Privacy Policy
Last Updated:
This policy explains what personal data TradePact collects, why, who we share it with, how long we keep it, and your rights. It covers our website, web app and iOS and Android apps.
1. Who we are
TradePact is operated by Curious House Design Limited, company number 16600459, 27 Newburn Croft, Quinton, Birmingham, England, B32 1QU. We are registered with the Information Commissioner's Office (ICO) under registration number ZC262126. For any privacy question or request, email support@tradepact.co.uk.
2. Our role
- Builders (our account holders): we are the data controller for your account, billing and usage data.
- Clients and subcontractors: when a Builder adds your details to a quote, a job or CIS records, the Builder is the data controller and we process your data on their behalf as a processor, except where we use data for our own purposes described in this policy, for which we are the controller. Contact the Builder first about how they use your data. We will help them respond.
3. What we collect
| Who | Data | Source |
|---|---|---|
| Builders | Name, email, mobile number, business name, trading address, company number, VAT number | You, at sign-up and in settings |
| Builders | Trade registrations (Gas Safe, NICEIC) and the results of checks against Companies House, Gas Safe Register and NICEIC | You, and those public registers |
| Builders | Bank account name, sort code and account number shown on your quotes | You |
| Builders | Subscription and billing records (card payments are handled by Stripe; we never see your full card number) | You and Stripe |
| Builders | Quotes, scopes of work, photos, uploaded terms and conditions, and the text you type or dictate into AI features (we do not store voice recordings) | You |
| Clients | Name, email, phone number, job address, quote details, acceptance and e-signature, with date, time and IP address of signing | The Builder, and you when you sign |
| Subcontractors | Name, business name, contact details, Unique Taxpayer Reference (UTR), CIS verification status, payments and deductions | The Builder |
| Everyone | Server log data (IP address, browser or device type), push notification tokens, and, only if you turn on product analytics, basic feature usage events | Automatically |
| Clients | When you open a quote link: the date and time, browser or device type and IP address | Automatically, when the link is opened |
| Anyone contacting support | Name, email address, your message and anything you attach | You, through our support form or by email |
We do not collect National Insurance numbers, precise location, contacts or health data. TradePact is not intended for anyone under 18.
4. How we use data and our lawful bases
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Create and run your account, send quotes, collect signatures, show payment details | Contract |
| Verify your phone number and trade registrations, detect fraud and protect Clients | Legitimate interests (keeping the platform safe) |
| Take subscription payments and keep accounting records | Contract and legal obligation |
| Keep CIS records the Builder needs for HMRC | Legal obligation (the Builder's, as controller) |
| Keep signed quotes as evidence of what was agreed, where we determine that retention is necessary for our own legal claims | Legitimate interests (establishing, exercising or defending our legal claims); otherwise we process signed quotes on the Builder's instructions as processor |
| Draft scopes and quotes with AI, and answer your questions through the AI assistant | Contract, and your permission: the app asks before you first use an AI feature and you can withdraw it at any time in Settings |
| Send service emails and SMS (verification codes, quote alerts, billing) | Contract |
| Send product news and tips to Builders | Legitimate interests; you can unsubscribe at any time |
| Understand which features are used, through in-app product analytics that is off unless you turn it on | Consent; you can turn it off in Settings at any time |
| Tell the Builder when their quote has been opened, and keep a record of when it was viewed and signed | Legitimate interests (helping Builders follow up and keeping an accurate record of the agreement) |
| Answer support enquiries | Legitimate interests (responding to you), or contract if you are a Builder |
We do not sell personal data, and we do not use it for advertising profiles. We do not use your data, or your Clients' data, to train AI models, and our OpenAI account is set not to share inputs or outputs with OpenAI for model training.
5. Who we share data with
We use these service providers, under written contracts that require them to protect your data:
| Provider | Purpose | Location |
|---|---|---|
| Render | Hosting | EU (Frankfurt, Germany) |
| Supabase | Database, sign-in and file storage (photos, uploaded terms and conditions, signatures) | UK (London) |
| Stripe | Subscription payments | UK, EEA and US |
| Twilio | SMS verification codes and messages | US |
| Resend | Transactional email | US |
| Google (Firebase Cloud Messaging) | Push notifications | US |
| OpenAI | AI drafting of scopes and quotes, the AI assistant, and transcribing voice notes in the web app | US |
We also share data:
- with the Client you send a quote to, which includes your business and bank details. If you choose to send it by WhatsApp, the app opens WhatsApp on your own phone with the message ready and you send it yourself, under WhatsApp's own terms;
- with Companies House, Gas Safe Register and NICEIC when we check your registration;
- with Apple and Google when you use their app stores, under their own privacy policies; and
- with professional advisers, regulators, law enforcement or a buyer of our business where the law requires or allows it.
Voice dictation works differently on each platform. In the web app, your recording is sent to OpenAI to be transcribed and we do not store it. In the iPhone app, dictation uses Apple speech recognition, and in the Android app it uses Android SpeechRecognizer (Google Speech Services when available). Depending on the device's settings, your audio may be sent to Apple or Google to return the text. In both apps TradePact receives only the text and does not send your audio to OpenAI. Text you type or dictate into AI features is sent to OpenAI only after you have given your permission.
6. International transfers
Some providers process data in the US. We protect these transfers with the UK-US Data Bridge where the provider is certified, or the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account data (profile, business and bank details, saved terms, drafts, unsigned quotes, other jobs and customers) | While your account is open. Removed when you delete your account (straight away, and always within 30 days), apart from the records below |
| Signed quotes and signature records, with their job and customer record | Up to 7 years from signing, where we need them for our own legal claims |
| Billing and accounting records | 6 years after the end of the financial year, for HMRC |
| CIS records, including UTRs | While your account is open. After you delete your account they are kept for 6 years with the billing records, then deleted. Builders can export them first and are responsible for keeping them for HMRC |
| Voice recordings and AI text | We do not store voice recordings. Our AI provider may keep what we send it for up to 30 days for abuse monitoring |
| Unaccepted quotes and photos | Removed when you delete your account (straight away, and always within 30 days) |
| Product analytics events | Up to 14 months, or deleted as soon as you turn product analytics off |
| Backups | Overwritten within 35 days |
| Quote view records | Kept with the quote they relate to, and deleted when it is |
| Support enquiries | Up to 2 years after the enquiry is closed |
Where we must keep data after you close your account, we restrict it to that purpose and delete it when the period ends.
8. Deleting your account
You can delete your account at any time:
- in the iPhone or Android app: Settings > Account Management > Delete account;
- on the web: Settings > Account > Account management > Delete account (see tradepact.co.uk/delete-account); or
- by emailing support@tradepact.co.uk.
We will confirm by email. Your drafts, unsigned quotes, other jobs, customers, business and bank details, saved terms and uploaded files are removed, apart from the records in section 7 that we must keep. Deleting the app from your phone does not delete your account. Any active subscription is cancelled when you delete your account.
9. Your rights
Under UK data protection law you can ask us to:
- give you a copy of your data;
- correct inaccurate data;
- delete your data;
- restrict or object to how we use it, including stopping marketing at any time;
- transfer your data to you or another provider; and
- withdraw consent where we rely on it.
Email support@tradepact.co.uk. We will reply within one month. If you are a Client or subcontractor, we may pass your request to the Builder who holds your data.
If you are unhappy with how we handle your data, you can complain to the ICO at ico.org.uk or on 0303 123 1113. We would appreciate the chance to help first.
10. Cookies
On our website and in the TradePact app we use essential cookies and similar storage only to keep you signed in and secure. We do not use advertising or third-party analytics cookies.
TradePact has its own product analytics, which is off by default and only records events if you turn on "Product analytics" in Settings. It records which features are used, page views, app version and a session ID. It never records your IP address, advertising identifiers, quote contents, customer details or amounts. If you turn it off, we stop recording and delete your analytics history. The apps do not use advertising identifiers or track you across other companies' apps and websites.
11. Security
We encrypt data in transit and at rest, restrict staff access to people who need it, and use SMS verification at sign-up. No system is completely secure, so please keep your login details private and tell us straight away if you suspect a problem.
12. Changes to this policy
We will post any update here with a new "last updated" date. If a change significantly affects how we use your data, we will email Builders before it takes effect.
13. Contact
Curious House Design Limited (TradePact), 27 Newburn Croft, Quinton, Birmingham, England, B32 1QU. Email: support@tradepact.co.uk.