Privacy Policy

Silo — app.silo.day Last updated: 8 August 2026

1. Who we are

Silo is operated by Colson Studio Ltd, a company incorporated in England and Wales (company number 16538540), registered office at C/O Goodier Smith & Watts, Devonshire House, Borehamwood, Hertfordshire, England, WD6 1QQ ("Colson Studio," "we," "us").

For any privacy question, request, or complaint: [email protected]

We are the data controller for the account and billing information you give us directly. For job data you create in Silo — client names, call-sheet contents, schedules, day rates — you are the data controller, and Colson Studio acts as your data processor. See our Data Processing Agreement for the detail of that relationship.

2. What we collect

Account data: name, email, password hash, billing details (handled by our payment provider — we do not store card numbers).

Job data you create or import:

• Booking details, kit checklists, expense entries
• Call-sheet content ingested via your personal inbound email address, including client names, locations, contact numbers, and schedules
• Calendar data read (never written) from any Google, Outlook, or Apple/webcal calendar you connect
• Day rates and other figures used for invoice and overtime calculation

Connection data: OAuth tokens for any third-party account you connect (Google, Microsoft, Dropbox, Xero, FreeAgent), stored encrypted at rest. We never see or store your passwords for these services.

Technical data: IP address, browser/device information, and error logs, collected automatically for security and to keep the service running.

3. How we use it, and why we're allowed to

We do not use your job data to train any LLM or other machine-learning model, ours or anyone else's. Colson Studio also operates as a freelance camera business, so to be explicit: we never use platform data for our own freelance work, rate-setting, or client acquisition, and we never produce cross-user analyses of rates, clients, or bookings (this is also committed in the Data Processing Agreement).

4. Who we share it with

We keep this list short by design, because most of the third parties in Silo's workflow are your own accounts, not ours:

• Google Drive, Microsoft OneDrive, Dropbox — when you connect one of these, call sheets are stored in your own account under it, not on our servers. We never gain broader access than the specific files Silo itself creates there (drive.file / Files.ReadWrite app-file scopes only — we cannot see the rest of your drive).
• Xero, FreeAgent — invoices are generated and pushed into your own connected accounting organisation (you connect one at a time). We do not retain a copy as our system of record; your accounting provider is.
• Google Calendar, Outlook, Apple/webcal — read-only. We never write, edit, or delete anything in your calendar.

The following are our sub-processors — companies we contract with directly, who may process data on our behalf:

Where a sub-processor is located outside the UK, we rely on the appropriate transfer safeguard (Cloudflare's, Google's, Meta's, Resend's, Sentry's, Stripe's, and Apple's standard contractual terms, as updated to reflect the UK's current international transfer framework). We'll update this table if that list changes, and you can ask us for the current version at any time.

Usage analytics is self-hosted, so it's not on the list above. We measure aggregate, cookieless usage of app.silo.day and www.silo.day with Plausible, which we run on our own server (stats.silo.day) rather than sending your visits to an analytics company. No cookies are set, no cross-site or persistent identifier is used, and no profile of you is built — Plausible counts pages and visits without identifying individuals. Because the data never leaves our own infrastructure, there's no third-party analytics processor to name here.

We never sell your data, and we don't share it for advertising purposes.

5. LLM features

Google's Gemini API powers the features below. Each one sends only what that task needs, from our servers, at the moment it runs:

• Call-sheet extraction — the text (or page images) of a call sheet or movement order you forward or upload, to pull out dates, times, locations and notes.
• Filing call sheets to jobs — a call sheet's extracted details, its email subject and filename, and the job number, title, client name, client reference, dates and status of your nearby jobs, to work out which job it belongs to.
• Receipt and serial-photo reading — the photo you upload, or for a PDF receipt or invoice, its extracted text (or, where that text isn't usable, images of its pages).
• WhatsApp — the text of a job or expense you send to Silo's WhatsApp number; any photo you send, to tell a receipt from a photographed call sheet (and then read it as one or the other); and a document's caption and extracted text, to tell a receipt from paperwork.
• Calendar sync — a connected calendar event's title, location and dates, your existing client names, and the title, client name, dates and status of your other jobs, to separate the client from the job name and to match events to the jobs they belong to.
• Accounting — when an invoice is drafted, the client's name and the names of candidate contacts in your connected Xero or FreeAgent organisation, so a near-miss like "Acme Ltd" vs "Acme Productions Ltd" doesn't create a duplicate contact. If you run an invoice-history import, the line items (descriptions, quantities and amounts) of your past invoices to that client, along with the names of the kit items already in your library, to suggest kit items and your usual day rate.
• Smaller helpers — an expense description (to suggest a category), and the column headers plus the first few rows of a CSV you import (to map its columns).

Two things worth knowing:

• No LLM credentials ever reach your browser — the LLM runs entirely on our servers.
• We use Gemini under Google's Paid Services terms, not the free tier — per Google's Gemini API Additional Terms of Service, this means Google does not use your prompts or responses to improve or train its models (unlike Google's unpaid/free tier, where it can). This is Google's policy commitment as our processor, not something we can independently audit.

Google API Services User Data Policy — Limited Use. Silo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely, the only Google Workspace data any AI/LLM ever processes is: (a) a Google Calendar event you have connected — its title, location and dates — used solely to help create or update the matching job in Silo; and (b) if you have chosen Google Drive as Silo's storage, the call sheets and kit serial photos Silo itself saved to your Drive (the only files its drive.file access can reach), read back so Gemini can pull out the job details or serial number for you. That data — raw or derived — is used only to provide and improve those user-facing features; is never transferred to anyone except as needed to provide the feature (Google's Gemini API, acting as our processor) or where required for security or law; is never sold; is never used for advertising; and is never used to develop, improve, or train generalised AI/ML models. Silo requests only read-only calendar access (calendar.readonly) and per-file Drive access (drive.file, which limits Silo to files it creates itself) — it never requests broad Drive access or the ability to write to your calendar.

6. How long we keep it

Silo is a working tool, not your system of financial record. Once an invoice is raised, your own connected Xero or FreeAgent organisation holds the authoritative copy — Silo doesn't need to, and doesn't, retain it as a record of account.

When you delete a job, expense, or your whole account, that data is marked for deletion and held for a short recovery window of 30 days purely to protect against accidental taps — during that window it isn't visible to you and isn't used for anything, it's just recoverable if you contact [email protected] quickly. After the window closes, it is permanently and irreversibly deleted, including from our backups within 30 days as the backup cycle rolls over.

This means: no indefinite retention, no "soft delete" as a permanent state, and no copy kept by us once both the recovery window and backup cycle have passed.

7. Security

• Every database query is automatically scoped to your account by construction — requesting another user's data returns a not-found response, not an access-denied one, so no information about other accounts' existence leaks.
• Third-party tokens (Google, Microsoft, Dropbox, Xero, FreeAgent) are encrypted at rest. A stolen database backup does not yield usable credentials.
• Day rates, invoicing figures, and client names are encrypted at rest in the database — the same protection third-party tokens get, above. This is not end-to-end/zero-knowledge encryption, though: the running application still holds the key and reads these values in the clear, because accounting sync (Xero or FreeAgent) and overtime/invoice calculations require it. What changes is what a stolen database backup or raw disk copy would show.
• Your inbound call-sheet email address uses a random token unconnected to your identity, and can be regenerated at any time if you believe it's been exposed. Inbound webhooks are cryptographically signature-verified.

8. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure (see Section 6 — for your own account, this is instant and self-serve)
• Object to or restrict certain processing
• Data portability
• Complain

To exercise any of these, email [email protected]. We'll respond within one month.

9. How to complain

If you're unhappy with how we've handled your data, you can complain to us directly — see our Complaints Procedure for how that works. You can also complain to the UK Information Commissioner's Office (ico.org.uk) at any time; you don't need to complain to us first.

10. Cookies

See our Cookie Notice.

11. Changes to this policy

We'll post updates here and, for material changes, notify you by email.