Privacy Notice

Who we are

Ask Dave is operated by David Heffernan, trading as Dave Heffernan Consultancy, registered in England and Wales.

David Heffernan is the data controller for any personal data processed through Ask Dave.

Contact: dave@daveheffernan.com

What Ask Dave is — and what it isn't

Ask Dave is a reflective wellbeing companion for construction workers, developed from 30 years of practice by Dave Heffernan using The SHIFT Code™ framework. It uses an AI language model to hold supportive conversations.

What data Ask Dave processes — and what it doesn't

3.1 Your conversation messages

When you send a message, the text of that message is transmitted securely to Anthropic (the provider of the Claude AI). Anthropic uses it solely to generate a response. The Site Journal does not store, log, or retain conversation content. We never see the content of what you write.

Anthropic may retain conversation data according to their own data retention policies. As of the date of this notice, Anthropic states that API inputs and outputs are not used to train their models and are retained for up to 30 days for abuse monitoring before deletion. See anthropic.com/privacy for their current policy.

3.2 Company code

If you enter a company code to access Ask Dave, that code is transmitted with each message so the correct company context can be set. It is used only during the session and is not stored in association with any conversation.

3.3 What we do not collect

• Your name, email address, or any directly identifying information
• The content of your conversation (this never touches our servers)
• Your device identifier, IP address, or location
• Images, audio, or video

Crisis detection and the wellbeing signal

4.1 How crisis detection works

Before your message is sent to the AI, it is checked locally against a list of terms associated with serious wellbeing concerns (such as references to self-harm or suicidal thoughts). This check happens automatically and is not a human review.

If a concern is detected, Ask Dave is instructed to share crisis support resources with you immediately, before any other response.

4.2 The anonymised crisis signal

When a concern is detected, an anonymised signal is logged in our database. This log contains:

• The company ID associated with the company code entered (if any)
• The date and time the signal occurred

The log contains no message content, no worker identity, and no information about what was said. It exists solely to allow us to understand the aggregate volume of wellbeing concerns across the platform over time.

The lawful basis for this processing is our legitimate interest in understanding and improving the safety of the platform (UK GDPR Article 6(1)(f)).

4.3 Optional welfare alert

Before starting a conversation, you may optionally consent to a welfare alert. If you tick the consent box and a concern is detected, a brief automated email is sent to your company's nominated welfare contact. This email states only:

• That Ask Dave detected a wellbeing concern during a session
• The date and time
• The company name

No conversation content is included. No worker identity is shared. The welfare contact is told only that someone at their company may need support.

If you do not tick the consent box, no welfare alert is sent under any circumstances. The consent box is unticked by default.

The lawful basis for processing where consent is given is your explicit consent (UK GDPR Article 6(1)(a)).

Third-party services

Service	Purpose	Data involved	Location
Anthropic anthropic.com/privacy	AI language model (Claude) that generates responses	Your conversation messages only	United States
Neon neon.tech/privacy	Database hosting for anonymised crisis signals	Company ID + timestamp (no message content)	United States (AWS us-east-1)
Netlify netlify.com/privacy	Platform hosting and serverless function execution	Standard server logs (IP, timestamp) — retained briefly per Netlify's policy	United States
Resend resend.com/legal/privacy-policy	Transactional email delivery for welfare alerts (only when consent given and concern detected)	Welfare officer's email address, company name, timestamp	United States

All transfers of data to the United States take place under the UK International Data Transfer Agreement (IDTA) framework or equivalent standard contractual clauses incorporated into each provider's data processing terms.

We do not sell data to any third party. We do not use conversation data for advertising, profiling, or any purpose beyond delivering the service.

Your rights under UK GDPR

You have the right to:

• Access — request a copy of any personal data we hold about you
• Erasure — request deletion of any personal data we hold
• Restriction — request that we limit how we use your data
• Objection — object to processing carried out on the basis of legitimate interest
• Portability — request your data in a portable format
• Withdraw consent — where processing is based on consent, you may withdraw it at any time

Note: because Ask Dave does not collect any identifying information from you, we may not be able to locate data relating to a specific individual without additional information from you.

To exercise any of these rights: dave@daveheffernan.com — we will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

How long data is retained

Data type	Retention
Conversation messages	Not retained by The Site Journal. Anthropic retains for up to 30 days per their policy.
Anonymised crisis signal (company ID + timestamp)	12 months, then deleted on a rolling basis
Welfare alert email (welfare officer's email address)	Not retained by us; subject to Resend's retention policy

Security

All data in transit between your device and our servers is encrypted using TLS. Conversation content is transmitted directly to Anthropic's API and does not pass through or touch any storage system controlled by The Site Journal. Database access is restricted by credential-based authentication and is not publicly accessible.

Changes to this notice

We may update this notice when the service changes. The effective date at the top will be updated when material changes are made. The version history below records what changed and when.

Version	Date	Summary of changes
2.0	1 October 2025	New notice covering Ask Dave: LLM processing via Anthropic, anonymised crisis signal logging, optional welfare alert system, third-party disclosures updated.
1.0	June 2025	Original Site Journal privacy policy (check-in platform only)

Contact

For any questions about this privacy notice, to exercise your data rights, or to raise a concern:

David Heffernan
Dave Heffernan Consultancy
dave@daveheffernan.com