07590 893350
KLO Document Control

Privacy statement

Effective date: 12 November 2026

KLO Document Control ("the app") and its consultants' web page ("the page") are made by KLO Technical Services Limited, trading as KLO Development Services, company number 16105032, registered office 23 Brook Road, Bomere Heath, Shrewsbury, Shropshire, SY4 3PU ("KLO", "we"). KLO is registered with the Information Commissioner's Office as a data controller, registration number ZC299134.

Your company uses KLO Document Control to keep a project's document register: its drawings and documents, their revisions and status, the firms working on it, transmittals, reviews and the drawing plan. This statement explains where that information is kept and where it goes.

The short version

  • We never receive your company's register. It and its documents are kept in your company's own Microsoft 365 (SharePoint), reached with your own Microsoft sign-in. KLO's account server keeps your KLO account (see "Your KLO account"). If someone shares a folder with "Anyone with the link", KLO's link server reads that folder (see "Links to shared folders").
  • Emails go from your own mailbox, through your company's Microsoft 365.
  • The AI is off until you turn it on. If you do, drawings go to Anthropic through your own Anthropic key, under your own agreement with Anthropic. Nothing goes to KLO.
  • No advertising, no analytics, no tracking. The app and the page collect no usage data, and don't track you across other apps or websites.

What the register holds, and where

What Where it's kept
The register: every document and revision, its status and notes, transmittals and who they went to, reviews and their comments, RFIs (requests for information): each question, the drawings and marked-up files sent with it, who it went to, and the firm's answers, the drawing plan, the firms and their people (names and email addresses), the distribution matrix, and who did each thing and when In the project's 00 REGISTER folder on your company's SharePoint site
The documents themselves, and each firm's upload folder In the project's folders on the same site
Your company's name and logo, as they appear on emails, sheets and PDFs In the register, set by an administrator
Copies of register files and documents already read, and the "what changed" PDFs a change check makes On each device, in the app's own folders. Signing out removes them
The demo project, if you try it On that device only, with made-up firms and drawings. Nothing is sent from it
Your Microsoft sign-in In the device's keychain (Apple's encrypted store), on that device only
Your Anthropic key, if you enter one In the app's own keychain, synced by iCloud Keychain to your other devices. Never written to SharePoint
Whether you've turned the AI on, and when; a few display choices In the app's settings on the device
The projects you've opened on a device: each one's name, code and place in SharePoint In the app's settings on that device. Signing out clears them
The open project's place in SharePoint, the plots typed for each project, and the address last typed in Setup's guest check In the app's settings on that device. Signing out leaves them, so the app opens where it was
A random number naming the device, which goes on each change it writes to the register, so that changes from different devices can be told apart In the app's settings on that device. Signing out leaves it

Nothing in the register is overwritten. Each change is a new file, so the history shows who did what and when.

Microsoft holds your company's SharePoint, mail and audit log under your company's own agreement with Microsoft. KLO can't see them.

What the app and the page ask Microsoft for

Permission Why
Sign you in and read your profile (User.Read, offline_access) To know your name and email address, which go on what you register and issue, and to keep you signed in
Read and write files and sites (Files.ReadWrite.All, Sites.ReadWrite.All) To find the project's SharePoint site and library, and to register, issue and file its documents
Send mail as you (Mail.Send) To send transmittals, review requests, RFIs, reminders and review outcomes from your own mailbox, so replies come to you
Read your mail (Mail.Read) To find replies to transmittals, reviews and RFIs, and bounce reports for transmittals. The app looks only for emails whose subject carries the transmittal's, review's or RFI's reference. When Microsoft won't search, it lists the subject, sender and time of recent emails, up to 1,000, on the device, and keeps none that don't match. An email's text is read only once its subject carries the reference, or starts “Undeliverable:” for a bounce report. Nothing it finds is recorded until you record it
Invite guests (User.Invite.All; your IT must approve it) To make a consultant outside your company a guest of your Microsoft 365, so SharePoint will share with them. Microsoft's own invitation email isn't sent
Search the audit log (AuditLogsQuery-SharePoint.Read.All; your IT must approve it) To show whether a consultant opened or downloaded what was issued to them, from your SharePoint audit log
SharePoint full control (AllSites.FullControl; your IT must approve it) To keep a folder for your company only (an internal folder), and to make a project's SharePoint site when you ask it to

The page asks only for the first two rows. Because the file and site permissions reach files across the organisation, your company's IT administrator may need to approve KLO Document Control once, for everyone, before anyone can sign in. The app's Settings › Approval by IT has the link and a guide for IT.

Emails and sharing

  • Each email goes from the mailbox of the person who did it: transmittals, review requests, review outcomes, shared-folder emails and reminders, to the people your company has put in the register, including people outside it such as consultants. Transmittals and their reminders are also kept in that person's Sent Items.
  • Sharing a folder or a document with a firm makes SharePoint email them its link, from Microsoft.
  • Each email sent is noted in the register, as the record of what was issued to whom.

Links to shared folders

When you share a folder with "Anyone with the link", KLO's link server (Cloudflare Workers, dc.klodevelopmentservices.co.uk) reads that folder from your company's SharePoint through the Entra app "KLO Document Control links", which your IT approves once. It has read-only access through Microsoft Graph's Files.Read.All. This is an app permission: on its own it could read any file in your company's Microsoft 365. KLO's server code limits it to the folders people have shared by link, and to the files inside them. It lists them and hands each download straight to SharePoint's own short-lived download link, so KLO does not store the files. KLO keeps a log of when each link's page was opened and which files were downloaded (time and file name only; an anyone-link names nobody). The sharer sees it under "Opened and downloaded". Withdrawing the link stops all access at once.

Only someone with their own subscription can make a link or move its date. KLO's link server asks KLO's account server whether they're subscribed, using their KLO account sign-in, and keeps nothing from the answer. Each company's KLO links are off until one of its Microsoft 365 admins (a Global or SharePoint admin) turns them on, in the web register's Shared folders tab. KLO keeps that setting with your company's tenant ID, the admin's sign-in name and when it was changed, for as long as your company uses KLO Document Control, and deletes it on request. Admins see every live link in the company (the folder, who made it, when it expires, whether it has a password) and can take any of them away. Turning KLO links off takes every live link away at once.

KLO also keeps a record of each link: your company's Microsoft 365 tenant ID and name, where the folder is in your SharePoint (its library and item IDs), the folder's name, who made it (their sign-in name), when it was made and when it expires, whether it was taken away and when, and a scrambled copy (a hash) of the password if one was set. The link record and its log are deleted 90 days after the link expires or is taken away, whichever is first.

To check who is making or changing a link, KLO's link server keeps a scrambled copy (a hash) of the person's Microsoft sign-in, with their sign-in name and company, for up to an hour.

The AI (off unless you turn it on)

The app can read a drawing's title block, and check what changed between two revisions, with Claude, an AI made by Anthropic. It is off until you agree to it in Settings › AI (Claude) and enter your own Anthropic API key. You can turn it off there at any time. When it's on, the app sends Anthropic:

  • To read a title block: page 1 of each upload waiting in Incoming and of each file you drop to register, with the project's status codes.
  • To check what changed: pages made from the new and previous revisions of a drawing, with its number, title, folder, status and the notes typed against it in the register, the text that appeared or went, and the names, codes and roles of the firms that would receive it.

A title block often carries people's names. It goes through your key, under your agreement with Anthropic, so Anthropic handles it as your company's provider, not KLO's. Nothing else in the register is sent.

The consultants' page

  • What it's for: firms answer reviews and RFIs, check file names before they upload, and send changes to the drawing plan, signed in as guests of your company's Microsoft 365.
  • RFIs: an RFI and its marked-up files are copied into the firm's own folder in your SharePoint, and the firm's answers are saved there too, each with the address of the person who answered.
  • Where it is: dc.klodevelopmentservices.co.uk/document-control/, unless your IT publishes its own copy.
  • Hosting: KLO's copy is hosted by Cloudflare. Like any web host, Cloudflare handles your IP address and browser details to deliver the page, under its own privacy policy.
  • Who it talks to: once loaded, the page talks only to Microsoft (to sign in, and to Microsoft Graph). KLO adds no analytics or tracking to it.
  • Kept in your browser: your sign-in, for that browser tab only, and what you've typed in an answer or a plan change before you send it. To remove it, clear the site's data in your browser.

The web register

  • What it's for: your company's people use the register in a browser, signed in with their own Microsoft 365 account. They can read it, register, reject or hold incoming documents, issue transmittals and follow them up, run reviews, raise RFIs, add firms, share folders and change the project's setup, as in the app.
  • Where it is: dc.klodevelopmentservices.co.uk/document-control/app/, hosted by Cloudflare as the consultants' page is.
  • Who it talks to: once loaded, the page talks to Microsoft (to sign in, and to Microsoft Graph) to KLO's account server (see "Your KLO account") and, when you share a folder with "Anyone with the link" or look at when a link was used, to KLO's link server (see "Links to shared folders"). The register is read from, and written to, your company's SharePoint. The register itself never goes to KLO. KLO adds no analytics or tracking to it.
  • What it changes: what you do on the page is written to the project's 00 REGISTER folder and its documents are moved or added on your company's SharePoint, as the app does, with your name and the time. Issuing a transmittal gives each person it goes to a view-only SharePoint link to its documents, makes the transmittal sheet in your browser, saves it to SharePoint, and emails it from your own mailbox. If SharePoint won't share with someone outside your company because they aren't yet a guest of your Microsoft 365, the page makes them one first, as the app does.
  • Its permissions: the same as the app's, listed above, asked for when first needed. Send mail as you (Mail.Send) is asked for only when you first email a transmittal from the page, and Read your mail (Mail.Read) only when you first press Look for replies and bounces. Mail is read in your browser, under the same rule as the app, and nothing that doesn't match is kept. Invite guests (User.Invite.All) is asked for only when SharePoint first won't share a transmittal's documents with someone outside your company who isn't yet a guest; Microsoft's own invitation email isn't sent.
  • Kept in your browser: your sign-in, for that browser tab only, a copy of the register's change files, so that it opens faster next time, and the name, code and link of each project you've opened, so that you can swap between them. These stay in the browser until you press Sign out, which removes them, or clear the site's data. Each browser tab also keeps a random number naming it as a device, which goes on what you write to the register, as each device running the app is named; it goes when the tab is closed. Your KLO account's email address and sign-in token are kept too, until you sign out of the KLO account.

Your KLO account

Making changes in full KLO Document Control needs a subscription, kept in a KLO account under your Microsoft 365 work address. The demo project and the free edition with BR Info Schedule never ask.

  • What it holds: your email address, a sign-in token, and your subscription: whether it's active, until when, and whether it was bought on the web or through Apple.
  • Signing in: KLO emails a 6-digit code to your address, through Microsoft 365, from [email protected].
  • What for: only to sign you in and decide whether you can make changes. Nothing is used for advertising or analytics, or shared with anyone else.
  • Where: KLO's account server, a Cloudflare server and database in Western Europe, which Cloudflare runs for KLO.
  • Kept on your device: the server's last answer, so the app and the web register know where you stand for 7 days without a connection, and your KLO account's sign-in token: in the app, in your device's keychain; in the web register, in the browser. Signing out of the KLO account removes it.
  • Deleting it: in the app, Settings › KLO account › Delete KLO account…, or email us. This cancels a web subscription too. Lawful basis: contract.

Paying on the web. Web payments are taken by Stripe. Your email address, card details and billing address go to Stripe; KLO receives your Stripe customer reference and subscription dates. Stripe's privacy policy: https://stripe.com/privacy.

The free edition with BR Info Schedule

The free edition that comes with KLO BR Info Schedule keeps its project in your company's own SharePoint, as full Document Control does. Everything in this statement applies to it, except the KLO account, which it never needs.

Links to other KLO apps

Another KLO app on the same device, such as KLO Pre-Con, can open KLO Document Control. Nothing is sent over the internet.

Information about other people

Your company decides who and what goes into its register: names, email addresses, notes and documents. Your company is responsible for that information and for who it is sent to. If your company has a data protection policy, use KLO Document Control in line with it.

Your rights

  • KLO doesn't hold your company's register, so we can't see, change or delete anything in it. KLO does keep your KLO account, if you have one (see "Your KLO account"). You can ask us to see or delete it, or delete it yourself in the app.
  • The register is your company's. Ask your company about anything about you in it. Its history is kept on purpose, so that every issue and every change can be traced.
  • What Microsoft holds is for your company's Microsoft 365 administrator. What Anthropic holds is under your own Anthropic account.

Support emails. If you email us at [email protected], we use your email only to answer you.

  • We keep it for as long as we need to deal with it, then delete it.
  • If it leads to work for you, it becomes part of our business records for that work.
  • You can ask us to see or delete it.

If you subscribe, we keep your KLO account and, from Stripe, your customer reference and subscription dates (see "Your KLO account"). We keep payment records as business records for as long as UK law requires.

Testing it with TestFlight. If you test KLO Document Control through Apple's TestFlight, Apple shares with us the email address you were invited with, and any feedback, screenshots and crash reports you choose to send, under Apple's TestFlight terms. We use them only to run the test and improve the app.

You can complain to the Information Commissioner's Office (ico.org.uk) if you think your information has been handled wrongly. We'd be grateful for the chance to put it right first.

Children

KLO Document Control is for companies and their staff. It isn't meant for children.

Changes

If this statement changes, the new version is put on this page with its date. If a change affects what leaves your device, it is described in the app's release notes too.

Contact

KLO Development Services, 23 Brook Road, Bomere Heath, Shrewsbury, Shropshire, SY4 3PU. Email: [email protected].