, OS version, app version and locale.
- Contracts, evidence, notes and uploaded files — the business content you and your colleagues create in the workspace.
- Usage, diagnostic and security information — feature usage, error reports, IP address and audit logs of significant actions.
Mobile app permissions
The Rekkord mobile apps request camera, microphone, photo library and location access only at the point you use the associated feature — never on launch. If you decline location access you can still select or type the site manually; the resulting evidence is clearly labelled as not location-verified. We do not request background location.
How we use it and our lawful basis
- To provide the Rekkord service to your organisation — performance of a contract.
- To secure the service, prevent abuse and keep audit trails — legitimate interests and legal obligation.
- To support you and respond to enquiries — legitimate interests / contract.
- To improve reliability and product quality using aggregated diagnostics — legitimate interests.
- To generate AI drafts — your explicit consent, recorded in-app before any processing.
- To send occasional product updates — your consent, withdrawable at any time.
AI processing and subprocessors
AI drafting is optional. Before your first use we present a clear disclosure and record your consent and its policy version; you can review or withdraw it at any time in Settings → AI processing. When you request a draft, the relevant event, evidence description, contract and narrative text is sent to our configured AI processing provider solely to produce that draft. Content is not used to train public models. AI output is a drafting aid and is not legal advice. Our subprocessors include our managed cloud and database hosting provider, our AI gateway and model providers, our email delivery provider and our error-monitoring provider. A current list is available on request from hello@rekkord.co.uk.
Where it's stored, retention and deletion
Customer data is stored on managed cloud infrastructure hosted in the European Union, with encryption at rest and TLS in transit. Workspace content is retained for as long as the subscribing organisation's workspace is active, and afterwards in line with its instructions and any legal or contractual retention requirement. Diagnostic logs are kept for a limited period. You can delete your account at any time in the app under Settings → Account → Delete Account; this revokes your access, deletes your credentials and sessions and deletes or anonymises your personal profile data. Business records owned by the subscribing organisation may be retained under that organisation's instructions and applicable law.
International transfers
Where a subprocessor processes data outside the UK or EEA, transfers are covered by the UK International Data Transfer Addendum and/or Standard Contractual Clauses, with supplementary measures where required.
Your rights
You have the right to access, correct, export or delete your personal data, and to object to or restrict processing, subject to UK GDPR. Where your organisation is the controller of the workspace content, we will direct your request to it. To exercise these rights, contact hello@rekkord.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
Security
See our Trust page for detail on encryption, access control, row-level data isolation and audit logging.
Contact
Questions? Email hello@rekkord.co.uk or use the contact page.