Privacy notice
Version 7 · Updated 25 September 2026
How Sandbox uses personal information when you use SAFE, take part in a project or contact us.
On this page
Who we are
Camelops Ltd, trading as Sandbox, provides SAFE. Our company number is 16888025 and our registered address is 86-90 Paul Street, London, EC2A 4NE.
We are the controller for personal information used to manage SAFE, accounts, service communications and our business records. This means we decide why and how that information is used.
Where we handle personal information solely on a customer’s instructions, the customer is the controller and we act as its processor. Contact the customer about that use, or contact us if you need help identifying the appropriate organisation.
Contact privacy@sandbox.land or write to our registered address about privacy or your rights. Our ICO registration number is ZC146595.
Information we use
Account and contact details
Your email address, name where supplied, sign-in activity and correspondence with us. An email address is needed to save a SAFE to an account and submit it.
You can prepare a SAFE before registering. We save unfinished work so you can return to it in the same browser.
Organisations and project members
Organisation names, membership and permissions. If a project member invites you, we receive your email address from them to send and manage the invitation.
Project information and files
Project names, answers, supporting documents, and information about existing assets or proposed works that you mark on the map.
This may include other people’s details in information you upload. Provide only information relevant to the project, and avoid sensitive personal information unless it is necessary and agreed with us.
Sites and locations
Addresses and places you search for, site boundaries, selected land parcels, marked locations and the surrounding area you ask us to assess.
Use my location asks your browser for permission to find your position. It moves the map; the position becomes project information only if you use it to define the site.
Assessments also use public and licensed sources, including planning records and land information. These can contain names, contact details and interests in land.
Submitted assessments
We keep the project brief, site boundary, marked assets and files submitted for each assessment, with the submitter’s details, date and revision. Later edits do not replace that submitted record.
Service messages include relevant account or project details. Internal submission notifications include a short project summary. We keep records of sending and delivery.
Early-access requests
Your work email address, requested project type and anything you choose to tell us about the project.
Technical and usage information
IP addresses, browser details, service requests and security signals used to deliver the service, prevent abuse and investigate faults.
Unless you turn analytics off, our usage measurement services receive browser identifiers, technical details and limited usage events, to measure how SAFE is used so we can improve it. One of these services, PostHog, also receives the addresses of the pages you view, which contain the reference of a SAFE, project or site, and which Topics and Evidence items you open in a SAFE. These identifiers can distinguish browsers; they are not anonymous merely because they are random. We do not use them to identify you.
Information on your device
The Cookies and storage page lists device storage, its duration and your choices.
Some project information is required for an assessment. SAFE identifies what is needed before submission; without it, we cannot prepare that assessment.
Why we use it
The table below explains why we use personal information and the legal basis for each use.
You use SAFE as a member of an organisation. We use your information to provide the service your organisation has requested and support the people working on its projects. The legal basis for this is legitimate interests.
Legitimate interests means using information for a reasonable business purpose, provided your rights and interests do not override it.
| Purpose and information | Lawful basis |
|---|---|
| Save work and provide an assessment Account, project and site information, files and submissions | Legitimate interests: providing the assessment your organisation has requested. |
| Assess relevant information about other people Personal information in project material, public records and licensed site information | Legitimate interests: understanding the site and preparing the requested assessment. |
| Manage access and collaboration Sign-in, contact details, membership and permissions | Legitimate interests: giving authorised members access to their organisation’s projects. |
| Send and manage project invitations The invited person’s email address and invitation details | Legitimate interests: helping project members work together. |
| Send service messages and answer enquiries Contact details, relevant project information and delivery records | Legitimate interests: supporting project members and keeping them informed about the service. |
| Respond to early-access requests Email, project type and supplied description | Legitimate interests: answering your request and letting you know when that project type is available. |
| Prevent abuse and diagnose faults Technical and security information | Legitimate interests: keeping SAFE secure and working properly. |
| Retain assessment and business records Submitted information, correspondence and relevant account records | Legitimate interests: keeping a record of our work and dealing with legal claims after the service ends. |
| Meet legal duties Information needed for the particular duty | Legal obligation: responding to rights requests and keeping records required by law. |
| Measure use and improve SAFE Limited usage events, page addresses and browser information | Legitimate interests: understanding how SAFE is used, including which parts of each SAFE are read, so we can improve it. Analytics is on unless you turn it off on the Cookies and storage page, and you can object at any time. |
| Remember display choices between visits Your chosen layout, map and area units | Legitimate interests: opening SAFE the way you left it. Remembering is on unless you turn it off on the Cookies and storage page. |
Where we use information solely on a customer’s instructions, the customer’s privacy information explains its legal basis.
Agreeing to the terms or confirming a submission is accurate changes nothing about analytics or remembered display choices.
On your first visit SAFE tells you that it measures use and remembers display choices, and lets you turn analytics off in one step. You can change either choice at any time on the Cookies and storage page.
Unfinished work
You can start a SAFE before signing in. When you sign in or create an account in the same browser, you can save that work to your organisation and return to it through your account. Saving your work does not submit it for assessment.
Clearing browser storage may prevent you from returning to unfinished work. It does not itself delete information already saved by Sandbox.
The retention table below explains the current position for unfinished work and its files.
Preparing your assessment
Authorised Sandbox staff use the submitted brief, site, marked assets and files to prepare your SAFE. They can review and download the submitted record for that purpose.
Assessment work can include automated analysis and AI-assisted interpretation of project information. The purpose is to assess the site and proposal, rather than to profile you. SAFE does not make decisions about you that have legal or similarly significant effects solely through automated processing.
Project information can be commercially confidential even when it is not personal information. Its permitted use is governed by your agreement with Sandbox and the terms of service.
Who can receive information
Project members can see information shared with that project. Their role determines whether they can edit it, submit an assessment or manage other members. Organisation administrators can manage access within their organisation.
Authorised staff and service providers receive information needed to operate SAFE, prepare assessments and respond to you. We use the following types of service:
| Type of service | Purpose |
|---|---|
| Secure service operation | Storing project information and files, managing accounts and delivering SAFE. |
| Email services | Sending account and submission messages, and handling correspondence with Sandbox. |
| Mapping services | Displaying and searching the map and the areas you view. |
| Security services | Checking for automated abuse and protecting SAFE. |
| Usage measurement | Understanding how SAFE is used, unless you turn analytics off. These providers act on our instructions and use the information only to help us improve SAFE. |
We may also disclose relevant information to professional advisers, regulators or public authorities where needed for advice, a legal obligation or a legal claim. We do not sell personal information or share it for advertising.
International transfers
SAFE’s main hosting and data storage are configured in Ireland. This does not mean all supplier access or processing takes place there.
Email, mapping, security and usage measurement services can process information outside the UK, including in the United States. Suppliers can also use support teams and service providers in other countries.
UK adequacy regulations cover transfers to Ireland. For other destinations, the relevant supplier terms describe contractual safeguards for UK transfers or, for eligible US recipients, the UK Extension to the Data Privacy Framework.
Contact privacy@sandbox.land for details of the countries and recipients relevant to your information and a copy of the relevant safeguards.
How long we keep information
| Information | Retention |
|---|---|
| Accounts, organisations and projects | While active. If your account closes or a project becomes inactive, up to 24 months, then deleted or anonymised. |
| Submitted assessments and related records | Six years from submission. |
| Unfinished work before registration | Our intended period is 30 days after the last change to unfinished work or a file upload. Older work and files can currently remain beyond this period because routine deletion has not started. You can ask us to delete them at privacy@sandbox.land. |
| Early-access requests | Up to 24 months after the most recent request, or 90 days after that project type becomes available and we have contacted you, whichever comes first |
| Technical request logs | Up to 30 days; longer only for a security incident or a legal claim. |
| Email content and delivery logs | The email delivery service retains email content and delivery logs for 30 days. Copies received in a mailbox and Sandbox’s own delivery records are separate. |
| Mapping service IP-address records | The mapping provider’s published policy describes a 30-day period for IP addresses, with exceptions for investigations. Other map information can have a different lifetime. |
| Analytics already collected | The usage measurement service’s retention settings govern user and event data separately from browser cookies. Turning analytics off does not delete earlier events or aggregate reports. Contact us about information already collected. |
Account, project and assessment deletion is handled separately from removing unfinished work. Shared projects and submitted assessments are not deleted simply because one member leaves.
Information may be retained for a legal obligation or a specific claim. Copies in email systems and backups have separate retention arrangements, so deleting live records does not remove every copy immediately.
Browser storage expiry, sign-in validity and server retention are different. For device storage and withdrawal controls, see Cookies and storage.
Your rights and choices
Your rights depend on the information and the basis for using it.
- Access. Ask for a copy of your personal information.
- Correction. Ask us to correct inaccurate or incomplete information.
- Erasure. Ask for deletion where there is no longer a lawful reason to keep the information.
- Restriction. Ask us to limit use of information in the circumstances provided by law.
- Portability. Receive information you provided in a reusable format where the right to portability applies, including where automated processing relies on your consent.
- Objection. Object to processing based on legitimate interests.
- Withdrawal. Withdraw consent at any time. This does not affect the lawfulness of earlier processing.
Object to a use of your information
Where we rely on legitimate interests, you can object at any time. We will stop that use unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need it for legal claims. For usage measurement and remembered display choices, turning the setting off on the Cookies and storage page is the objection, and we stop at once.
privacy@sandbox.land is the contact for objections and other rights requests. You can also write to our registered address. We may need to confirm your identity.
We normally respond to rights requests within one month. If the law permits an extension for a complex request or several requests, we will explain the reason within that month.
Turn analytics off or turn off remembered display choices. Where a customer controls the information, we will help direct your request to them.
Privacy complaints
If you are unhappy with how your personal information has been handled, email privacy@sandbox.land or write to our registered address. Explain what happened and the outcome you are seeking. You do not need to use a particular form.
We must acknowledge a data-protection complaint within 30 days, investigate it without undue delay and tell you the outcome. We may ask for information needed to understand the complaint and will keep you informed of progress.
This complaints process is separate from the response period for rights requests. You can also Complain to the ICO.
Changes to this notice
We update this notice when the way we use personal information changes. Its version and date appear at the top.
If we intend to use existing information for a materially different purpose, we will provide the required information before that use begins. We will not rely only on an updated page.