Privacy Policy

The organisation you work for — your employer, or the company whose sites you record — is the data controller for the information you enter in Arrol Field. Arrol Ltd is the data processor: we hold and handle that information on your organisation's instructions, and provide the app and the portal.

The app asks for these permissions, and only uses them for what it says:

• Precise location (GPS) — to record the tracks you walk, the waypoints you drop, and where each photo, voice note or species sighting was taken. Location is recorded only while you are capturing.
• Camera and photos — to attach photos to a waypoint and to photograph a plant, fungus or insect for identification.
• Microphone — to record voice notes you choose to make.

Each permission is requested only for the purpose above, and only when you use the feature that needs it. The app does not access your contacts, calendar, health data or advertising identifier, and it reads no advertising ID (there is no ad or tracking software in the app — see below).

What you capture in the field is saved to your organisation's account:

• Field records — tracks, waypoints, voice-note text, species records, DBH survey plots and field reports — are stored in a managed PostgreSQL database (Supabase).
• Photos, voice recordings and species images are stored as files in Amazon Web Services S3, in the London (eu-west-2) region.
• Your account — you sign in with an email address and password (managed by Supabase Auth).
• The web portal is hosted on Vercel, which serves the pages; the field data itself lives in the stores above.

When you photograph a plant, fungus or insect to identify it, that single photo is sent to a specialist identification service (Plant.id, mushroom.id or insect.id, operated by Kindwise) which returns a suggested name. Only the photo is sent, and only for that identification. The suggestion and the photo are then stored with your record as described above.

Arrol Field and the web portal contain no advertising and no third-party analytics or tracking software. We do not build advertising profiles, and we do not sell your data. The only external service your captures reach is the species identification service above, and only when you ask for an identification.

Your captures belong to your organisation and are visible only within it — enforced in the database by per-organisation access rules. Arrol staff access your data only where needed to run and support the service, or where the law requires it.

When you delete a track, waypoint, note or record in the app, it is marked as deleted and removed from your views immediately. We keep your data while your organisation's account is active so your history stays intact.

Some records are kept because the law or good practice requires it: health-and-safety records — including site reports — are kept for at least three years. You can ask us to delete your data at any time (see your rights below), and we will do so except where we are required to retain a record.

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you (access);
• have inaccurate data corrected (rectification);
• ask us to delete your data (erasure);
• ask us to restrict or object to how we use it;
• ask for your data in a portable form (portability).

To exercise any of these, email enquiries@arrol.uk. Because your organisation is the data controller, we may pass your request to it, or ask you to raise it with it directly. We process your data as a processor on your organisation's documented instructions; your organisation's lawful basis is normally the performance of its contract with you and its legitimate interests in running forestry operations and meeting its health-and-safety obligations. If you are unhappy with how your data is handled you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Arrol Field is a professional tool and is not directed at children.

If we change how we handle your data we will update this page and the date at the top.

Questions about this policy or your data: enquiries@arrol.uk.