Last updated: 19 October 2026
The data controller is Phil Yarrow Consulting Ltd, trading as Tree Atlas (company number 06268045, registered office 3 Springdale Close, Hardwicke, Gloucester, England, GL2 4JD), ICO registration 00015296613. For any privacy request, contact support@treeatlas.app. This policy is written to meet the UK GDPR and the Data Protection Act 2018.
| Data | Why we hold it | Lawful basis |
|---|---|---|
| Account details (name, email, consultancy, role) | Create and run your account | Contract |
| Survey content (trees, measurements, notes, photos, audio, location) | The core service — recording and reporting surveys | Contract |
| Billing details (via Stripe) | Take and manage subscription payments | Contract / legal obligation |
| Tree photos sent for AI species suggestions | Suggest a likely species — only if you agree in the app | Consent |
| Voice notes sent for AI transcription | Turn a recorded voice note into text as part of the survey service your consultancy uses. On unless you switch it off | Contract (providing the service); legitimate interests (quicker, searchable survey notes) |
| Audit log (sign-in, evidence access, report download) | Security and accountability | Legitimate interests |
| Basic technical/usage data | Keep the service secure and working | Legitimate interests |
We do not sell your data, and we do not use your survey content to train third-party AI models. Google does not use what we send through the paid Gemini API to train or improve its models.
We use the following processors to deliver Tree Atlas. Each processes data only on our instructions under a data-processing agreement.
| Processor | Purpose | Region / transfer basis |
|---|---|---|
| Supabase | Application database, authentication and file storage | EU (Ireland) |
| Cloudflare | Hosting, content delivery and security | Global CDN; UK/EU adequacy + SCCs |
| Stripe | Subscription payments and invoicing | US; UK IDTA / SCCs |
| RevenueCat | Subscription management for in-app purchases in the iOS app. Receives an app user ID (your consultancy's ID) and purchase/transaction data from the App Store | US; UK IDTA / SCCs |
| Apple (App Store) | Takes payment for subscriptions bought in the iOS app; Apple handles your payment details under its own privacy policy | Apple's own terms |
| Google (Gemini API) | AI assistance: tree-species suggestions from photos, and transcription of voice notes | US; UK IDTA / SCCs |
| Ordnance Survey | Map and parcel/boundary lookups from coordinates | UK |
| OpenStreetMap Foundation (Nominatim) | Address text from coordinates | EU |
| Resend | Transactional and trial-reminder emails | US; UK IDTA / SCCs |
| Google (Firebase Cloud Messaging) | Delivers push notifications to your phone or tablet. Receives a device token and the notification text, never tree details | US; UK IDTA / SCCs |
| Functional Software, Inc. (Sentry) | Error and performance monitoring for the app and the web desk. Receives your user ID, your device and operating system model, and crash reports with survey details, email addresses and locations removed | EU (Frankfurt) |
| Apple (WeatherKit) | Weather conditions for a survey when you tap Fill from weather. Receives the site's location and the survey date and time | Apple's own terms |
Tree photos are sent to Google's Gemini API only to suggest a species, and only after you have agreed to it in the app: the first time a photo would be sent, Tree Atlas asks for your permission, and nothing is sent unless you say yes. Photos can show people or vehicle number plates and may carry location data, so please bear that in mind. Voice notes are sent to the Gemini API only to transcribe them. Transcription is part of the service and is on unless you change it: the first time you record a voice note, Tree Atlas tells you this, and you can switch it off, or have the app ask before each note, at any time in Me › AI suggestions › Voice notes. When it is off, nothing you record is sent. Recordings can capture other people's voices, so please avoid recording anyone who has not agreed. You can turn AI suggestions off at any time in Me, and you can always identify a tree manually. Coordinates are sent to Ordnance Survey and Nominatim only to look up a location, and to Apple only to fetch the weather.
We keep your survey data for as long as your consultancy has an account with us. If your subscription ends, your data is retained in read-only form for 12 months, after which it is permanently deleted (survey rows and the associated photo and audio files). Re-subscribing within that window restores full access. Audit-log entries follow their own retention (24 months by default). Billing records are kept as required by law (typically 6 years).
Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it (right to erasure), restrict or object to processing, or provide it in a portable format. To exercise any of these, email support@treeatlas.app; we respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).
Data is encrypted in transit and at rest. Access is isolated per consultancy and enforced at the database level, so one consultancy cannot see another's data. We restrict internal access to what is needed to run and support the service.
We may update this policy. If a change materially affects how we use your data we will give reasonable notice.