⚡

Trade-Mates

Smart business management for tradespeople

Privacy Policy

Last updated: 8 July 2026

1. Overview

Trade-Mates Ltd ("we", "us") is committed to protecting your privacy and complying with the UK GDPR and Data Protection Act 2018. This policy explains what data we collect, why we collect it, how we use it, and your rights regarding your personal data.

We act as a data controller for your account data and a data processor for the business data you store in Trade-Mates (leads, quotes, jobs, invoices, photos). You are the data controller for your customers' personal data.

2. Data We Collect

Data you provide directly:

  • Account data: name, email, business name, trade, phone number, service area
  • Business data: leads (customer names, phones, emails, addresses), quotes, jobs, invoices, photos
  • Team data: email addresses of team members you invite
  • Contact form submissions: name, email, message (stored in our database)

Data collected automatically:

  • Usage data: pages visited, features used, timestamps, IP address
  • Device data: browser type, operating system, screen resolution
  • Authentication data: login timestamps, session tokens (managed by Supabase Auth)

3. How We Use Your Data

  • Providing the Service: storing and displaying your leads, quotes, jobs, invoices, and photos
  • Authentication: verifying your identity and managing your session
  • Notifications: sending email alerts when leads arrive, quotes are viewed, invoices are paid, etc.
  • Customer communication: sending quotes and invoices to your customers on your behalf
  • Team collaboration: sharing data with team members you invite
  • Service improvement: analysing usage patterns to improve features (anonymised)
  • Billing: processing subscription payments (via Stripe) and issuing receipts
  • Support: responding to your enquiries via the contact form or admin inbox

4. Legal Basis for Processing (UK GDPR)

  • Contract (Art. 6(1)(b)): processing your data to provide the Service you subscribed to
  • Legal obligation (Art. 6(1)(c)): retaining billing records for tax purposes
  • Legitimate interests (Art. 6(1)(f)): sending service notifications, improving the platform
  • Consent (Art. 6(1)(a)): for optional marketing communications (you can opt out anytime)

5. Data Storage and Security

Your data is stored securely using the following providers:

  • Supabase (database + authentication) — PostgreSQL database hosted in EU (Ireland), with Row Level Security ensuring users can only access their own data
  • Vercel (application hosting) — servers in Washington D.C., USA (East)
  • Resend (email delivery) — for sending transactional emails
  • Stripe (payment processing) — PCI-DSS compliant, we never see or store card numbers

We use encryption in transit (HTTPS/TLS) and at rest (database-level encryption). Access to production data is restricted to authorised personnel. Photos are stored as base64 data in the database — not on public file servers.

6. Data Sharing

We do not sell your data. We only share data with the third-party providers listed above, strictly for operating the Service. We may disclose data to law enforcement if legally compelled to do so.

When you send a quote or invoice to a customer, their email address is shared with Resend (for email delivery) and Stripe (for payment processing, if enabled). This is necessary to provide the Service.

7. Data Retention

  • Active accounts: data is retained while your account is active
  • Cancelled accounts: data is retained for 90 days after cancellation, then permanently deleted
  • Contact form submissions: retained until you delete them from the admin inbox
  • Billing records: retained for 6 years (HMRC requirement)
  • Inactive accounts: accounts with no login for 12 months may be deleted with 30 days' notice

8. Your Rights (UK GDPR)

You have the right to:

  • Access: request a copy of all your data (data portability export)
  • Rectification: correct inaccurate or incomplete data
  • Erasure: request deletion of your account and all associated data
  • Restriction: request that we limit processing of your data
  • Objection: object to processing based on legitimate interests
  • Withdraw consent: opt out of marketing communications at any time

To exercise any of these rights, contact us via our contact page.

9. Cookies

Trade-Mates uses essential cookies for authentication (session management). We do not use third-party tracking cookies, advertising cookies, or analytics cookies. No cookie consent banner is required because we only use strictly necessary cookies.

10. International Data Transfers

Your data is processed in the EU (Supabase — Ireland) and the USA (Vercel — Washington D.C.). We rely on Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement to ensure appropriate safeguards for international transfers.

11. Children's Privacy

Trade-Mates is not directed at children under 18. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email at least 14 days before material changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Contact

If you have questions about this Privacy Policy or your data, please:

← Back to Trade-Mates