Your files and your account

Privacy notice

Effective 29 September 2026

Who provides WasteSheet

Stephen Sunday, a sole trader trading as FroggyHub, provides WasteSheet and is the data controller for account, contact and website operations. WasteSheet and FroggyHub are product and trading names, not separate incorporated companies. Contact wastesheet@froggyhub.com about privacy or this service.

What we process

• Your name, email address, account and sign-in/session records, organisation membership and invitations.
• Files you upload, receipt facts, corrections, saved layouts and organisation lists, generated workbooks, attributed site confirmations and reporting outcomes you record.
• Operational logs and error reports needed to keep the service working, and optional cookieless website statistics described below.

Files may contain information about other people. Your organisation decides what to upload and who can access it. Only upload data you are authorised to use and share. We process those files to provide preparation and private organisation history.

If you separately choose a paid plan, Stripe processes payment and billing details. We keep the customer/subscription identifiers, billing status and site allocations needed to administer that plan. Payment card details are entered with the payment provider; we do not store card numbers.

Why we use it

We provide and secure accounts, prepare receipt workbooks, manage trial access and permissions, retain and retrieve your organisation's history, answer enquiries, diagnose failures and improve the service. Account details are necessary to provide authenticated access; source and receipt facts are necessary to prepare a workbook.

Our lawful bases are performance of a contract where the service is provided to you as an individual, legitimate interests in providing and securing a business service and answering business/team enquiries, and legal obligations where applicable. Your organisation remains responsible for its own processing of personal data and reporting records.

We do not ask for Government Gateway credentials, sell uploaded records or send source files to an external AI classification service. Deterministic checks help prepare a workbook; the operator reviews it, submits it and checks acceptance. They do not make legally significant decisions about people.

Access and service providers

Authorised organisation members can access records according to their role. Owners control invitations. We use service providers for app and database hosting, private object storage, transactional email, error reporting and, where a paid plan is separately chosen, payments. Configured providers include Railway for app hosting, Hetzner for database infrastructure, Cloudflare R2 for private object storage, Resend for account email, and GlitchTip for error reporting. Those providers process information as needed to operate the service. Uploads are not made public; sending a workbook to government is your separate action.

Infrastructure and support providers may process data outside the UK. Contact us for the current provider locations and applicable transfer arrangements. We do not claim that all processing takes place in the UK.

How long it is kept

Source files, corrections and exported workbooks are available in history for 90 days from the original source upload. Expired material is unavailable for download; the retention job deletes source/export objects and batch records. A current-list recheck does not extend the source's original expiry.

Account, organisation, reusable list/layout and service-administration records remain while needed to provide the service, manage the organisation or meet legal obligations. Backups follow the operational backup cycle and are used for recovery, not routine access to expired records. Contact us to request deletion or ask about a particular record.

Download and retain your reporting records yourself. WasteSheet's history is not a permanent statutory archive.

Cookies and optional statistics

Necessary sign-in/session cookies support the account you request. Optional Umami statistics count visits to the public website without analytics cookies. We exclude URL query strings and fragments, avoid tracking preparation/auth routes, and respect the browser's Do Not Track setting. We do not enable advertising tracking or session replays.

Optional statistics include the public page path, referring site domain and browser/device information. The statistics service receives connection information when processing requests. Account identifiers and form/file contents are not included in these statistics.

You can object to optional analytics using the control below. Its preference is saved only in this browser; changing or clearing browser storage resets it.

Your rights

Depending on the processing and applicable law, you can request access, correction, erasure, restriction and portability of your personal data. You can object to processing based on legitimate interests, including optional analytics. Write to wastesheet@froggyhub.com; we may need enough information to verify your identity and locate the relevant records.

You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. Please contact us about concerns so we can address them.

Changes

This notice describes the current early-access service. We will update it when processing changes and draw attention to material changes.