Privacy
This explains what we collect, why, and what you can do about it. It is written to be read rather than to be survived.
The short version
We collect what the service needs, we send marketing only if you tick the box, we sell nothing to anyone, and your documents are yours.
Who is responsible
Drone Imagery Services Ltd, trading as Four Drills, is the data controller for everything described here. Data questions go to hello@fourdrills.co.uk.
Where your organisation uses this service to hold records about your own staff, you are the controller for that information and we process it on your instructions.
What we collect
| Your account | Your email address, and your name and organisation details if you give them. There is no password, ever: signing in is a six-digit code sent to your inbox, so there is no password for us to hold or to lose. |
|---|---|
| Your venue | The answers you give about your building: its exits, safer areas, entry points, assembly points, capacity assessment and the procedures generated from them. |
| Your staff | The names, roles and contact details you enter for the people on your roster, and the record of which version of your procedures each of them confirmed reading, and when. This is information about your employees and volunteers, entered by you. |
| Activity | When a document was generated, downloaded or amended, who by, and from what address; when you signed in; and the checklist items you have marked as done. This is the evidence trail the product exists to produce. |
| Consent records | If you ask to hear from us, we record the address, what you agreed to, the page you agreed on, the date, and the date you withdrew if you do. Keeping the record is how we can show the agreement was real. |
| Payment | Handled by Stripe. Card details never reach our servers. We hold the customer and subscription references Stripe gives us, and what you paid. |
| The free scope check | The use category and capacity figure you entered, and the outcome, with no name attached. It tells us how many venues we turn away and why. The free record you can download from that screen creates no account and stores nothing else. |
Why, and on what basis
| To provide the service | Running your walkthrough, generating your documents, keeping your attestation trail and letting you download it. Basis: performance of our contract with you. |
|---|---|
| Service messages | Your sign-in codes, your download links, notice that your review is due or your renewal is coming. Basis: performance of the contract. These are part of the service and are not marketing. |
| Marketing | Only if you ticked a box asking for it. Basis: consent. Every marketing email carries a one-click unsubscribe, and you can turn it off in your account at any time. |
| Keeping the service working and honest | Security logs, rate limiting, fraud prevention, and the counts that tell us where people get stuck. Basis: our legitimate interests in running a service that stays up and does what it says. |
Cookies
We use one cookie: the session cookie that keeps you signed in. It is strictly necessary, so no consent banner is required by law and we do not show one. We set no advertising, analytics or tracking cookies. If that changes, this policy changes first.
We do not sell your data
Not to anyone, for any purpose, including anonymised or aggregated onward sale. Your venue's layout, your exits and your staff list are not a product.
Who else touches it
A small number of suppliers process data so the service can run. They act on our instructions and cannot use it for their own purposes:
- Our hosting provider, which runs the servers and the database.
- Google Workspace (Google Ireland Limited), which delivers sign-in codes, service email and any documents we email you, and which holds the mailbox those messages are sent from and replied to. Google may process this outside the UK under its standard data protection terms.
- Stripe, which takes payments.
- Anthropic (United States), which provides the automated check of your walkthrough answers before your documents are made, and the assistant on this site. It receives your answers about your building for that check. It does not receive your email address, your account details, your payment details, or anything about your staff beyond names and roles already in your answers. It does not use them to train its models.
Our hosting provider and Stripe will be named here, with their locations, before this page is published.
Where it lives, and for how long
Records are held in the UK or the EU, with the exception of email, which Google may process elsewhere as described above. While your account is open we keep your data so the service works. After you close it we keep your venue records for two years, because compliance evidence that vanishes the moment you stop paying is not evidence, and then delete it.
Your organisation's own compliance records are kept and disposed of on your instruction: you can export everything at any time, including after you cancel, and ask us to delete it sooner.
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to processing, or ask for it in a portable form. Withdraw marketing consent at any time without affecting anything else.
One caveat we would rather state than hide: where a record exists because your staff attested to a document, deleting it destroys your own evidence that they did. We will confirm before acting on that.
If you are not happy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would rather you told us first, but you do not have to.
Drone Imagery Services Ltd, trading as Four Drills · Registered in England & Wales, Company No. [COMPANY_NO not set] · Registered office: [COMPANY_REG_OFFICE not set] · VAT No. [COMPANY_VAT not set] · info@droneimageryservices.co.uk