Privacy policy

Cucumber is the project system Cheyne Developments Ltd (“Cheyne”, “we”) uses to run its construction projects with its staff, consultants, clients, subcontractors and suppliers. This policy explains what information Cucumber holds about people, why, who it's shared with, how long it's kept and your rights.

Who's responsible for your information

Cheyne Developments Ltd is the controller of the personal information in Cucumber. We're a company registered in England and Wales, number 11786184, with our registered office at Norwich Accountancy, 19 Upper King Street, Norwich, NR3 1RB.

For anything about your information, or to use any of your rights below, email info@cheyneconstruction.co.uk.

What we hold

About you, if you use Cucumber or are a project contact

• Your name, email address, mobile number, job title and the company you work for (with its office number and address).
• The projects you're on, your role on them and which emails you get.
• Your settings: your colour, light or dark mode, how you like lists sorted, and favourite projects.
• Sign-in records: when you were invited, when you first and last signed in.

What you do in Cucumber

• The project records you create or are named in: RFIs and responses, instructions, actions and notes, procurement records, timesheets and forecasts, and the links to any files you attach. Files themselves are kept in Cheyne's Dropbox, not in Cucumber.
• Comments on actions, including who you tag with @, and the notifications that tells them about (shown in Cucumber's bell and sent by email).
• A history of changes: who created, edited, issued or closed something, and when.

Usage statistics

When you're signed in, Cucumber records:

• each page you open (its address, without any search or filters) and when;
• for each day, how many minutes you actively used Cucumber (the page was on screen and you'd used the mouse, keyboard or screen in the last five minutes), how many pages you opened, and the time of your first and last activity.

We use these to see which parts of Cucumber are used and how much, so we can improve it and check it's worth what it costs. Only Cheyne's Super Admins can see them. We don't use them to judge anyone's work or performance. They're deleted after 12 months. If you have concerns about them, contact us at info@cheyneconstruction.co.uk.

About people who don't sign in

• Site operatives: name, company or agency, trade, the company they've worked for over time, and the hours and tasks recorded on timesheets and forecasts. Cheyne's site staff record these; operatives don't have a Cucumber login.
• Contacts: people listed in a project directory without a login (name, company and contact details).

About companies

Company details, including information from the public Companies House register and, for some firms, a business credit check from Creditsafe (score, rating and credit limit). For most firms this is information about a company, not a person, but for sole traders and partnerships it may be personal information.

Why we use it, and our legal basis

• Running our projects (sharing information with the project team, recording RFIs, instructions and decisions, and keeping a record of who did what): our legitimate interests in running our business and projects properly, and where you or your company have a contract with us, to perform that contract.
• Timesheets and labour records: our legitimate interests in managing our sites and costs, and our legal obligations (for example health and safety, and tax and employment records).
• Signing you in and keeping Cucumber secure: our legitimate interests in protecting the information in it.
• Usage statistics: our legitimate interests in improving Cucumber and checking it's worthwhile, as described above.
• Credit checks: our legitimate interests in making sure the firms we work with are financially sound.

Where we rely on legitimate interests we've considered your interests and rights, and you can object (see Your rights). We don't sell your information, use it for advertising, or make decisions about you by automated means alone.

Emails

Cucumber emails you sign-in codes, invitations and project emails (for example when an RFI is issued or answered, or when someone tags you in a comment). Staff can turn off some project emails in their settings; sign-in codes and invitations are always sent.

Who we share it with

• Other people on your projects see what Cucumber shows them, depending on their role. For example, consultants and clients see the project's staff and other consultants, but not subcontractors, and outside firms never see internal notes or history.
• Our service providers, who handle information only on our instructions:
  • Supabase: stores Cucumber's database and sign-ins (in London).
  • Vercel: runs the Cucumber website (in London).
  • Resend: sends Cucumber's emails.
  • Dropbox: stores files attached to project records.
  • Creditsafe: provides business credit checks.
  • Companies House: the public register we look up company details from.
• Others when the law requires it, or to establish or defend legal claims (for example in a contract dispute).

International transfers

Cucumber's database and website are hosted in London. Some of our providers (Supabase, Vercel, Resend and Dropbox) are based in the United States and may access or process information there, for example for support or to send emails. Where that happens, the transfer is protected by the UK's approved safeguards, such as the UK International Data Transfer Addendum or the UK-US data bridge.

How long we keep it

• Project records (RFIs, instructions, actions, procurement, timesheets and their history): for as long as we need them for the project and for any claims that could arise afterwards. In construction that can be up to 12 years after a project finishes.
• Your account and contact details: while you're working with us. When you stop, your access is turned off and your sign-in is deleted. Your name stays on the project records you were part of.
• Usage statistics: 12 months, then deleted automatically.
• Notifications (in the bell): six months, then deleted automatically. Comments themselves are part of the project records.
• Sign-in sessions: 30 days from when you last used Cucumber on that device.

Cookies

Cucumber only uses cookies it needs to work. There are no advertising or tracking cookies, so we don't ask for consent.

• Sign-in cookies (set by Supabase): keep you signed in, for up to 30 days.
• cucumber-preview-role: used only when a Super Admin previews Cucumber as another role. Removed when they stop or sign out.
• dropbox_state: a security check while a Super Admin connects Cheyne's Dropbox. Deleted after 10 minutes.

Usage statistics don't use cookies. When staff attach files from Dropbox, Dropbox's own file picker loads from dropbox.com and Dropbox's privacy policy applies to it.

Keeping it secure

Cucumber is invitation-only, and you sign in with a code emailed to you, with no passwords to steal. Everything is sent encrypted. Each person only sees what their role allows, and that's checked on our server, not just on screen.

Your rights

You have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct anything that's wrong (you can also change your own name, mobile and job title in Cucumber);
• ask us to delete your information, or limit how we use it;
• object to how we use it where we rely on legitimate interests, including the usage statistics;
• ask for information you gave us in a format you can take elsewhere.

Some rights depend on the circumstances. For example, we may need to keep project records for legal reasons. To use any of them, email info@cheyneconstruction.co.uk. We'll reply within a month.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113.

Changes to this policy

If we change this policy we'll update the date above, and Cucumber will ask you to read and agree to it again the next time you use it.