Privacy Policy for RAMS Assessor™

---

Last updated: 12 September 2026

1. WHO WE ARE AND WHAT THIS POLICY COVERS

RAMS Assessor™ is provided by Bullion Apps Ltd, United Kingdom. This policy explains how personal information is handled when you use the app, its online document and AI-review services, purchases, credits and related support.

Contact: contact@bullionapps.co.uk

Website: https://bullionapps.co.uk

Bullion Apps Ltd is responsible for personal information used to operate the service, manage purchases and credits, provide support, protect the service and meet our legal obligations.

Where you use the app for an employer, client or another organisation, that organisation may be the controller of personal information in its documents and assessments. Where we process that content solely on its instructions to provide the service, we act as its processor. This policy does not replace any applicable data-processing agreement or your organisation’s own privacy notice.

RAMS Assessor™ supports professional review of workplace-safety documents. AI output is an editable draft. A competent person must check the original documents, correct the draft and authorise the final assessment. AI does not provide safety approval.

2. INFORMATION YOU ENTER OR SELECT

Depending on the features you use, information handled by the app may include:

• Company and reviewer information: names, job titles, business contact details, addresses, company identifiers, logos and saved signature images.

• Projects and assessments: project references, titles, sites, clients, contractors, work descriptions, dates, document versions, hazards, controls, findings, observations, actions, comments, review outcomes and reviewer declarations.

• Source material: selected RAMS, risk assessments, method statements, job packs, supporting documents, Word/RTF files, PDFs and captured paper documents. An assessment may contain several selected source documents.

• Document contents: text, images, tables, quotations, page references, names, contact details, signatures, qualifications, training information and other personal information included in the material you select.

• App preferences: regional terminology, theme, branding and export settings.

• Support information: your name, email address, messages and any information or attachments you provide when contacting us.

Saved signatures are used to display the reviewer’s authorisation on documents. We do not use them for biometric identification or matching.

We receive this information from you, from documents selected by you or your organisation, and from your use of the service. We also receive the store and technical information described below.

3. LOCAL STORAGE AND DOCUMENT CAPTURE

The app stores working information on your device, including selected documents, captured pages, viewing copies, projects, drafts, completed assessments, registers, reviewer details, signatures, branding and preferences. It may also keep a local copy of a pending upload and its recovery status so an interrupted request can be resolved.

On Android, document capture uses Google’s ML Kit document scanner through Google Play services. Google states that the scanning process runs on the device and that ML Kit does not send the scanned input or resulting output to Google’s servers for processing. The scanner may download components or updates and send technical performance and usage metrics to Google. Google handles those metrics under its own privacy policy.

Google’s ML Kit privacy information: https://developers.google.com/ml-kit/terms

Google Privacy Policy: https://policies.google.com/privacy

Capturing a document and submitting it for online review are separate steps. If you later include the captured document in an AI review, its contents are transmitted as explained in section 4.

The app uses file selection, camera, document, photo, printing and sharing capabilities for the features you choose. Permissions and system controls vary by device and platform. You can manage available permissions through your device settings.

4. ONLINE DOCUMENT PROCESSING AND AI REVIEW

Some document functions require our online service. For example, a selected Word or RTF document is sent to the Bullion Apps backend to create a PDF viewing copy that preserves the document’s layout. This document-conversion step is separate from generating an AI draft.

When you agree to an AI review, the selected source documents and their contents, including any personal information, are sent to the Bullion Apps backend. Relevant document contents and review instructions are then processed using the OpenAI API to produce an editable assessment draft.

Information used for the review may include the project reference and title, document roles and metadata, extracted text, document images or pages, and the instructions needed to generate the requested assessment. Scanned documents may undergo text extraction or optical character recognition as part of document processing.

The resulting draft may contain personal information reproduced or inferred from the selected documents, including names, project details and quotations. AI output can be inaccurate or incomplete. Review the source material and correct the output before using, signing or sharing it.

You can cancel at the review confirmation screen. If you do not agree to online AI processing, the requested AI review cannot be provided. Cancelling a later AI review does not reverse a document-conversion request already completed.

5. SAVING, RECOVERY AND CREDITS

To help recover a completed draft after a lost connection or interrupted delivery, the service temporarily holds an encrypted copy of the draft for a recovery window of up to 24 hours.

This recovery copy may contain names, project details, findings and quotations. It does not contain the original uploaded files or their full extracted text as a separate recovery archive.

The working recovery copy is removed after the app confirms that it has saved the draft, or through expiry cleanup. If the service is offline when the recovery period expires, cleanup takes place when the service restarts. The 24-hour window is therefore a result-recovery limit, rather than a promise that every physical copy disappears at that exact moment.

One review credit is deducted only after the draft has been saved on your device and that save has been confirmed. Limited review identifiers, delivery status and payment records may remain after the draft is removed to reconcile credits and prevent repeat charges. These records are separate from the temporary recovery copy.

Hosting backups can retain copies for longer, as explained in section 8. They do not extend the in-app recovery window or provide a permanent cloud archive of your assessments.

6. PURCHASES, ENTITLEMENTS AND TECHNICAL INFORMATION

Google Play or Apple, as applicable, processes app purchases and in-app payments. We do not receive your full payment-card or bank-account details from those transactions.

We may receive and process product identifiers, signed ownership evidence, receipts or purchase tokens, transaction identifiers, purchase dates, purchase status, restoration information, refunds, entitlement identifiers, credit balances and credit history.

The service uses store-linked or installation identifiers to recognise valid ownership, maintain credits, restore entitlements, reconcile transactions and prevent duplicate purchase processing or repeated introductory credit awards. These identifiers are used for service operation and fraud prevention, not advertising profiles. Reinstalling the app does not by itself delete the server’s purchase or entitlement records.

Online requests may also generate technical records such as IP addresses, app and operating-system versions, platform information, request identifiers, timestamps, status codes, processing failures and security or rate-limit events. Such records help us operate, troubleshoot and protect the service.

7. WHY WE USE INFORMATION AND OUR LAWFUL BASES

We use information to provide document capture and viewing, organise projects and assessments, generate requested AI drafts, save and recover results, produce exports, administer purchases and credits, answer support requests, maintain reliability, prevent misuse and meet legal obligations.

Where UK or European data-protection law applies and we act as controller, our lawful bases are:

• Contract: information necessary to provide services you request under our agreement with you, including purchase administration and support.

• Legitimate interests: operating and securing our business services, supporting organisational customers, maintaining reliability, preventing fraud and duplicate charges, resolving disputes and protecting legal rights. We consider the effect on individuals and balance these interests against their rights.

• Legal obligation: information we must retain or disclose to meet applicable legal, tax, accounting or regulatory requirements.

• Consent: where consent is required for a particular optional use. You can withdraw that consent by contacting us or using the relevant controls. Withdrawal does not affect processing that was lawful before withdrawal.

Agreeing to submit an AI review authorises that request. It does not automatically establish a lawful basis for every individual whose information appears in an uploaded document.

Where an organisation controls the uploaded information, it is responsible for its lawful basis, notices and instructions. If documents contain special-category information, such as health information, the organisation must also identify an applicable additional condition before uploading it.

You choose the information you enter or select. Some information is necessary to provide a requested feature or verify a purchase; without it, that feature may not work. Avoid including personal information that is unnecessary for the task.

8. HOW LONG INFORMATION IS KEPT

Different copies and records have different purposes and retention periods.

On your device

Local documents, assessments, signatures, settings and other app records generally remain until you delete them using the app’s controls, clear app data or uninstall the app, subject to the operating system and backup arrangements. Exported files and copies saved outside the app must be deleted separately.

Temporary backend processing files

Our retention policy is to delete working copies of uploaded source documents, extracted content and temporary processing files held on the Bullion Apps backend within 24 hours after the processing request has completed successfully or permanently failed.

A longer period may be necessary to resolve a specific processing failure or interrupted request, provide support you have requested, investigate a security incident or suspected misuse, resolve a dispute or meet a legal obligation. Access is restricted and the information is retained only for as long as needed for that purpose. This working-file policy does not describe the retention of hosting backups or OpenAI’s separate records.

Encrypted recovery drafts

The result-recovery window is up to 24 hours. The working draft copy is removed following confirmation of a local save or expiry cleanup, including cleanup after a service restart if it was offline. See section 5.

Hosting backups

GoDaddy hosts the review service and its hosting backups. A server backup or snapshot may capture documents being processed, encrypted recovery drafts and operational records. Those backup copies can remain after the corresponding working files have been deleted.

Automatic backup retention follows the hosting provider’s schedule, currently described as seven days. On-demand snapshots and separately retained backups may last longer. Their retention depends on the need to restore the service safely, recover from a particular change or incident, or meet a legal requirement. Seven days is not a guaranteed maximum for every backup copy.

Backup copies are for disaster recovery. They do not extend the 24-hour result-recovery window or make expired assessments available for ordinary retrieval through the app. Contact us if you need information about backup retention or a deletion request affecting backup copies.

Review, credit and purchase records

Limited review identifiers and delivery or charging records may remain to prevent duplicate charges. Entitlement and credit records are retained for as long as needed to maintain valid ownership and balances, restore purchases and prevent repeat processing or fraud. Transaction, tax and accounting information may need to be retained for longer to meet legal requirements or resolve disputes. Deleting an assessment does not necessarily delete these separate records.

Operational logs and support

Our retention policy for routine operational and security logs is up to 30 days. Relevant records may be retained longer where necessary to investigate a specific failure, security incident, suspected fraud, support request or legal claim, or to meet a legal obligation. This routine-log period does not apply to the entitlement, credit and transaction records described above.

Support correspondence is retained as needed to resolve the request, maintain a record of the assistance provided and address related legal or business obligations.

OpenAI

OpenAI’s retention arrangements are separate and are explained in section 9.

9. OPENAI DATA HANDLING

Bullion Apps Ltd has not opted in to sharing RAMS Assessor™ API inputs and outputs for model training or improvement. OpenAI states that API data is not used to train its models by default unless the customer opts in.

OpenAI processes submitted content and outputs to provide the service and may retain content and related metadata in abuse-monitoring logs for up to 30 days under its standard arrangements. Longer retention may apply where required by law or reasonably necessary to protect its services or others from harm.

Disabling optional response storage does not remove these separate retention arrangements. Other necessary service storage, including temporary caching, may also apply under OpenAI’s documented controls. This service does not promise Zero Data Retention.

OpenAI’s current API data controls: https://developers.openai.com/api/docs/guides/your-data

10. WHO INFORMATION MAY BE SHARED WITH

Information may be disclosed or made available, where necessary for the relevant purpose, to:

• OpenAI, to process the requested AI review and operate its API service.

• GoDaddy and relevant hosting, infrastructure, security and support providers, to operate and protect the backend and its backups.

• Google and Apple, as applicable, for app distribution, ownership verification, payments, restoration, refunds and platform services. Google also receives the scanner metrics described in section 3.

• Email and other support-service providers when you contact us.

• Professional advisers, accountants, insurers and auditors where needed for legitimate business or legal purposes.

• Regulators, courts, law-enforcement bodies or other authorities where disclosure is required by law or otherwise legally justified.

• An appropriate successor or adviser involved in a business sale or restructuring, subject to applicable safeguards.

You may also choose to export, print or share documents through email, messaging, cloud storage or other applications. Those recipients and services handle the information under their own arrangements.

We do not sell personal information, display third-party advertising in RAMS Assessor™, or use uploaded documents for targeted advertising or cross-application behavioural tracking.

11. INTERNATIONAL PROCESSING

Bullion Apps Ltd is based in the United Kingdom. Service providers may process information in the UK, the European Economic Area, the United States or other countries in which they operate. The service does not promise that all information remains in the UK.

Where applicable law requires safeguards for an international transfer, we use an applicable lawful transfer mechanism, such as an adequacy decision or approved contractual safeguards, including standard contractual clauses with a UK Addendum or a UK International Data Transfer Agreement where required.

Contact contact@bullionapps.co.uk for information about the safeguards relevant to your information and how to obtain a copy.

12. SECURITY

We use technical and organisational measures designed to protect information, including HTTPS for online requests, restricted backend access, server-held service credentials, encrypted temporary recovery drafts, purchase verification and controls against misuse.

These measures do not mean that every local file or exported document is separately encrypted, or that the service is end-to-end encrypted. The backend and AI provider must process readable content to provide the requested review. No transmission or storage system is completely secure.

Protect your device with suitable access controls, keep software updated and take care when storing or sharing workplace documents, signatures and exports.

13. YOUR RESPONSIBILITIES WHEN HANDLING OTHER PEOPLE’S INFORMATION

Only select or upload documents you are authorised to use. Your organisation’s confidentiality, security, retention and data-protection requirements may also apply.

Remove or redact unnecessary personal information before submitting documents. Avoid unnecessary medical or other sensitive information. Do not submit classified, security-sensitive, legally privileged or similarly restricted material unless your organisation has confirmed that the service and contractual arrangements are suitable.

People whose information is included in an organisation’s documents should normally contact that organisation about its use of their information. We will assist with requests relating to our processing where appropriate.

14. YOUR RIGHTS AND HOW TO REQUEST DELETION

Depending on your location and the applicable law, you may have rights to access your personal information, correct it, request deletion, restrict its use, receive certain information in a portable form and withdraw consent where processing relies on consent. These rights are subject to applicable conditions and exceptions.

Your right to object

You may object to processing based on legitimate interests for reasons relating to your circumstances. Contact us and explain your request so we can consider it under the applicable law.

To make a privacy request, email contact@bullionapps.co.uk. We may ask for proportionate information to verify your identity and locate the relevant installation, transaction or support record. Do not send passwords, payment-card details or confidential workplace documents by ordinary email.

Use the app’s deletion controls for information stored locally. We may be unable to access or delete information held only on your device. Removing local records or uninstalling the app does not automatically erase backend entitlement records, hosting backups or information retained separately by service providers.

For information held by our online service, contact us. We will assess the request, explain any applicable retention requirement and respond within the timescale required by law. Where information remains in backups, it may not be immediately removable from an individual snapshot and is subject to the backup arrangements described above.

Files already exported, printed, emailed, shared or saved to a separate cloud service must be managed in those locations. We cannot recall copies held independently by other recipients.

15. COMPLAINTS

You can contact us about a concern at contact@bullionapps.co.uk.

You also have the right to complain to the relevant data-protection authority. In the UK, this is the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/.

If you are in the European Economic Area, you may contact the supervisory authority where you live, work or believe an infringement occurred. Elsewhere, contact your applicable privacy authority. Where local privacy laws provide additional rights, we will handle requests in accordance with those laws.

16. CHILDREN AND AUTOMATED DECISIONS

RAMS Assessor™ is a professional workplace application intended for adults who are authorised to handle and review the relevant documents. It is not directed at children. Users must be at least 18 or meet any higher minimum age required by applicable law.

The app uses automated processing to assist document review and administer service functions such as ownership verification and credits. AI findings are not a final decision about workplace safety or an individual. The assessment workflow requires a competent human reviewer to check the evidence and authorise the outcome; it is not intended to make solely automated decisions with legal or similarly significant effects on individuals.

17. CHANGES TO THIS POLICY

We may update this policy when features, providers, data handling or legal requirements change. The current version is published at https://bullionapps.co.uk/rams-assessor-privacy and shows its last-updated date.

Where required, we will give additional notice of material changes and obtain consent before a new use that requires it.

Email:

contact@bullionapps.co.uk

Website:

www.bullionapps.co.uk

Please include enough information to identify the relevant installation, purchase, transaction or support request.

Do not send confidential workplace-safety documents by ordinary email unless Bullion Apps Ltd has specifically requested them through an approved secure method.