Privacy Policy

1. Introduction

Tradehand ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

This policy applies to users in the United Kingdom and complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1A. Who controls your data

Tradehand is used by property maintenance companies to run their operations, so who controls personal data depends on whose data it is:

• A company's customers and contacts. When a company uses Tradehand to serve its customers, tenants, landlords, property managers, and other job contacts, that company is the data controller and Tradehand is its processor: we handle that data on the company's instructions to run its jobs, as set out in our Data Processing Addendum. Tradehand provides a standard privacy notice that the company adopts; the company remains the controller for its customers' data.
• Companies, owners, team members, and website visitors. Tradehand is the controller of the account and business data of the companies and people who are our own customers, and of visitors to our website.
• Tradehand's own narrow purposes. Tradehand is also an independent controller for a small, defined set of purposes: preventing fraud and abuse, producing aggregated analytics to improve the Services and the agents, and meeting our own legal obligations.

This policy explains how Tradehand handles data where it is the controller. Where a company is the controller, that company's own privacy notice applies. If you have questions about this policy, please contact us through the app.

2. Information We Collect

Personal Information (Customers)

When you use Tradehand as a customer, we collect:

• Name and contact information (phone number, email address)
• Address and location data for the job or property
• Job details and problem descriptions
• Payment information (processed securely through Stripe)
• Communication history with the company, traders, or Tradehand assistant tools through our platform (including SMS and call recordings)

Company and Trader Information

When companies and traders use Tradehand, we may collect professional, business, and compliance information:

• Trade registration details: Registration numbers, certificate information, and registration status where relevant to the work
• Professional qualifications: Certificates, training records, and qualification dates
• Business information: Business name, trading name, business address, and VAT number (if applicable)
• Public liability insurance: Insurance certificate details and coverage amounts
• Service area and specialisations: Geographic coverage, types of maintenance work performed, and areas of expertise
• Availability and pricing: Working hours, rates, and pricing set by the company
• Stripe Connect information: The company's bank account details for payment processing (stored securely by Stripe). Individual team members do not connect their own Stripe accounts

Where relevant, we may retain copies of certificates, registration documents, and insurance evidence so companies can manage jobs, documents, and compliance records in one place.

Usage Information

We automatically collect:

• Device information and identifiers
• App usage data and interactions
• IP address and location data
• Log files and analytics data

3. Legal Basis for Processing

Under UK GDPR, we process your personal data based on the following lawful bases:

• Contract Performance: Processing is necessary to perform our contract with you, facilitate the platform, manage job records, communications, and process payments
• Legitimate Interests: We have legitimate interests in operating our platform, preventing fraud, improving our services, and communicating with you about jobs, accounts, and support
• Legal Obligation: We must process certain data to comply with legal requirements (tax, financial regulations, safety reporting)
• Consent: Where required, we obtain your consent for specific processing activities (marketing communications, optional features)

4. How We Use Your Information

We use your information to:

• Verify and onboard companies and traders: Check relevant registrations, validate professional information, and support compliance record keeping
• Help companies capture enquiries, create jobs, schedule traders, and coordinate customers or contacts
• Facilitate communication: Enable phone calls (via ElevenLabs) and SMS messaging (via Twilio) between customers, companies, traders, and relevant job contacts
• Record and analyze interactions: Call recordings and transcripts are used for quality assurance and dispute resolution, and, in aggregated or de-identified form, to improve the Services
• Process payments securely through Stripe
• Provide customer support and respond to your inquiries
• Detect and prevent fraud, security threats, and illegal activity
• Improve our platform, services, and user experience through analytics
• Send important updates about jobs and accounts
• Comply with legal obligations (tax, financial regulations, safety reporting)
• Enforce our Terms of Service
• Resolve disputes, investigate complaints, and troubleshoot problems

5. Information Sharing and Disclosure

We share your information only in the following circumstances:

With the company running your job

When a job is created, the relevant details: such as name, contact details, address, postcode, and job description. Are available to the company handling the work and the team member assigned to it, and, where a job involves more than one party, to the other job contacts who need them, such as a tenant, landlord, or property manager. Tradehand handles this data on the company's behalf so it can run the job.

With Service Providers (Data Processors)

We use third-party service providers who process data on our behalf under strict data processing agreements:

• Convex (database and backend): Stores all platform data including user accounts, job requests, and messages
• Clerk (authentication): Manages user authentication and account security
• Stripe (payment processing): Processes payment transactions and stores payment method details
• ElevenLabs (voice calls): Facilitates automated phone calls and processes voice-agent tool results, call recordings, and transcripts. We opt the workspace out of using this content to train ElevenLabs models
• Twilio (SMS): Sends and receives text messages between customers, companies, traders, and job contacts
• OpenRouter and Google Gemini (text assistant): OpenRouter routes requests to the Google Gemini models that power the Tradehand text assistant. Every request uses routing that excludes providers which collect request data, and the workspace data-use discount is disabled so inputs and outputs are not used to improve OpenRouter's product
• Vercel (hosting and aggregate analytics): Hosts our website and provides cookieless, aggregate site-use statistics. This operates by default and you can object at any time in Cookie settings
• Google Analytics and Google Ads: With your optional consent, measures site use and our own demo and revenue marketing events
• Meta, Reddit, and X (advertising measurement): With your optional consent, receive ad click IDs and hashed identifiers for our own lead, booked-demo, and revenue events. This covers Tradehand prospects only, never a trade company's customers or job data
• LinkedIn, Facebook, and Instagram (optional social posting): When a Tradehand company administrator connects an account, the selected provider receives the completed-work caption and photos needed to publish to the connected destination. Tradehand stores the authorization token, granted permissions, provider account identifiers, and confirmed post identifiers needed to operate and audit the connection

Legal and Safety Disclosures

We may disclose information when:

• Required by law, regulation, or legal process
• Necessary to respond to lawful requests from public authorities
• Needed to enforce our Terms of Service or protect our rights
• Required to protect the safety, property, or rights of users or the public
• In connection with a business transaction (merger, acquisition, or sale)

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

5A. Google Calendar Integration

Traders can optionally connect a Google Calendar so Tradehand knows when they are already busy and avoids double-booking. Google is the provider for this integration. This connection is entirely optional and is always started by the Google account holder. Nothing is connected unless the trader chooses to link their own calendar and grants access on Google's consent screen.

We are moving this integration to a least-privilege connection. The revised initial connection lets the trader choose a calendar and lets Tradehand receive only unavailable start and end times. It stores the selected calendar's identifier and display name, the authorization tokens, and those busy times; it does not receive imported event names, descriptions, locations, attendees, or event identifiers.

Until Google approves that revised connection and we complete the production migration, an existing connection may still use the previous read permission and retain an event's time, Google calendar and event identifiers, and title. Office schedules show only “Busy”. Before the revised code is released, an older stored title can also be processed when a trader asks the text Assistant about that schedule or when text or voice dispatch checks an overlapping time. After approval, we will remove Tradehand-created entries, revoke each older grant, delete its stored tokens and legacy event metadata, and ask the trader to reconnect with the narrower permission.

A trader can separately choose to add Tradehand jobs to Google. Only then do we ask for permission to create, update, and delete events. We send the scheduled time and the Tradehand job details needed in that Google entry, and store the Google identifier for entries Tradehand created so that the same entry can be updated or removed. The trader chooses the writable calendar and can turn this feature off independently of availability import.

We use Google Calendar data only for the visible scheduling features described above. It is never used for advertising, sold, or shared for marketing. In the revised integration, Google-derived rows are reduced to “Busy” and their start/end times before any dashboard, text, or voice schedule or dispatch output. OpenRouter and Google Gemini may process those opaque busy windows and derived booking options. During a voice scheduling request, ElevenLabs and its Google Gemini language model may process opaque busy windows and derived candidate or booked times. They do not receive imported event titles, descriptions, locations, attendees, or Google event identifiers. We disable provider data use for model improvement and do not permit raw or derived Google Workspace data to train generalized or foundation AI models.

We import a bounded period from the recent past to roughly 90 days ahead and refresh it while the connection is active. Turning availability import off deletes the imported busy times. Disconnecting revokes Tradehand's Google access and deletes its authorization tokens, selected-calendar details, imported busy times, and locally stored identifiers for Tradehand-created entries. In the revised integration, disconnecting first removes every Tradehand-created Google entry while access is still active and fails visibly without clearing retryable state if Google does not confirm a deletion.

Tradehand's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5B. Social Account Integrations

A Tradehand company administrator can optionally connect LinkedIn, Facebook, or Instagram. Tradehand uses the completed-work summary and eligible work photos stored for that company to prepare a caption and publish it only to the destination explicitly authorized by the provider. Before publishing, Tradehand checks each proposed photo and rejects it if it contains a person, customer-identifying information, an address, vehicle registration, document, screen, personal belongings, sensitive private interior, or anything uncertain. The caption generator is instructed not to include customer names, addresses, postcodes, prices, contact details, or inferred claims.

We store the connected account's provider identifier, display name, handle where supplied, authorization token, granted permissions, expiry time, and confirmed post receipt. These details are used only to operate, secure, and audit the company's social posting feature. They are not sold or used for advertising.

You can revoke Tradehand in the social provider's account settings. To ask us to delete the related connection data, follow our social account data deletion instructions.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information. This includes encryption, secure data storage, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

Typical retention periods:

• Account information: Retained for the duration of your account, plus 6 years after closure (for legal and tax purposes)
• Job records and communication: Retained for 6 years after job completion (for dispute resolution and legal compliance)
• Payment records: Retained for 7 years (HMRC requirement)
• Call recordings: Retained for 90 days unless needed for dispute resolution or legal purposes
• SMS messages: Retained for 6 months after job completion
• Analytics data: Aggregated and anonymized after 2 years

When we no longer need your information, we securely delete or anonymize it.

7. Your Rights Under UK Data Protection Law

Under UK GDPR, you have the following rights:

• Right of Access: Request a copy of the personal information we hold about you (commonly called a "Subject Access Request" or SAR)
• Right to Rectification: Request correction of inaccurate or incomplete information
• Right to Erasure ("Right to be Forgotten"): Request deletion of your information, subject to legal retention requirements
• Right to Restrict Processing: Request that we limit how we use your information in certain circumstances
• Right to Data Portability: Receive your information in a structured, machine-readable format and transfer it to another service
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time
• Rights Related to Automated Decision-Making: We do not currently use fully automated decision-making that produces legal effects

How to Exercise Your Rights: To exercise any of these rights, please contact us through the app. We will respond to your request within one month, or inform you if we need additional time (up to three months for complex requests).

Right to Lodge a Complaint: You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe we have not handled your data properly. Visit ico.org.uk or call 0303 123 1113.

8. Cookies and Tracking Technologies

We use essential storage to operate the site and privacy-preserving Vercel aggregate analytics by default to understand and improve site use. You can object to Vercel analytics at any time. We load Google Analytics and advertising technologies only after you choose to allow them.

Types of cookies we use:

• Essential Cookies: Required for authentication, security, core platform functionality, recording your privacy choice, and reliably completing a booking or consent sync (these cannot be disabled)
• Aggregate Site Analytics: Vercel Analytics measures aggregate page use without cookies or persistent identifiable sessions; it operates by default unless you object
• Optional Analytics Cookies: Google Analytics helps us understand site interaction only after you accept optional tracking
• Advertising Cookies: Google Ads, Meta, Reddit, and X measure our campaigns and audiences. We may store campaign parameters, platform click IDs, and pixel identifiers, then send hashed contact identifiers for our own consented conversion events

The paid-attribution cookie lasts up to 90 days, your choice lasts up to 12 months, and duplicated delivery/readback payloads are deleted after 30 days. Rejecting optional cookies does not affect your ability to browse or book a demo.

Use Cookie settings on any website page to object to Vercel aggregate analytics, or to accept, reject, or withdraw optional tracking at any time. Withdrawal clears our first-party advertising identifiers and suppresses any linked conversion delivery that has not completed. You can also manage cookies in your browser. For general browser guidance, visit aboutcookies.org.

9. Children's Privacy

Our platform is not intended for users under 18 years of age. We do not knowingly collect personal information from children.

10. International Data Transfers

Some of our service providers are located outside the United Kingdom, which means your personal data may be transferred to and processed in countries that may not offer the same level of data protection as the UK.

When we transfer your data internationally, we ensure appropriate safeguards are in place:

• UK transfer safeguards: We use the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified, to ensure your data receives adequate protection
• Adequacy Decisions: Where possible, we use service providers in countries deemed adequate by the UK government
• Additional Safeguards: We implement technical and organizational measures including encryption, access controls, and regular security audits

After transfer, your data remains subject to UK GDPR protections and the contractual safeguards we have in place with our service providers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes through the app or by email. Continued use after changes are posted constitutes acceptance of the updated policy.

12. Third-Party Links

Our platform may contain links to third-party websites or services. We are not responsible for the privacy practices or content of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

13. Contact Us and Data Protection Queries

If you have questions about this Privacy Policy, how we handle your data, or wish to exercise your rights, please contact us through the app or visit our About page.

We aim to respond to all data protection queries within 48 hours and resolve Subject Access Requests within one month.