[Trust Center](https://complyonsite.com/trust) Data Handling ### Contents [Back to Trust Center](https://complyonsite.com/trust) # Data Handling > What happens to what you enter in ComplyOnSite: free tool sessions, workspace records, how long each is kept & how retention and deletion work. > Web page: https://complyonsite.com/legal/data-handling Last updated: 30 October 2026 ## 1. Free tools Most tools need no account. Full and Max reviews in RAMS Review, running Prepare on your own file, setting up a site in Site Register and copying a paper form need a ComplyOnSite account. Connecting Google Drive, OneDrive or SharePoint, where a tool offers it, uses your own Google or Microsoft account. What each tool does with what you enter: - **Site Diary.** Keeps your projects, days, signatures and photos in this browser on this device, so a reload or a closed tab does not lose them. Photos are downscaled on your device before they are kept. Signed out, nothing is sent to us, except a day work sheet you send for signature: it is locked in your browser before it is sent, our server holds only a copy it cannot read, and deletes it after 30 days. Signed in, your days, photos and issued PDFs are also kept in your ComplyOnSite account, in your workspace, so your other devices and your team can open them; our server stores them and does not read what they say, and anyone in your workspace can open them. A photo or PDF no longer used by anything you keep is deleted from the account 30 days later. Photo of my diary page, signed in, sends that photo to our server and on to Microsoft (Azure OpenAI) or OpenAI to read, and keeps the page with your day. Clearing your browser’s site data removes the copy on this device, not the account’s; deleting your account removes the account’s copy, with its photos and PDFs, and the copy in the browser you delete it from, not another device’s. If you save to Google Drive, your browser sends the PDF directly to Google, into a ComplyOnSite folder in your Drive. - **Site Register.** The site’s owner signs in to set up a site; its settings and every sign-in are kept in their ComplyOnSite account, in their workspace. People who scan the site’s QR code need no account: the name, company and trade they type, or for a visitor whom they came to see, are remembered on their own phone, and each sign-in or sign-out sends those, the time, a random id for the phone, a signature if the site asks for one, and, if the site asks and the person allows it, one location reading taken when they tap. The site’s owner, and anyone in the same workspace, can see them. The phone shows its own sign-ins for the day, and when the site marked the person out or cancelled one of them; nobody else’s. A sign-in sent later, after no signal, carries the phone’s own time, and one the site cannot take yet stays on the phone with the reason. A signature or location shows which phone sent it, not that the person was on site. A sign-in made with the QR code cannot be changed in the account, only cancelled, which keeps it crossed out. If the site’s owner sends a RAMS briefing, the page shows its words to anyone with the code, and a person who signs it sends their name, company and signature; those are kept with that briefing for the same time as sign-ins. The site’s owner can remove one person’s details. Their name, company, trade, signatures and locations then go from every sign-in of theirs on the site, their briefing signatures are deleted, and the times and the phone’s random id stay. A sign-in of theirs that reaches the site later is kept without them too. For that, the account keeps a code made from their name and company with a secret key, which does not show either. People ask the site’s owner to see or remove their sign-ins. Sign-ins are kept for the site’s chosen time (two years unless changed), then deleted, but only once the owner has exported them. Deleting the owner’s account deletes their sites, every sign-in and every briefing, and the sites’ QR codes stop working. The page a QR code opens runs Cloudflare’s bot check (Turnstile) as the person taps, so a crew sharing one mobile network is not mistaken for a script. Looking up the site’s address sends what the owner typed, through our server, to postcodes.io or an OpenStreetMap address search (Photon, or Geoapify); the map tiles come from OpenStreetMap or the map provider we use. If you save a day sheet to Google Drive, your browser sends the PDF directly to Google. - **Site Issues.** Keeps your projects’ issues, notes and photos in this browser on this device, the same store Site Diary uses. Photos are downscaled on your device before they are kept. Each new issue you log, signed in or not, sends its words, its photo when it has one, and the first line of each of the project’s open issues, its areas and the trades named on its issues to our server and on to OpenAI, to suggest who owns it, where it is and whether it is already logged. We keep a count of it, not what it says; OpenAI may keep it up to 30 days and doesn’t train on it. Signed out, nothing else is sent to us. Signed in, your issues, notes and photos are also kept in your ComplyOnSite account, in your workspace, so your other devices and your team can open them; our server stores them and does not read what they say, and anyone in your workspace can open them. A photo or PDF no longer used by anything you keep is deleted from the account 30 days later. Deleting your account deletes the account’s copy, with its photos, and the copy in the browser you delete it from. On another device, the copy stays until you clear that browser’s site data. The PDF and the email text are made in your browser. If you save to Google Drive, your browser sends the PDF directly to Google. - **Site Progress Report.** Keeps your projects’ progress reports and the sections you choose in this browser on this device, the same store Site Diary uses, and reads your diary days, site issues and photos there to fill a report when you ask. Signed out, nothing is sent to us. Signed in, your reports and the PDFs you send are also kept in your ComplyOnSite account, in your workspace, so your other devices and your team can open them; our server stores them and does not read what they say, and anyone in your workspace can open them. A photo or PDF no longer used by anything you keep is deleted from the account 30 days later. Deleting your account deletes the account’s copy, with its PDFs, and the copy in the browser you delete it from. On another device, the copy stays until you clear that browser’s site data. The PDF and the email text are made in your browser. If you save to Google Drive, your browser sends the PDF directly to Google. - **Construction site register template.** Builds the sheet and its PDF, Excel and Word files in your browser. Your design, with any logo you add, is kept in this browser on this device so it is there next time; the logo is resized on the device and never uploaded. Nothing you type is sent to us. Clearing your browser’s site data removes the design. - **Site register examples.** Shows fixed examples in your browser. Nothing you read here is saved. Get this blank opens the site register template, which keeps your design as it says on its page. - **RAMS Builder.** Builds your RAMS in your browser and saves your work in this browser on this device so you can come back to it. Signed in, your drafts and their photos are also kept on your account, so you can open them on another device; drafts made before you signed in stay on this device until you add them. Signed out, your answers are not sent to us unless you send a briefing to phones, and clearing your browser’s site data removes them. Photos are made smaller on your device, and their location data removed, before they are kept. If you save to Google Drive or OneDrive, your browser sends the PDF directly to Google or Microsoft, into a ComplyOnSite folder in your Drive or OneDrive. If you choose to brief a team on phones, you sign in and the RAMS’s words go to your account and to a Site Register site; anyone with that site’s code can read them. Names, companies and signatures of those who sign are kept in the site’s account and can be added to the RAMS, and follow that site’s rules below. - **Site diary template.** Builds the sheet and its PDF, Excel and Word files in your browser. Your design, with any logo you add, is kept in this browser on this device so it is there next time; the logo is resized on the device and never uploaded. Nothing you type is sent to us. Clearing your browser’s site data removes the design. - **Site diary examples.** Shows fixed examples in your browser. Nothing you read here is saved. Get this blank opens the site diary template, which keeps your design as it says on its page. - **COSHH assessment template.** Builds the form and its PDF, Excel and Word files in your browser. Your design, with any logo you add, is kept in this browser on this device so it is there next time; the logo is resized on the device and never uploaded. Nothing you type is sent to us. Clearing your browser’s site data removes the design. - **Permit to work template.** Builds the sheet and its PDF, Excel and Word files in your browser. Your design, with any logo you add, is kept in this browser on this device so it is there next time; the logo is resized on the device and never uploaded. Nothing you type is sent to us. Clearing your browser’s site data removes the design. - **RAMS template.** Builds the blank and its Word and PDF files in your browser. Your design, with any logo you add, is kept in this browser on this device so it is there next time; the logo is resized on the device and never uploaded. Nothing you type is sent to us. Clearing your browser’s site data removes the design. - **Snagging list template.** Builds the sheet and its PDF, Excel and Word files in your browser. Your design, with any logo you add, is kept in this browser on this device so it is there next time; the logo is resized on the device and never uploaded. Nothing you type is sent to us. Clearing your browser’s site data removes the design. - **COSHH assessment examples.** Shows fixed examples in your browser. Nothing you read here is saved. The blank opens in the COSHH template, and a form saved on this device stays as it is until you choose to save over it. - **Permit to work examples.** Shows fixed examples in your browser. Nothing you read here is saved. Get this blank opens the permit to work template, which keeps your design as it says on its page. - **RAMS Examples.** Shows fixed examples in your browser. Nothing you read here is saved. Use this opens the RAMS Builder with the example’s answers, and the builder keeps your work as it says on its page. - **Snag list examples.** Shows filled example lists and downloads them. Nothing you do on the page is kept. Use this opens the example’s rows in Site Issues, and they are saved only if you save them there. - **Inspection checklist template.** Builds the sheet and its PDF, Excel and Word files in your browser. Your design, with any logo you add, is kept in this browser on this device so it is there next time; the logo is resized on the device and never uploaded. Nothing you type is sent to us. Clearing your browser’s site data removes the design. - **Method statement template.** Builds the blank and its Word and PDF files in your browser. Your design, with any logo you add, is kept in this browser on this device so it is there next time; the logo is resized on the device and never uploaded. Nothing you type is sent to us. Clearing your browser’s site data removes the design. - **Method Statement Examples.** Shows fixed examples in your browser. Nothing you read here is saved. Use this opens the RAMS Builder with the example’s answers, and the builder keeps your work as it says on its page. - **Construction phase plan template.** Builds the blank and its Word and PDF files in your browser. Your design, with any logo you add, is kept in this browser on this device so it is there next time; the logo is resized on the device and never uploaded. Nothing you type is sent to us. Clearing your browser’s site data removes the design. - **Construction phase plan examples.** Shows fixed examples in your browser. Nothing you read here is saved. Get this blank opens the construction phase plan template, which keeps your design as it says on its page. - **EWC code finder.** Searches in your browser as you type. Your search and chosen codes go into the page address so you can share it; opening that address sends it to our server, which runs the same search to show the page. We keep nothing. - **Waste transfer note.** Builds the note and both signatures in your browser, and keeps your notes in this browser on this device, so a reload does not lose them. Signed in, your notes and each signed copy are also kept on your account, so you can open them on another device. If you ask someone to sign on their own phone, the note is locked in your browser before it is sent: our server holds only a copy it cannot read. It deletes that copy after 7 days. A signature is kept until your note collects it, for up to 12 months. A link from the EWC code finder puts only its waste codes in the page address; opening it sends those codes to our server to fill in the waste. A Companies House search sends the letters you type to our server and on to Companies House; the answers, with your search, are kept for a day so the same search is not asked twice. - **Waste transfer note template.** Builds the sheet and its PDF, Excel and Word files in your browser. Your design, with any logo you add, is kept in this browser on this device so it is there next time; the logo is resized on the device and never uploaded. Nothing you type is sent to us. Clearing your browser’s site data removes the design. - **Hazardous waste consignment note.** Builds the note and each signature in your browser, and keeps your notes in this browser on this device, so a reload does not lose them. Signed in, your notes and each signed copy are also kept on your account, so you can open them on another device. If you ask someone to sign on their own phone, the note is locked in your browser before it is sent: our server holds only a copy it cannot read. It deletes that copy after 30 days. A signature is kept until your note collects it, for up to 12 months. A link from the EWC code finder puts only its waste codes in the page address; opening it sends those codes to our server to fill in the waste. - **Prepare your Defra report.** Reads your export in your browser. The first file from a system goes to our server, which sends its column headings, a sample of rows and its repeated values on to an AI provider to learn the layout; the file is not kept. The layout is kept in your account, and later files from that system are read in your browser with no call. Your sites, reports and Defra’s answers are kept in your account so you can finish held loads and record tracking IDs on any device. Where sending to Defra is offered, the loads you send go from our server to Defra with your Defra API code, which is kept encrypted; a receipt Defra accepts stays with Defra. On Pro and Team, a masked copy of each file is kept to read similar files better, unless an admin turns it off. - **Defra Receipt of Waste spreadsheet checker.** Sends your spreadsheet to our server to check it. The result and any corrected workbook come straight back to you, and we keep no copy of the file, its contents or your results. Nothing is sent to Defra; uploading to Defra stays your step. - **HAVS calculator.** Works out the result in your browser and writes your tools and times into the page address, so the link reproduces the calculation. We keep nothing, but anyone you send the link to sees what is in it, and opening the link sends that address to our server to show the page. - **Noise exposure calculator.** Works out the result in your browser and writes your tasks, levels, times and hearing-protector ratings into the page address, so the link reproduces the calculation. We keep nothing, but anyone you send the link to sees what is in it, and opening the link sends that address to our server to show the page. - **First aid requirements calculator.** Works out the cover in your browser and writes your answers into the page address, so the link reproduces the result. We keep nothing, but anyone you send the link to sees what is in it, and opening the link sends that address to our server to show the page. Printing and sharing use your own device. - **RAMS review tool.** Reads your PDF in your browser and sends only the text of its pages to our server and on to Microsoft (Azure OpenAI) or OpenAI (Quick and Full review) or Anthropic (Max review), and at every level to OpenAI for a quick check that it is a RAMS and to merge repeated points; the file stays on your device. Signed in, reviews are kept in your account for 30 days (12 months on Pro and Team) until you delete them, then deleted from our servers within 24 hours, with any review form you downloaded; signed out, the result is deleted within 24 hours. Microsoft, OpenAI and Anthropic may keep the text up to 30 days and don’t train on it. We use de-identified information to run and improve the service. If you choose from Google Drive, OneDrive or SharePoint, your browser downloads the PDF directly from Google or Microsoft. - **Paper form to digital form.** Copying a form needs an account. The photos you choose are made smaller on your device, then sent to our server and on to OpenAI to read the form; we do not keep the photos. The copy, with any logo cut from your photo, is kept in your account for 30 days (12 months on Pro and Team) so you can fill it in again, until you delete it. OpenAI may keep the photos up to 30 days. Changes to the boxes, what you type, your signature and any photo you add stay in this browser on this device and go into the PDF made there; they are not sent to us. The sample needs no account and sends nothing. - **SDS to Excel converter.** Reads your safety data sheet in your browser. The PDF is not uploaded to ComplyOnSite and we never receive a copy. If you choose from Google Drive, OneDrive or SharePoint, your browser downloads only the PDF you pick, directly from Google or Microsoft. - **RCRA waste code finder.** Searches in your browser as you type. Your search and chosen codes go into the page address so you can share it; opening that address sends it to our server, which runs the same search to show the page. We keep nothing. - **California waste code finder.** Searches in your browser as you type. Your search and chosen codes go into the page address so you can share it; opening that address sends it to our server, which runs the same search to show the page. We keep nothing. - **Texas waste code finder.** Searches in your browser as you type. Your search and chosen codes go into the page address so you can share it; opening that address sends it to our server, which runs the same search to show the page. We keep nothing. - **Australian waste code finder.** Searches in your browser as you type. Your search and chosen codes go into the page address so you can share it; opening that address sends it to our server, which runs the same search to show the page. We keep nothing. - **Canadian waste code finder.** Searches in your browser as you type. Your search and chosen codes go into the page address so you can share it; opening that address sends it to our server, which runs the same search to show the page. We keep nothing. - **Asbestos waste shipment record.** Builds the form and each signature in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. If you ask someone to sign on their own phone, the form is locked in your browser before it is sent: our server holds only a copy it cannot read. It deletes that copy after 30 days. A signature is kept until your form collects it, for up to 12 months. - **Non hazardous waste manifest.** Builds the form and each signature in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. If you ask someone to sign on their own phone, the form is locked in your browser before it is sent: our server holds only a copy it cannot read. It deletes that copy after 30 days. A signature is kept until your form collects it, for up to 12 months. - **Hazardous waste manifest (EPA Form 8700-22): prepare it item by item.** Checks the details in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. Nothing is sent to the regulator; copying the details across stays your step. - **Solid waste origin and disposal form (NJ O&D form).** Builds the form and each signature in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. If you ask someone to sign on their own phone, the form is locked in your browser before it is sent: our server holds only a copy it cannot read. It deletes that copy after 30 days. A signature is kept until your form collects it, for up to 12 months. - **Part 360 waste tracking document for C&D debris (New York).** Builds the form and each signature in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. If you ask someone to sign on their own phone, the form is locked in your browser before it is sent: our server holds only a copy it cannot read. It deletes that copy after 30 days. A signature is kept until your form collects it, for up to 12 months. - **Waste Tracker EPA Victoria: the details for a waste record.** Checks the details in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. Nothing is sent to the regulator; copying the details across stays your step. - **Waste transport certificate QLD: the generator’s details for Part 1.** Checks the details in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. Nothing is sent to the regulator; copying the details across stays your step. - **Asbestos waste tracking NSW: the details for an IWTS movement.** Checks the details in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. Nothing is sent to the regulator; copying the details across stays your step. - **Waste transfer form Ireland: the details for your WTF.** Checks the details in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. Nothing is sent to the regulator; copying the details across stays your step. - **Waste transfer note Ireland: a waste docket for each load.** Builds the form and each signature in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. If you ask someone to sign on their own phone, the form is locked in your browser before it is sent: our server holds only a copy it cannot read. It deletes that copy after 30 days. A signature is kept until your form collects it, for up to 12 months. - **Begeleidingsbrief afvalstoffen: every box ready to copy.** Checks the details in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. Nothing is sent to the regulator; copying the details across stays your step. - **Special waste consignment note: the details for SEPA’s note.** Checks the details in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. Nothing is sent to the regulator; copying the details across stays your step. - **NIEA hazardous waste consignment note: the details to copy across.** Checks the details in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. Nothing is sent to the regulator; copying the details across stays your step. - **LPC-662 form: Illinois EPA source site certification for clean soil.** Builds the form and each signature in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. If you ask someone to sign on their own phone, the form is locked in your browser before it is sent: our server holds only a copy it cannot read. It deletes that copy after 30 days. A signature is kept until your form collects it, for up to 12 months. - **LPC-663 form: Illinois EPA uncontaminated soil certification by a PE or PG.** Builds the form and each signature in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. If you ask someone to sign on their own phone, the form is locked in your browser before it is sent: our server holds only a copy it cannot read. It deletes that copy after 30 days. A signature is kept until your form collects it, for up to 12 months. - **Illinois non hazardous special waste manifest: items 1 to 20, filled in.** Builds the form and each signature in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. If you ask someone to sign on their own phone, the form is locked in your browser before it is sent: our server holds only a copy it cannot read. It deletes that copy after 30 days. A signature is kept until your form collects it, for up to 12 months. - **Excess soil hauling record for Ontario loads under O. Reg. 406/19.** Builds the form and each signature in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. If you ask someone to sign on their own phone, the form is locked in your browser before it is sent: our server holds only a copy it cannot read. It deletes that copy after 30 days. A signature is kept until your form collects it, for up to 12 months. - **Ontario hazardous waste manifest: prepare it for the RPRA HWP Registry.** Checks the details in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. Nothing is sent to the regulator; copying the details across stays your step. - **Alberta waste manifest form: prepare Parts A and B before the load leaves.** Checks the details in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. Nothing is sent to the regulator; copying the details across stays your step. - **BC hazardous waste manifest: prepare Parts A and B box by box.** Checks the details in your browser, and keeps your copies in this browser on this device, so a reload does not lose them. Signed in, your copies and each signed copy are also kept on your account, so you can open them on another device. Nothing is sent to the regulator; copying the details across stays your step. The PDFs, Excel files and checked workbooks you download are ordinary files. Anyone you send them to can open them without an account. We keep no copy, except a RAMS Review form downloaded while signed in, which is kept with its review, and a PDF a site tool issues while you are signed in, which is kept in your account. Review what you have entered before you share a download. ## 2. Account data Saved reviews are kept for 30 days on Starter and 12 months on Pro and Team. Your sign-in, company details and logo, work details, Prepare’s layouts, sites, Defra API codes and reports, and your Site Diary, Site Issues, Site Progress Report and Site Register records with their photos and PDFs, stay until you delete your account; Site Register sign-ins can go sooner, as that tool’s entry above says. Kept copies of Prepare uploads and examples are deleted after 12 months at most, and 30 days after they are turned off. A receipt sent to Defra stays with Defra. We do not offer EU data residency. ## 3. Retention and deletion Apart from RAMS Review, Prepare, the waste notes, documents and RAMS Builder drafts you keep while signed in, the site tools when you are signed in (above), and a Companies House search on the waste transfer note (kept for a day with its answers), the tools keep nothing you enter on our side. A note or document sent for signing is held on our server only as a copy we cannot read, as each tool above says. RAMS Review keeps a record of each review (level, page count, timing, cost and how many points it found) without the document text, the review’s result (kept in your account for 30 days, or 12 months on Pro and Team, until you delete it, then deleted from our servers within 24 hours; without an account, deleted within 24 hours), and any rating or comment you send. Work saved by the RAMS builder stays in your browser until you clear this site’s data, apart from a briefing you send to phones, which is kept with that Site Register site. When you delete your account or ask us to delete your data, it is deleted from our servers within 24 hours, apart from the billing and other records the [privacy policy](https://complyonsite.com/legal/privacy) lists. We keep encrypted backups of the account database, and of the files kept in accounts (review forms, signed copies, photos and PDFs), for up to 400 days so we can recover from a failure. Data you delete stays in those backups until they expire, and we never use it from them; if we ever restore a backup, deleted accounts, with their photos and PDFs, and RAMS reviews are deleted again automatically. Work kept in your browser is listed in the [privacy policy](https://complyonsite.com/legal/privacy#browser-storage).