Privacy Policy

1. Information We Collect

We process two categories of information within TradesHelper:

• Tradesperson Profile Data: Your business name, physical address, business phone number, email address, logo files, default tax rates, and professional registration details (such as Gas Safe or OFTEC registration IDs).
• Client & Transaction Data: Names, contact emails, phone numbers, and job addresses of your customers. This also includes invoices, quotes, appointments, supplier receipt files, and safety certificates.
• Early Access & Waitlist Data: If you join our waitlist, we collect your email address, optional name, and trade specialty based on your explicit consent to notify you when new registration tranches open. You can unsubscribe at any time.

2. How Data is Processed

All customer and document details you input reside in secure database instances. When you forward emails to your dedicated @invoices.tradeshelper.app inbound routing address, our system processes the attachment to extract invoice values and match them to your supplier account. The raw attachment file and extracted fields are stored securely.

3. Payment & Billing Data

When payment features go live, all payment transactions will be processed directly through certified PCI-DSS Level 1 payment gateways (such as Stripe or Merchant of Record platforms). TradesHelper never receives, processes, or stores your full credit or debit card numbers on our infrastructure. We retain only provider customer references, tokenised subscription identifiers, and invoice transaction histories for accounting compliance.

4. Data Retention & Lapsed Accounts

We apply clear retention limits in accordance with the GDPR storage limitation principle:

• Active Accounts: We retain your business data and customer records for as long as your account remains active.
• Lapsed Accounts (12 Months): When a trial concludes without a paid plan or a subscription is cancelled, your account transitions to read-only safety mode. Records are preserved for 12 months (365 days) so you can review and export your data anytime.
• Advance Warning Schedule: Prior to any automated record pruning, we deliver email notifications at 65 days, 14 days, and 3 days before scheduled archiving to ensure you have ample opportunity to download your records or reactivate your account.
• Soft Deletes: Items you voluntarily delete in-app are moved to Deleted Items and permanently purged after 30 days.

5. Subprocessors & Storage Providers

We work with trusted infrastructure partners to host the Service:

• Supabase: For secure database hosting, PostgreSQL storage, authentication, and secure bucket storage.
• Nodemailer / Outbound SMTP Host: To dispatch your security verification codes, welcome newsletters, trial reminders, and notification updates.
• Payment Infrastructure: Certified payment gateways for subscription tokenisation, recurring invoicing, and tax calculation.

6. Cookies and Local Storage

We only place strictly necessary cookies and local storage tokens. These are used to:

• Keep you securely signed in between page loads.
• Store your theme choice (Light vs. Dark mode).
• Remember that you have acknowledged our Cookie notification.

We do not run third-party advertising tracking scripts or behavioural tracking cookies.

7. Your Rights & Access Controls

Under UK GDPR and EU GDPR, you have the right to access your personal data, request corrections, receive an export of your customer data in structured CSV/PDF formats, or request complete account erasure ("Right to be Forgotten"). You can initiate account export or erasure directly from Account settings or by contacting our support team.