TW PLUMBING & GAS
Staff privacy & device access
What the team portal records, who can see it and which device services it uses.
Version 1 · Updated 13 September 2026 · Applies to staff and contractors
How this policy was prepared
Prepared with ChatGPT, an OpenAI AI system, and checked against the portal’s code and access controls on 13 September 2026. Statements about app behaviour reflect that review; business responsibilities and limits are identified separately.
TW management remains responsible for the policy and keeping it accurate as the portal changes.
No GPS tracking
The portal does not request your device location.
You choose uploads
Camera scanning starts when you select it. Files are chosen by you.
Pay access is tagged
Colleagues’ payment details require Payroll access inside the app.
Why TW holds this information
TW Plumbing & Gas manages this portal to organise work, communicate with the team, record completed work, prepare payroll, identify contractors and keep accounts secure. Information comes from account details entered by administrators, entries and uploads made by staff, customer handover signatures and automatic service records.
This policy describes the portal’s current behaviour. It does not cover unrelated company systems, personal apps or a separate vehicle-tracking service.
Who can see what?
| Access | Information visible |
|---|---|
| Your account | You can see your own profile, assigned jobs, payroll submissions, receipts, pay statements, your own job opening status, optional tax details and approved payslips or self-billing invoices. |
| Everyone on the team | Names, profile pictures, bios, Staff/Administrator/Payroll tags, contractor numbers, team chat, message delivery/read receipts, online/last-active status and availability for the open planning weeks. The customer directory is shared for work. |
| Staff assigned to a job | That job’s customer details, notes, media, activity, commissioning records and signatures. Other staff cannot open an unassigned job through the portal. |
| Administrators | All ordinary job records, account names and sign-in emails, account status, account setup/reset controls, customer records and privacy tools. They can create accounts and grant tags to colleagues. For colleagues’ payroll they see submission status and submission time unless they also hold Payroll access. |
| Payroll-tagged staff | Everyone’s saved payroll drafts and submissions: days, rates, claims, reasons, receipts, notes and totals. They can view optional tax details, approve pay requests with deductions, reopen submissions and export payment reports. Approval records the reviewer’s name and time. Administrator status alone does not give this access; another administrator must change an existing account’s own Payroll tag. |
| Direct-message participants | Only the two participants can open their conversation in the app. Ordinary administrators have no inbox for reading other people’s direct messages. Team chat is visible to everyone. |
| Customers and QR-link holders | Anyone with a valid contractor verification link can see the saved ID headshot and contractor number. The page does not show your name, email, tags, pay or jobs. A job report shared with a customer can contain your work notes, media, sign-off name, profile image and timestamps. |
Check Team & chat to see current access tags. Your own payroll is always available to you. Do not put payment details into team chat, shared job notes or availability if you want them kept within the payroll area.
Device services and permissions
Location / GPS
Not requested by this portal. There is no live location map or journey tracking. The portal does not record your movements or check whether you enter or leave a particular area (sometimes called geofencing), including while it is in the background. A job address and a typed address search are not your device’s location. Opening directions passes the job address to Google Maps; Maps may use location under its own permissions.
Camera
The serial-barcode scanner asks to use your camera when you start it. Scanning happens on your device; the scanner does not upload a live camera feed. The serial text is added to the form and saved with the commissioning details. Stop the scanner or leave the section to end scanning. Manual serial entry remains available.
Photos, videos and files
Only files you select through the upload picker are submitted. TW cannot browse your whole photo library or other files through the portal. Your device may offer taking a new photo/video; recording a video can include sound under your device’s permissions. Uploaded evidence and receipts can keep metadata: extra information saved inside the file, such as when and where a photo was taken. A location saved in a photo describes that photo’s capture location. It does not give TW your live location or track where you go afterwards. The portal does not automatically strip this information from evidence and receipts. If you do not want to share a saved photo location, remove it in your photo-sharing options before uploading.
Microphone
The portal does not request a live microphone stream or provide background listening. Sound already included in a video you upload is part of that file and can be heard by people allowed to open it.
Contacts, calls and other apps
No access to your phone contacts, call history, SMS, WhatsApp, personal email, other apps, screen recording or browsing history outside this portal. Call/email links open your chosen phone or mail app; they do not give TW access to it.
Notifications and clipboard
The greeting, availability reminder and chat badges appear inside the portal. If you tap Enable notifications, your browser asks permission for system notifications about new messages and weekly submission reminders. You can turn them off for this device or all your devices in Settings, and in your phone settings. Team & chat shows setup controls while alerts are off. Message previews show the sender’s name and “Sent you a message.” Where supported, the icon shows their profile picture with a TW badge, or initials if no picture is set. Your phone may show these on its lock screen; the actual message text stays inside the app. iPhone web notifications may retain the TW app icon. Job assignment emails, Sunday availability reminders and Friday 4pm UK-time payroll reminders are sent to your account email. Availability and payroll emails also trigger a matching push to your enabled devices. Reminders do not include pay amounts, claims, customer details or other recipients’ addresses. The Copy setup link button writes the selected link to the clipboard when an administrator taps it; the portal does not read clipboard contents.
Activity, signatures and account security
While the portal is visible, it sends periodic presence updates so the team can see online/last-active status. When it is hidden or closed it attempts to send an offline update and stops regular presence updates. Status can lag if the connection drops. “Online” does not prove someone is working, and “last active” is not a timesheet or a location record.
“Online” means the portal has recently heard from an open, visible app page. “Last active” is the latest time it heard from that page, not the last time you used your phone. This feature does not record your screen, keystrokes or activity in other apps. It keeps a latest-active time and temporary connection records, rather than a page-by-page activity history. Work actions separately record names and times: notes, uploads, checklist sign-offs, customer edits and job changes. A profile picture may be saved with a sign-off; changing your current photo does not rewrite earlier signed records.
Passwords are stored as salted hashes, not readable passwords. Administrators can issue setup/reset links but cannot display your existing password. Disabling an account revokes its sessions. The hosting/security services receive technical request data such as IP address, browser information, request paths, times and errors. An IP address is the internet address used by your connection. It may suggest a broad area, but it is not a live GPS feed or a record of your movements. Sign-in protection also uses IP/account-based limits.
The portal does not automatically score staff performance or make employment or pay decisions. Payroll totals are calculations from the information submitted, not confirmation that payment has been made.
Contractor photos and verification
Your contractor ID uses a separate headshot, locked for 12 months after upload. Your editable profile picture is separate. The ID card displays your name, Plumber role, number and photo. Its animated silver shine and device-clock display show an active card view; they do not replace QR verification. A valid QR link publicly displays the headshot and number so a customer can compare them with the card presented; it is not facial recognition or proof of professional qualifications.
Disabling or deleting the account stops successful verification. Replacing an eligible ID photo changes the verification link, invalidating the old link. Someone may still retain a screenshot, downloaded report or previously saved card.
Services outside the portal
- Sites / OpenAI and Cloudflare: hosting, database, file storage, site administration and technical diagnostics. Staff use TW accounts; signing in does not give TW access to their personal ChatGPT conversations. Scheduled ChatGPT tasks read active team account names/emails to arrange Sunday availability and Friday payroll reminders. They do not read your submitted days, rates, claims or totals.
- Resend: sends assignment emails containing your name/email and limited job reference, category, schedule and portal link. Availability and payroll reminders contain your name, email, the relevant week and a portal link; they do not include your pay or customer details. A signed notice from Resend tells the portal when a tagged reminder email was sent so it can send the matching phone alert. Delivery status is recorded.
- Google Maps / Places: receives text sent for live address lookup. Directions, review and search links open Google services. Their separate permissions and privacy terms apply.
- Apple, Google, Mozilla or Microsoft notification services: deliver optional phone/browser alerts. TW stores the device’s push subscription and encryption keys, linked to your staff session. The provider processes delivery information; notification payloads are encrypted and contain the sender’s name for chat alerts, generic alert text and chat or submission-page routing references, not message text, pay amounts or customer details. A receiving device fetches the sender’s current profile picture using its staff session and renders the icon locally; this does not publish the picture or give administrators access to private chats.
- Boiler references: the fault finder uses stored reference material and links to manufacturer documents or searches. It does not send your payroll or private chat messages to an AI assistant as part of fault lookup.
- Apple Wallet: if company setup is enabled and you choose to add a card, the downloaded pass contains its ID information. Your device/Apple handles Wallet separately.
Hosting providers also handle service logs and backups under their own arrangements. A backup is a recovery copy of stored information. Ask TW management for the applicable provider terms, processing locations, transfer safeguards and retention information.
Message receipts and alerts
Sent means the portal saved a message. Delivered means a recipient’s app acknowledged receiving the message or phone notification; acceptance by a notification provider alone does not count as delivery. Read means the message was displayed in an open, visible chat. The sender can see recipient names and delivery/read times for their own messages, including team messages. These receipts start with messages sent after this feature was added; older messages are not given invented receipt times.
Logging out, an expired session, a password reset or a disabled account stops phone notifications for that session. Your device’s network connection, notification settings and Focus mode affect whether and when alerts appear. Receipt records stay with chat history. Chat push transport attempts are removed after seven days when that queue is next processed. Weekly reminder dispatch records contain the account reference, week, email reference and device delivery status, and are removed after 30 days when a reminder is processed; device subscriptions are removed on logout, deletion, opting out or when a provider reports that they have expired.
How long records remain
New job badges are personal to each assigned member and clear when they open the job. The portal records that opening time, not how long they spend reading. Assignment pushes say “New Job Assigned” and “Open the app to see details”, with no customer details. Opening an email or receiving a push does not mark a job opened. Assignment push transport attempts are cleared after seven days when the queue is next processed; the current opening record stays with the assignment and is removed when it is removed or the job or account is deleted.
Current and next-week availability is shown Monday to Friday. From Saturday, only next week is available to view or change. Expired weeks are cleared after Sunday; old entries are removed when availability is next loaded or saved. Temporary presence connections older than a day are cleaned up during presence updates; the latest-active value remains while the account exists.
Deleting an account removes its profile and current tax details, credentials, sessions, availability and contractor photo reference, and removes it from job assignments. Submitted payroll (including tax details snapshotted into approved documents), historical work sign-offs and chat messages can remain. Deleting an account is therefore not the same as erasing every record about that person.
Job records, submitted payroll and chats currently have no general automatic expiry in the portal. TW management must review them against its business/legal retention requirements and arrange deletion when no longer needed. Shared reports, receipts, downloads and provider backups need separate consideration.
Questions, corrections or a copy of your data
Contact Tom Walsh or a TW administrator through Team & chat, or through your usual TW contact if you cannot log in. Say that it is a staff privacy request and describe the information or concern. Avoid posting sensitive requests in team chat. For payment corrections, contact someone with the Payroll tag.
You can ask about use of your information, request access or correction, and ask for deletion, restriction or object where applicable. These rights have conditions; some records may need to be retained. TW should assess the request and explain its response. The Data compliance screen is for customer requests, not a staff self-service erasure tool.
Ask management for TW’s wider staff privacy information, including its lawful bases and retention schedule. If your concern is not resolved, you can contact the Information Commissioner’s Office.
This is an information policy, not a consent checkbox. TW should update it and tell staff before introducing new monitoring or materially changing access.