Privacy notice
Last updated: 23 October 2026
How Same Basis Ltd (“Same Basis”, “we”) handles personal data when you use our website and the Same Basis service.
Who we are
Same Basis Ltd, registered in England & Wales, company no. 17209111; registered office 8 Clarendon Court, Carr Bank Lane, Sheffield, S11 7FN. ICO registration ZC245984.
- We are the controller for your account and how you use the service.
- We are a processor for the content customers put in their projects. For that content, the customer organisation is the controller and our contract with them applies.
Contact: hello@samebasis.com. Security issues: security@samebasis.com.
What we collect
- Account data: name, email address, organisation, sign-in method (email link or Google), and the projects and roles you have.
- Project content: projects, carbon data, comments, review decisions and uploaded documents (planning PDFs, drawings, spreadsheets). Documents can contain other people’s personal data, such as applicants’ or agents’ names.
- Invitations: the email address of the person invited and who invited them.
- Security and usage records: sign-in events including IP address, an audit trail of changes to projects and access, and AI feature usage for billing.
- Messages you send us.
We use no advertising or analytics trackers.
Why we use it
| Purpose | Lawful basis |
|---|---|
| Providing the service and your account; invitations and comment notifications | Contract (with you or your organisation) |
| Keeping the service secure: preventing misuse, audit trails, investigating incidents | Legitimate interests |
| AI features you choose to use | Contract; for other people’s data in documents, the customer’s lawful basis |
| Accounting and legal duties | Legal obligation |
AI features
When you use an AI feature, the documents or drawings you select and related project details are sent to OpenAI (reading documents) or Anthropic (measuring drawings, drafting opinions), in the United States. Under their business terms they do not train their models on this data and keep it for up to 30 days for abuse monitoring. AI results are suggestions for you to check.
Who processes it for us
These providers act on our instructions under data processing agreements. We do not sell personal data or share it for anyone’s marketing.
| Provider | Purpose | Location |
|---|---|---|
| Supabase (on Amazon Web Services) | Database, sign-in, file storage | Ireland |
| Vercel | Website and application hosting | Ireland, with a global network |
| OpenAI | AI document reading | USA |
| Anthropic | AI drawing measurement and opinions | USA |
| Resend | Sign-in, invitation and notification emails | Sent from Ireland; USA company |
| “Sign in with Google”, if you choose it; encrypted nightly backup copies of the database and uploaded files | Global (sign-in); London, UK (backups) |
When you view maps or look up a site, your browser contacts CARTO (map tiles), OpenStreetMap Nominatim (address search) and the British Geological Survey (geology) directly. They receive your IP address and the place you look up.
Where data goes outside the UK, we rely on the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. We tell customers in advance about new providers.
How long we keep it
| Data | Kept |
|---|---|
| Account data | While your account is active; deleted within 30 days of closure |
| Project content and documents | Until the project is deleted or the customer’s contract ends; removed from backups within 6 weeks |
| Unaccepted invitations | 90 days |
| Notification email records | 30 days |
| AI usage and billing records | 6 years |
| Security logs | As kept by our providers, longer if needed to investigate an incident |
What we store on your device
Only what the service needs: your sign-in session, a copy of the projects you open (so they work offline), rendered document pages, and display preferences. Signing out clears your project copies and rendered pages from that browser, unless changes have not synced yet. No advertising or tracking cookies.
Your rights
You can ask to access, correct, delete, restrict or object to our use of your personal data, and for a copy to take elsewhere. Email hello@samebasis.com; we reply within one month. Requests about content in a customer’s project may be passed to that customer. You can complain to the Information Commissioner’s Office (ico.org.uk).
Security
Encryption in transit and at rest, access rules enforced in the database, two-step sign-in for our staff, daily backups, and an information security management system run to ISO/IEC 27001.
Changes
When our processing changes, we update this notice and the date at the top.