Privacy Policy

Perpetually Limited (company number 16482921), registered at 66 Paul Street, London, England, EC2A 4NA is the data controller for personal data we collect about visitors to our website, prospects, trial users and account holders. We are registered with the Information Commissioner's Office (ICO) under registration number ZB100000 (placeholder, updated on registration).

This policy covers personal data we process as a controller. When you use TradesInvo to store information about your customers, jobs and invoices, you are the controller of that data and we act as your processor. The terms of that processing are set out in our Data Processing Agreement.

We collect the following categories of personal data:

• Account data: name, email, business name, role, password (hashed), phone (optional).
• Billing data: billing address, VAT number, payment method tokens (cards are handled by Stripe — we never store full card numbers).
• Usage data: pages viewed, features used, IP address, device, browser, approximate location.
• Support data: messages you send to support, screenshots and diagnostics you attach.
• Marketing data: preferences, email open/click events where you have opted in.

• Contract: to provide the service you've signed up for.
• Legitimate interests: to keep the service secure, prevent fraud, improve features, and run our business. We balance these against your rights.
• Consent: for non-essential cookies and marketing emails. You can withdraw consent at any time.
• Legal obligation: to comply with UK tax, accounting and law-enforcement requirements.

• Provide, maintain and improve the TradesInvo service.
• Process payments, send invoices and manage your subscription.
• Send service emails (security alerts, billing receipts, product changes that affect you).
• Send marketing emails where you've opted in — you can unsubscribe in one click.
• Investigate and prevent fraud, abuse and security incidents.
• Comply with our legal and regulatory obligations.

Our AI features use third-party AI providers. When you use an AI feature, the relevant prompt and minimum necessary context is sent to the provider to generate the response:

• OpenAI — lead extraction and triage, quote draft generation, review reply drafts, and turning your spoken voice notes into text.
• ElevenLabs — the optional AI voice receptionist: answering and transcribing calls, and generating spoken replies.

• We have data processing agreements in place with each AI provider.
• We do not allow providers to train their general-purpose models on your data.
• You can disable AI features for your workspace at any time in Settings.

We share personal data only with the following categories of recipients, under written contract:

• Hosting & core platform: Supabase (database, authentication, file storage) and Lovable (application hosting and transactional email delivery).
• Communications: Twilio (SMS and phone calls) and Meta (WhatsApp Business messaging), where you use those channels.
• Payments: Stripe and GoCardless, to process card payments and Direct Debits.
• AI providers: OpenAI and ElevenLabs — see "AI processing" above.
• Analytics & visitor identification: PostHog, Google Analytics and Leadsy (Instantly.ai), only once you've consented to analytics cookies (see our Cookie Policy).
• Other service providers: including Sanity (marketing content) and Firecrawl (publicly available competitor data for the compare tool, which does not include your customers' personal data).
• Professional advisers: lawyers, auditors and insurers where strictly necessary.
• Authorities: if required by valid legal process, with notice to you where lawful.

The full, current list of sub-processors, what each one does and where they're located is in our DPA appendix. We will notify you of any change to this list at least 30 days in advance.

We do not sell your personal data. Ever.

Where personal data is transferred outside the UK, we rely on UK adequacy decisions, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate supplementary measures.

• Account data: while your account is active, plus 90 days after cancellation.
• Billing records: 7 years to comply with UK tax law.
• Support tickets: 3 years.
• Marketing data: until you unsubscribe.
• Backups: rotated out within 35 days.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erasure ("right to be forgotten"), subject to legal limits.
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time.
• Lodge a complaint with the ICO at ico.org.uk.

To exercise any of these rights, email privacy@tradesinvo.com. We respond within one month.

We use encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access control, audit logging, MFA for staff, and regular penetration tests. Full details in our Security overview.

TradesInvo is not intended for use by anyone under 18. We do not knowingly collect data from children.

We use a small number of cookies. See our Cookie Policy for the full list and how to manage your preferences.

We update this policy when our practices change. Material changes will be communicated by email or in-product notice at least 30 days before they take effect.