Privacy Policy

Last updated: 14 September 2026

This Privacy Policy explains how Boroto Ltd ("Maintivo", "we", "us") collects, uses and protects personal data when you use the Maintivo mobile app and this website (together, the "Service"). We are the data controller for the personal data described here and process data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Maintivo is a product of Boroto Ltd, a company registered in England & Wales (company number 15171190), registered office 10 Church Square, Leighton Buzzard, England, LU7 1AE. For any privacy question you can reach us at info@maintivo.com.

2. Data we collect

We collect the following categories of personal data:

• Account data, name, business name, email address, phone number and password when you create an account.
• Content you create, inspection reports, photos, meter readings, checklists, signatures, client and site details, invoices and any files you upload.
• Usage & device data, app and website interactions, device type, operating system, IP address and diagnostic logs. On the website, analytics and session-replay data is collected only after you accept the cookie banner.
• Communications, messages you send us via the contact form, email or support.
• Advertising & attribution data (iOS app), if you give permission through Apple's App Tracking Transparency prompt: your device's advertising identifier (IDFA), an anonymous advertising ID, app install and app-open events, and purchase/subscription events. This is used to measure the performance of our advertising, as described in section 6a. If you decline the prompt, this data is not used for tracking.

Some content you enter (for example your customers' names and contact details) is personal data about third parties. Where you enter such data, you are responsible for having a lawful basis to do so, and we process it on your behalf (see section 5).

3. How and why we use it

• To provide and operate the Service, creating reports, generating and sending branded PDFs, storing your records and enabling invoicing.
• To manage your account, subscription and free trial.
• To provide support and respond to your enquiries.
• To improve, secure and troubleshoot the Service.
• To send service and, where permitted, occasional product messages. You can opt out of marketing at any time.
• To measure and improve the performance of our advertising campaigns (iOS app, only with your tracking permission, see section 6a).
• To meet legal, tax and regulatory obligations.

4. Legal bases

We rely on the following legal bases under UK GDPR: performance of a contract (to deliver the Service you sign up for); legitimate interests (to secure, improve and support the Service, and for limited product communications); consent (for optional marketing and certain cookies); and legal obligation (for tax and compliance).

5. Controller and processor roles

For your own account data and our website, we act as a data controller. For the customer and site data you enter into your reports, we generally act as a data processor acting on your instructions, and you are the controller of that data. We only process it to provide the Service to you.

6. Sharing & sub-processors

We do not sell your personal data. We share it only with trusted service providers who help us run the Service, under contracts that require appropriate protection. These include cloud hosting and database providers, email delivery providers, subscription/billing providers, website analytics providers (Google Analytics, provided by Google, and Microsoft Clarity, provided by Microsoft, which produces heatmaps and anonymised session replays with sensitive content masked; both load only after you accept the cookie banner on our website, see our Cookie Policy), advertising measurement providers (Meta Platforms and RevenueCat, only with your tracking permission, see section 6a), and (only if you switch on the optional AI wording assistance described in section 7) Anthropic, PBC. Reports and invoices you generate are sent to the recipients you choose. We may also disclose data where required by law.

Where data is transferred outside the UK, we ensure appropriate safeguards (such as UK adequacy regulations or standard contractual clauses) are in place.

6a. Advertising & app tracking (iOS app)

Our iOS app uses the Meta (Facebook) SDK and RevenueCat to help us understand whether our advertising works. On first launch the app shows Apple's App Tracking Transparency prompt. Only if you tap "Allow" do we share your device's advertising identifier, app events (such as install and app open) and purchase/subscription events with Meta Platforms, so that installs and subscriptions can be attributed to the adverts that led to them. Meta processes this data in accordance with its own privacy policy.

If you tap "Ask App Not to Track", no advertising identifier is shared and no cross-app tracking takes place. You can change this choice at any time in iOS Settings → Privacy & Security → Tracking. This data is never used to decide anything about your reports, certificates or account, and declining has no effect on any feature of the Service.

7. Optional AI wording assistance

Maintivo includes an optional feature that can tidy up the wording of the free-text notes you type. It is off unless you turn it on, we ask you before it is used for the first time, and you can turn it off again at any time in Settings. Declining costs you nothing but that one feature.

Who processes it. If you turn it on, the text you choose to refine is sent to Anthropic, PBC (the provider of the Claude models), acting as our sub-processor, and processed on servers in the United States.

What is sent. Only the text in the single field you choose to refine.

What is never sent. Your customer's name, address and contact details; photographs; and your readings, measurements and pass/fail results. The feature is technically prevented from writing a measurement, a pass, a fail or a signature. It can only rewrite free text, and every suggestion is checked before you see it and rejected if it adds a number, drops a fault, or claims something you did not say. You always see what changed and nothing is used until you confirm it.

Legal basis. Your consent (UK GDPR Art. 6(1)(a)), which you may withdraw at any time in Settings without affecting the lawfulness of processing carried out before withdrawal.

Training. Your text is not used to train AI models.

International transfer. This transfer to the United States is covered by appropriate safeguards, including standard contractual clauses / the UK Addendum.

No automated decision-making. The feature only proposes wording. It makes no decision about you or your customers, and produces no legal or similarly significant effects.

8. Storage & retention

Data is stored in secure, UK-GDPR compliant cloud infrastructure. We keep personal data for as long as your account is active and as needed to provide the Service, then for any period required to meet legal, tax or accounting obligations, after which it is deleted or anonymised. You can request deletion of your account and associated data at any time (subject to legal retention requirements).

9. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. To exercise any right, email info@maintivo.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

We use technical and organisational measures to protect personal data, including encryption in transit, access controls and regular backups. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of any breach as required by law.

11. Contact

Questions about this policy or your data? Email info@maintivo.com. We may update this policy from time to time; the "last updated" date above shows the current version.