Terms and legal

These terms and conditions ("Terms") govern your access to and use of VariationFlow (the "Service"), operated by VariationFlow Ltd, a company registered in England and Wales (company number 17287903) ("we", "us", "our"). By creating an account or using the Service you agree to be bound by these Terms on behalf of yourself and the organisation you represent (the "Customer").

Where a subscription is purchased, acceptance of these Terms is also confirmed by ticking the acceptance box at checkout. The person ticking that box confirms that they are authorised to accept these Terms on behalf of the Customer.

If you do not agree to these Terms, you must not use the Service.

VariationFlow is a software-as-a-service platform for capturing, tracking, and managing construction variations, including mobile evidence capture, a variation register, workflow management, notifications, and reporting.

We may improve, modify, or add features to the Service at any time. We will not materially reduce the core functionality of your subscribed plan during a paid term.

From time to time we may make new or early-access features available on an optional basis. Such features are provided "as is" while so designated and may be modified or withdrawn without the notice periods that apply to core functionality.

You are responsible for maintaining the confidentiality of account credentials and for all activity under your organisation’s accounts, including users you invite (such as site operatives, quantity surveyors, and administrators).

You must ensure that the information you provide on sign-up is accurate and kept up to date, and that your use of the Service complies with applicable law.

All subscriptions are subject to a minimum commitment period of six (6) months from the date your paid subscription starts (the "Minimum Term").

Subscriptions are billed in advance at the rate of your selected plan, either monthly or — where you choose annual billing — annually, with the full 12-month fee payable upfront at the discounted annual rate shown at the point of purchase. After the Minimum Term, monthly subscriptions continue on a rolling monthly basis, and annual subscriptions renew for successive 12-month periods, until cancelled.

You may cancel at any time with effect from the end of the Minimum Term or, after the Minimum Term, the end of the current billing period (monthly or annual, as applicable). If you cancel a monthly subscription during the Minimum Term, the remaining monthly fees for the Minimum Term remain payable and are not refundable. Annual fees paid upfront are not refundable on cancellation, except as set out in section 11.

Plan upgrades take effect immediately, with any difference in price prorated by our payment provider. Downgrades take effect at the end of the current billing period and not before the end of the Minimum Term.

Optional add-ons — including additional user seats beyond your plan’s allowance where your plan offers them, and additional organisations beyond those your plan includes — are charged monthly in advance at the rates shown in the Service at the time you add them, and are prorated by our payment provider when added or removed part-way through a billing period. Add-ons may be removed at any time with effect from the next billing period and are not subject to their own Minimum Term.

The QA Flow quality module is included in the VariationFlow + QA Flow plan. Where it is offered as an optional add-on to another plan, it is priced at the rates shown in the Service and billed monthly in advance as a separate subscription alongside your plan. QA Flow requires an active VariationFlow subscription: if your subscription ends or is cancelled for any reason, QA Flow ends with it. The QA Flow add-on is not subject to its own Minimum Term and may be cancelled at any time with effect from the end of its current monthly period. The add-on price is fixed at the rate applicable when you purchase it; if you later change plan, the add-on continues at the purchased rate unless re-purchased at the new rate.

Free plan. We offer a Free plan with the limits published on our pricing page (at the date of these Terms, one project and two users, with the features listed for it there). No fees are payable for the Free plan and the Minimum Term does not apply to it. We may change its limits or withdraw it on at least 30 days’ notice, in which case you may export your data as described in section 11 or move to a paid plan. Every other section of these Terms applies to the Free plan in full.

Builder plan. The Builder plan is for domestic building work carried out for homeowners and other residential occupiers. It may be used only for projects of that kind, each with a contract value no higher than the limit published on our pricing page (at the date of these Terms, £100,000), and by no more than five users. It may not be used for subcontract or other commercial work. If the Service is used outside these limits on the Builder plan, we may ask you to move to a suitable plan and, if you do not do so within 30 days, restrict the projects concerned.

Prices shown in the Service and on our website are exclusive of VAT. UK VAT is added at the prevailing rate where applicable and is shown on your invoice. VariationFlow Ltd is registered for UK VAT, registration number GB 525532502, and invoices show VAT as a separate line. If you subscribed while our registration was being processed, we will reissue VAT invoices for that interim period on request. We may revise prices with at least 30 days’ notice; revised prices apply from your next renewal after the notice period and never during the Minimum Term.

Fees are payable in advance by the payment method on your account. If a payment fails or any sum is overdue, we may suspend access to the Service until it is paid (see section 6) and charge interest on overdue amounts as provided by the Late Payment of Commercial Debts (Interest) Act 1998.

You retain all rights to the data you submit to the Service, including variation records, photographs, documents, and project information ("Customer Data"). You grant us a licence to host, process, and display Customer Data solely to provide the Service.

You are responsible for ensuring you have the right to upload Customer Data, including any photographs taken on third-party sites.

You may export your data at any time using the tools in the Service, including a full account export in open machine-readable and human-readable formats, register CSV exports, and per-variation audit reports. On termination, the same exports remain available for 30 days, after which Customer Data may be permanently deleted.

Certain features send communications to third parties at your direction — for example emailing a priced variation to your main contractor for instruction, or emailing a valuation to your client. You authorise us to send such communications on your behalf and are responsible for the content you include and the recipient addresses you provide. Third-party responses recorded through those features (such as a contractor agreeing, querying, or declining an instruction via a review link) form part of your records in the Service.

QA Flow features capture quality and safety records at your direction: quality form steps and photographs, external sign-off decisions made by parties you nominate (such as a main contractor approving a hold point via an emailed link), RAMS documents you distribute, and RAMS signature records. Where a recipient signs a RAMS or approves a hold point through the Service, the recorded name, date, time, confirmation and (where requested) drawn signature together constitute that person’s electronic signature, and you agree such electronic signatures may be relied on to the same extent as handwritten ones. You are responsible for nominating the correct recipients and for the content of documents you distribute, and you must ensure you have a lawful basis for processing the personal data of the individuals you ask to sign.

Aggregated and anonymised data. We may create aggregated, anonymised or de-identified data derived from Customer Data and from use of the Service (for example, industry-level statistics such as typical times from variation submission to instruction, or average recovery rates by sector). Such data will never identify the Customer, the Customer’s clients or counterparties, any project, or any individual, and we will not publish any statistic drawn from a sample small enough for a customer or counterparty to be re-identified. We may use such data to operate and improve the Service, to develop new features, and to produce and publish industry benchmarks and research. You may opt your organisation out of inclusion in aggregated statistics at any time by emailing info@variationflow.com, and we will exclude Customer Data processed after the opt-out.

We process personal data in accordance with UK GDPR and the Data Protection Act 2018. We act as processor for personal data contained in Customer Data and as controller for account information. Further detail is set out in our Privacy Policy, and our current sub-processors are listed at variationflow.com/sub-processors.

You must not: use the Service for unlawful purposes; attempt to gain unauthorised access to other customers’ data; resell or sublicense the Service without our written agreement; introduce malicious code; or use the Service in any manner that degrades it for others.

We may suspend access immediately where we reasonably believe these Terms are being materially breached, and will tell you why as soon as practicable. We may also suspend access for non-payment of fees as set out in section 4.

We aim to keep the Service available 24/7 but do not guarantee uninterrupted availability. Planned maintenance will be notified in advance where practicable.

Support is provided by email on every plan, with the response targets for your plan set out in our Service Level Agreement.

Payments are processed by our payment provider (Stripe); we do not store your card details. Where you connect an optional third-party integration (such as Xero), you authorise us to exchange data with it on your instruction, and your use of that service is governed by its own terms — we are not responsible for third-party services. The VariationFlow mobile apps are distributed through the Apple App Store and Google Play, and the applicable store terms also apply to your use of the apps.

The Service, including all underlying software, source and object code, databases and database structures, algorithms, design, user interfaces, screens, text, graphics, logos, icons, images, audio, video, "look and feel", and documentation (together, the "VariationFlow Materials"), is owned by VariationFlow Ltd or its licensors and is protected by copyright, database rights, trade mark rights, and other intellectual property rights subsisting in the United Kingdom and worldwide. Copyright © VariationFlow Ltd. All rights reserved.

"VariationFlow", the VariationFlow logo, and our other product names, marks, and slogans are trade marks of VariationFlow Ltd. You may not use, reproduce, or register them — or any name, mark, or domain that is confusingly similar — without our prior written consent.

Subject to your compliance with these Terms and payment of the applicable fees, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, and revocable licence to access and use the Service for your organisation’s internal business purposes during the term of your subscription. No rights are granted to you other than as expressly set out in these Terms, whether by implication, estoppel, or otherwise, and we reserve all rights not expressly granted.

You must not, and must not permit or enable any third party to: copy, reproduce, republish, distribute, display, sell, rent, lease, sublicense, or otherwise make available any of the VariationFlow Materials; modify, adapt, translate, or create derivative works based on the Service; reverse engineer, decompile, or disassemble, or otherwise attempt to discover or derive the source code or underlying structure of, any part of the Service (save to the limited extent such a restriction is expressly prohibited by applicable law); remove, obscure, or alter any copyright, trade mark, or other proprietary notice; or access, scrape, frame, mirror, index, or use any automated means to extract data or content from the Service other than through functionality we provide for that purpose (such as data exports).

If you choose to provide feedback, suggestions, or ideas about the Service, you grant us a perpetual, irrevocable, worldwide, royalty-free, and fully sublicensable licence to use, incorporate, and exploit them in the Service and our business without restriction or any obligation to you. This section does not affect your ownership of Customer Data, which is dealt with in section 5.

The Service is a record-keeping and decision-support tool. It does not constitute, and must not be relied upon as, legal, contractual, adjudication, or professional quantity-surveying advice.

Any contract-clause references, statutory references (including the Housing Grants, Construction and Regeneration Act 1996), notice periods, deadlines, payment timelines, entitlement indications, valuations, and similar outputs are provided for general guidance only. They are based on standard, unamended contract forms (such as JCT and NEC4) and statutory defaults, and may not reflect your executed contract, its schedule of amendments, or any bespoke (Z) clauses. They are indicative only; you must verify them against your executed contract and take your own professional advice before acting or relying on them.

You remain solely responsible for complying with your construction contracts — including all NEC4 and JCT notice requirements, time bars, and timescales — and for every decision you take or do not take. To the fullest extent permitted by law, we accept no liability for any loss arising from reliance on the Service or its outputs as advice.

Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, fraud, or any other liability that cannot be excluded by law.

Subject to the above, our total aggregate liability arising out of or in connection with the Service in any 12-month period is limited to the fees paid by you in that period, and we are not liable for loss of profits, loss of contracts, or indirect or consequential loss.

As set out in section 9, the Service is decision-support only and does not constitute legal, contractual, or quantity-surveying advice; you remain responsible for compliance with your construction contracts, including NEC4 and JCT notice periods and timescales.

Either party may terminate immediately if the other commits a material breach which is not remedied within 30 days of written notice, or becomes insolvent.

On termination or expiry, your right to use the Service ends and any fees already accrued remain payable.

If we terminate for your uncured material breach, or you terminate for convenience, during the Minimum Term, the remaining monthly fees for the Minimum Term become immediately payable. This acceleration does not apply where you terminate because of our uncured material breach or our insolvency: in that case you owe only the fees accrued up to the date of termination, and we will refund any fees you have prepaid for the period after it.

We may update these Terms from time to time. We will give at least 30 days’ notice of material changes by email or in-app notice. Continued use of the Service after the notice period constitutes acceptance. If you do not accept the changes, you may terminate at the end of the Minimum Term or current billing period, whichever is later.

Neither party is liable for any failure or delay in performing its obligations (other than obligations to pay) to the extent caused by events beyond its reasonable control, including failures of utilities or telecommunications, acts of government, fire, flood, epidemic or pandemic, industrial action, or failures of third-party networks or infrastructure providers. The affected party will take reasonable steps to mitigate the effect, and if the event continues for more than 60 days either party may terminate on written notice.

These Terms constitute the entire agreement between the parties in relation to the Service and supersede any prior agreement or understanding. Nothing in these Terms excludes or limits liability for fraud or fraudulent misrepresentation. Failure to enforce a provision is not a waiver. If any provision is found unenforceable, the remainder continues in force. Neither party may assign these Terms without the other’s consent, except to an affiliate or in connection with a merger or sale.

These Terms are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

VariationFlow Ltd, a company registered in England and Wales (company number 17287903) ("we", "us", "our"), provides a software-as-a-service platform for capturing, tracking, and managing construction variations (the "Service").

For account information — the details you give us when you sign up and administer your subscription — we are the data controller. For personal data contained in the content your organisation uploads to the Service (such as names in variation records or people appearing in site photographs), we act as a data processor on behalf of your organisation, which is the controller.

We are committed to processing personal data in accordance with UK GDPR and the Data Protection Act 2018, and are registered with the UK Information Commissioner’s Office (ICO) as a data controller under registration reference ZC180231.

Account data: name, email address, organisation name, and role, collected when you create an account or are invited by your organisation.

Billing data: subscription plan and billing status. Payment card details are collected and processed directly by Stripe — we never see or store full card numbers.

Service content: variation records, project and customer details, photographs, documents, and notes uploaded by your organisation. Site photographs may incidentally capture individuals.

Precise location: when a variation is submitted from the mobile app, the app records the device's GPS coordinates to roughly a metre and attaches them to that record, so the evidence shows where the work was captured. The coordinates are stored against the person who submitted it. Location is captured only at the moment of submission — never in the background — and the field can be cleared or edited before saving.

Voice notes: recordings made in the mobile app are a recording of an identifiable person's voice and are stored as evidence alongside the variation.

Technical data: IP address, device and browser information, and usage logs generated when you use the Service, used for security and service operation.

Communications: emails you exchange with us, including support requests.

We process personal data on the following lawful bases:

Performance of a contract — providing the Service, managing accounts, processing subscriptions, and sending service emails such as instruction confirmations and ageing alerts.

Legitimate interests — securing the Service, preventing fraud and abuse, maintaining audit trails, improving the product, and communicating with business contacts, including contacting prospective business customers at business contact details their company has published on its own website. We balance these interests against your rights, and you can object to marketing at any time by emailing info@variationflow.com.

Legal obligation — keeping records required by tax, accounting, and other laws.

Consent — where required, for example optional marketing emails. You can withdraw consent at any time.

We do not sell personal data. We do not make decisions about you by automated means alone that produce legal or similarly significant effects — where the Service proposes something (for example dates read from an uploaded document, see section 10), a person checks and confirms it before it takes effect.

Aggregated statistics: we produce anonymised, aggregated statistics about use of the service and industry activity (for example, average timescales across projects). These statistics are engineered so that no individual, organisation, or project can be identified from them; once anonymised, they are no longer personal data. Organisations can opt out of inclusion by emailing info@variationflow.com.

We share personal data only with service providers (processors) who help us run the Service, under contracts that meet UK GDPR requirements:

Authentication — Clerk (account sign-in and user management).

Payments — Stripe (subscription billing).

Hosting and infrastructure — cloud hosting, database, and file-storage providers used to run the Service and store uploaded evidence.

Email delivery — our transactional email provider, for service notifications.

We may also disclose personal data where required by law, to enforce our terms, or as part of a business transfer (such as a merger or acquisition), in which case this policy continues to apply.

Within the Service, content your organisation uploads is visible to other users in your organisation according to their roles, and variation submissions may be emailed to the main contractor contacts your organisation specifies.

Some of our service providers process data outside the UK, including in the United States and the European Economic Area. Where personal data leaves the UK, we ensure an adequate level of protection through UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, as applicable.

EU representative (Art. 27 GDPR): VariationFlow does not currently offer the Service to customers in the EU, so no Article 27 representative is appointed. One will be appointed and named here before we open to EU customers.

Swiss representative (Art. 14 FADP): VariationFlow offers the Service to customers in Switzerland. Article 14 FADP requires a Swiss representative only where the processing is also large-scale, regular and high-risk, and all of those conditions must be met. Our processing of personal data of persons in Switzerland is not large-scale, so no representative is appointed. We will appoint one and name them here if and when that threshold is met.

We keep your content for as long as your subscription is active.

If you cancel, your content is deleted 30 days after the cancellation date. Nothing is deleted immediately: for those 30 days your account stays open on the Free plan and your administrators and directors keep full access to the account export, so you can take your records with you — these are contractual records you may need years later. We email you when you cancel, and again 7 days before the deletion date. Resubscribing at any point during the 30 days stops the deletion.

After that date your projects, variations, valuations, evidence photographs, voice notes, signatures and quality records are permanently deleted, including the underlying files in our storage. Deletion cannot be reversed.

We also delete your data sooner on written request from an administrator or director of your organisation, and confirm in writing when it is done. You can delete your own personal account at any time from the app.

Billing records are retained for 6 years to meet tax and accounting obligations, even after everything else has been deleted. We also retain the executed subscription agreement, including the signature given at onboarding, as the record of the contract between us.

We protect personal data with appropriate technical and organisational measures, including encryption in transit, encrypted storage, role-based access controls within the Service, and tenant isolation between organisations.

No system is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify the ICO and affected parties as required by UK GDPR.

Under UK GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; have data erased; restrict or object to processing; data portability; and withdraw consent where processing is based on consent.

To exercise any of these rights, contact us using the details below. We will respond within one month. We may need to verify your identity first.

Where we process data as a processor for your organisation, we may refer your request to your organisation as the controller.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would appreciate the chance to address your concerns first.

The Service uses strictly necessary cookies to keep you signed in and to secure your session (set by our authentication provider). These are essential for the Service to function and do not require consent under the Privacy and Electronic Communications Regulations (PECR).

With your consent, our public website also uses privacy-friendly analytics to understand how the site is used. You can accept or decline these when you first visit and change your choice at any time. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for full details.

We use AI in two specific, limited places. Neither is used to make a decision about a person automatically, and neither sends your data to be used for training an AI model.

Reading payment calendars (Google Gemini, United States). If an admin or director at your organisation switches this on in Settings → Organisation, your team can upload a payment calendar and have the dates read out of it. The complete PDF that is uploaded is sent to Google to be read — so whoever uploads it should redact anything they would rather not send. Nothing else in your account is sent. Every date the model proposes is shown for checking and must be confirmed by a person before it is saved. This feature is off unless your organisation turns it on, and every use is recorded (who, when, which file).

The assistant on our public website (Anthropic Claude, United States). Where the chat assistant is switched on, the messages you type into it and our replies are processed by Anthropic. It identifies itself as an AI, it has no access to any customer account or project data, and you never have to use it — every page offers a way to reach a person instead.

Automated bot detection (Vercel BotID). Our demo-request form uses an automated check on browser characteristics to block automated abuse. Very occasionally this can misjudge a real person; if a form will not submit, email info@variationflow.com and we will deal with it directly.

We keep a written record of where AI is used in the Service and review it whenever that changes. See our sub-processors page for where each provider processes data. If you would like more detail for a procurement or security review, email info@variationflow.com.

Evidence photographs uploaded by your organisation may incidentally include images of individuals on site. Your organisation is responsible, as controller, for ensuring it has a lawful basis to capture and upload such images, and for handling any requests from those individuals. We will assist with deletion requests passed to us by your organisation.

The Service is a business tool and is not intended for use by anyone under 18. We do not knowingly collect personal data from children.

We may update this policy from time to time. Material changes will be notified by email or in-app notice at least 30 days before they take effect. The "Last updated" date below shows the current version.

For any privacy question or to exercise your rights, email us at info@variationflow.com. We aim to respond to all privacy enquiries within one month.

Our Data Protection Officer, named on our ICO registration (reference ZC180231), can be contacted at info@variationflow.com.

You can also write to us at our registered office: VariationFlow Ltd, Scar Close Farm, Feizor, Austwick, Lancaster, LA2 8DF.

Cookies are small text files placed on your device when you visit a website. Similar technologies, such as browser local storage, work in much the same way. They are widely used to make websites work, to keep you signed in, and to understand how a site is used.

This policy explains which cookies and similar technologies VariationFlow uses and how you can control them. It should be read alongside our Privacy Policy.

These cookies are essential for the Service to function and cannot be switched off. They are set by our authentication provider to keep you signed in and to secure your session, and by our hosting platform to route requests and protect against abuse.

Because they are strictly necessary, they do not require your consent under the Privacy and Electronic Communications Regulations (PECR). Without them, parts of the Service would not work.

With your consent, our public website uses privacy-friendly analytics (Vercel Web Analytics and Speed Insights) to understand which pages are visited and how the site performs. We use this only in aggregate to improve the site.

These analytics do not load until you choose “Accept all” on the cookie banner. If you choose “Essential only”, they are not loaded. We do not use advertising or cross-site tracking cookies, and we do not sell your data.

When you first visit the site you can accept or decline non-essential analytics. You can change your mind at any time.

To revisit your choice now, change your cookie choice. You can also block or delete cookies through your browser settings, although blocking strictly necessary cookies may stop you from signing in.

We may update this Cookie Policy from time to time. The “Last updated” date below shows the current version. Material changes will be reflected here and, where appropriate, notified to you.

If you have any questions about our use of cookies, email us at info@variationflow.com.

This Data Processing Agreement (“DPA”) forms part of the agreement between VariationFlow Ltd (“VariationFlow”, “we”, “Processor”) and the customer organisation (“Customer”, “you”, “Controller”) for use of the VariationFlow service (the “Service”), as set out in our Terms & Conditions.

It governs the processing of personal data that we carry out on your behalf when you use the Service. Where you require a counter-signed copy for your records, contact info@variationflow.com.

Terms such as “personal data”, “processing”, “controller”, “processor” and “data subject” have the meanings given in UK GDPR and the Data Protection Act 2018 (together, “Data Protection Law”).

For personal data contained in the content you upload to the Service (for example, names recorded in variations, contractor contacts, and individuals incidentally captured in site photographs), you are the Controller and we are the Processor.

For account and billing data that we collect to provide and administer the Service, we act as Controller; that processing is described in our Privacy Policy and is outside the scope of this DPA.

Anonymised and aggregated data: the Customer instructs and authorises us to derive anonymised, aggregated statistics from Customer Data as described in the Terms. Anonymisation is performed so that the resulting data is no longer personal data under UK GDPR (it identifies no individual, customer, counterparty, or project). The anonymisation process itself is processing under the Customer’s documented instructions in this DPA; the resulting anonymised data falls outside this DPA, and we act as controller of it. The Customer may opt out of inclusion at any time as described in the Terms.

Subject matter: provision of the VariationFlow Service.

Duration: for the term of your subscription, plus the limited retention period in section 9.

Nature and purpose: hosting, storage, processing and transmission of your content so you can capture, track, value and recover construction variations, including sending notifications to recipients you specify.

Types of personal data: names, job titles, email addresses, telephone numbers, and any personal data contained in variation descriptions, notes, documents and photographs you upload.

Categories of data subjects: your personnel and users, your customers’ and main contractors’ personnel, and individuals who may appear in uploaded evidence.

We will: (a) process personal data only on your documented instructions, including the instructions given through your configuration and use of the Service, unless required to do otherwise by law (in which case we will inform you unless legally prohibited); (b) ensure that personnel authorised to process personal data are bound by confidentiality; (c) implement appropriate technical and organisational security measures (section 6); (d) assist you, taking into account the nature of processing, with data-subject requests and with your obligations on security, breach notification, and data protection impact assessments; and (e) make available information reasonably necessary to demonstrate compliance with Article 28.

You provide general authorisation for us to engage sub-processors to deliver the Service. Our current sub-processors are listed at /sub-processors. We impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance.

We will give you a reasonable means to be informed of any intended changes to our sub-processors so that you have the opportunity to object on reasonable data-protection grounds. If you object on such grounds and we cannot, within a reasonable time, offer a commercially reasonable alternative that addresses your concern, you may terminate the affected part of the Service, and we will refund any fees you have prepaid for that part beyond the date of termination.

Taking into account the state of the art and the risks of processing, we maintain appropriate technical and organisational measures, including encryption in transit, encryption of stored data, role-based access control, tenant isolation between customers, and an immutable audit trail. Further detail is on our Security page.

Where we or our sub-processors process personal data outside the United Kingdom, we ensure an adequate level of protection through UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, as applicable.

We will notify you without undue delay after becoming aware of a personal data breach affecting your personal data, and provide information reasonably available to us to help you meet your own notification obligations to the ICO and affected individuals.

On termination of the Service you may export your data in full, and that export remains available to your administrators and directors for 30 days after the subscription ends.

We delete your content 30 days after termination. This is automated: a scheduled job deletes the personal data and the underlying files, and we notify your administrators and directors when the subscription ends and again 7 days before the deletion date. We will delete sooner on written request, and confirm the deletion in writing.

We retain billing records for 6 years to meet tax and accounting obligations, and the executed subscription agreement as the record of the contract between us. Where your own compliance requires a different period, tell us and we will agree it in writing.

We will make available information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on reasonable prior notice, no more than once per year (unless required by a supervisory authority or following a breach), subject to confidentiality and to not compromising other customers’ security.

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms & Conditions. If there is a conflict between this DPA and the Terms on the processing of personal data, this DPA prevails.

Questions about this DPA, or requests for a signed copy, should be sent to info@variationflow.com.

This Service Level Agreement (SLA) describes the availability and support commitments for the VariationFlow service. It forms part of, and is governed by, our Terms & Conditions. Enterprise customers may agree a bespoke SLA in their order form, which takes precedence over this page where it differs.

We target monthly availability of 99.5% for the VariationFlow application, measured as the percentage of time the service responds to requests in a calendar month, excluding the planned maintenance and exclusions below. We target 99.9% for Enterprise customers.

Availability is measured at the application level. Because VariationFlow’s mobile capture works offline and syncs when a connection returns, brief interruptions generally do not stop site teams capturing variations.

Any service-level remedies for not meeting an availability target — including any service credits — are agreed individually with Enterprise customers in their order form or agreement. They are not offered as a standing entitlement under this page.

From time to time we carry out maintenance and deploy updates. We aim to perform disruptive maintenance outside UK business hours and, where it is likely to cause noticeable downtime, to give advance notice by email or in-app. Routine deployments are designed to be zero- or near-zero-downtime and are not counted against the availability target.

Support is provided by email at info@variationflow.com. Our response-time targets, during UK business hours (Monday–Friday, excluding public holidays), are:

Builder: response within two business days.

VariationFlow and VariationFlow + QA Flow: response within one business day.

Plans no longer sold: Starter and Growth, two business days; Professional, one business day; Enterprise, priority response, targeted within four business hours for issues that make the service substantially unusable.

Response time means our first substantive reply, not necessarily full resolution. We prioritise issues by impact, with service-down incidents handled first.

The availability target does not apply to unavailability caused by: factors outside our reasonable control (including failures of third-party networks, internet service providers, or the customer’s own equipment); planned maintenance notified in advance or emergency maintenance needed for security; suspension for non-payment or breach of the Terms; misuse of the service, or use not in accordance with our documentation; or force majeure events.

We take regular backups of the primary database as part of our managed infrastructure. Backups support service continuity and disaster recovery; they are not a substitute for your own records. You can export your variation register at any time, and on termination your data is retained for 30 days for export as described in our Privacy Policy.

During a significant incident we will keep affected customers informed by email and, where appropriate, in-app notice, with an estimate of impact and expected resolution. After a major incident we will provide a summary on request.

We may update this SLA from time to time. The “Last updated” date below shows the current version, and material changes will be notified in line with our Terms & Conditions.

VariationFlow holds commercially sensitive construction data — variation values, valuations, evidence and contract correspondence. We treat protecting it as core to the product, not an afterthought. This page summarises the technical and organisational measures we use. If you have a security question or need to report an issue, email info@variationflow.com.

All traffic to and from VariationFlow is encrypted in transit using TLS (HTTPS). Data and uploaded evidence are stored on infrastructure that encrypts data at rest.

Payment card details are handled entirely by Stripe, a PCI-DSS Level 1 certified payment provider. We never see or store full card numbers.

VariationFlow is multi-tenant: each organisation’s data is logically separated. Every request is authenticated and scoped to the signed-in user’s organisation, and every data query is filtered by that organisation so one customer can never see another’s records.

Authentication is provided by Clerk, with role-based access inside the application. Each of the roles has a defined permission set, and administrative functions — billing, team settings, subscriptions and user management — are restricted to leadership roles. Site operatives can capture variations and run quality forms, and cannot reach those settings.

Every variation carries a server-timestamped audit trail of status changes, value updates, evidence and payments. The event log is append-only — protected by database triggers that block retrospective edits and deletes — and each entry is linked into a SHA-256 hash chain, so any later insertion, deletion or change is detectable. Evidence files are hashed on upload. The exported audit document verifies the chain and states plainly whether it reconciled, giving you a strong evidential record for a dispute or adjudication.

VariationFlow runs on established cloud platforms with managed, regularly backed-up databases. We use reputable sub-processors for hosting, storage, authentication, payments and email — see our Sub-processors list for the current set.

Our availability targets and support response times are set out in our Service Level commitments.

All input is validated, database access uses parameterised queries, and output is escaped to prevent injection. The application sets standard security headers, restricts cross-origin access to our own web app, and rate-limits requests to reduce abuse. File uploads use short-lived, scoped, signed URLs so evidence cannot be accessed outside its variation.

We process personal data in line with UK GDPR and the Data Protection Act 2018. See our Privacy Policy for what we collect and why, and our Data Processing Agreement for the terms on which we process data on your behalf. Signed-in users can export their personal data and delete their account from within the app.

If you believe you have found a security vulnerability, please email info@variationflow.com with details. We welcome responsible disclosure and will acknowledge your report and keep you updated as we investigate. Please do not publicly disclose an issue before we have had a reasonable opportunity to address it.