1. Introduction and who we are
TradesPay Hero makes running a trade business simpler. We bring customers, quotes, jobs, products, team management and communication together in one place, helping Trade Persons reduce everyday admin, stay organised, and work more easily with their Clients.
Your privacy matters. This Privacy Policy explains, in plain English, how Tradespay Hero Limited (“TPH”, “we”, “us”) uses personal information when you visit our website or use the TradesPay Hero platform and browser extension (the “Platform”). It also explains your rights under UK data protection law.
Who we are. Tradespay Hero Limited is registered in England and Wales under company number 16431566. Our registered office is 1st Floor, 48 Chancery Lane, London, England, WC2A 1JF. Our marketing website is www.tradespayhero.com. Privacy contact: Devon Passmore, Support Manager, devon@tradespayhero.com.
TPH is a UK software company. We provide software that helps Trade Persons run their business and work with their Clients. We are not the trade provider, and we are not a party to any contract between a Trade Person and a Client.
2. Our role: controller and processor
Where we are the controller. We decide how and why we use information about people who visit our website, register for or use a Trade Person account, contact us, or use the Platform in ways we need to secure, support and improve it.
Where we act for the Trade Person. Trade Persons enter information about their own Clients, leads, opportunities, quotes, jobs, team members, Subcontractors and email correspondence into the Platform. For that information the Trade Person decides how it is used, and TPH generally acts as its processor, following the Trade Person’s instructions. Trade Persons are responsible for having a lawful basis to enter that information into the Platform and for giving the people concerned a suitable privacy notice.
If you are a Client and want to know how a Trade Person uses your information, please contact that Trade Person first. You can also contact us using the details in section 18.
3. Information we collect
Account and user information. Name, email address, phone number, business name, role, login credentials (passwords are stored in protected form) and settings.
Trade Person and business information. Business details, logo, and the products, packs (packages), descriptions, pricing and quote templates a Trade Person creates.
Team members. Name, email, role and permissions of people invited to a Trade Person’s account, and their activity within that account.
Client, lead and opportunity information entered by Trade Persons: names, contact details, site addresses, notes, communication history, and lead and opportunity records. Clients do not need to register, so this information usually comes from the Trade Person.
Quote and job information. Quote content, versions and status, job details, status, progress, hold, resume and completion records, related notes, messages, images and documents.
Subcontractor information. Basic details a Trade Person records about a Subcontractor.
Client Portal and dispute information. When a Client opens a quote or job link, we record what they view, approve or dispute and when, together with any comments they enter and any response from the Trade Person.
Mailbox and email information. See sections 4 and 5.
Technical information. IP address, device and browser type, log-in and security logs, error logs and timestamps. We have not identified any analytics or advertising tracking service in use at present.
Product information captured with our browser extension. When a user chooses to use the extension on a supported supplier website, we collect the product details they select to save, such as product names, descriptions and prices. This is normally business and product data rather than personal data. The extension does not collect browsing history or information from other websites.
Support communications. What you tell us when you contact us.
What you must provide. Account information is needed to provide the Platform. If you do not provide it, we cannot set up or run your account. Connecting an email account and using the AI Assistant are optional, and the rest of the Platform works without them.
4. Mailbox and email integrations
The Platform includes a Mailbox (Inbox, Outbox, Contacts and Accounts). A Trade Person can choose to connect an email account (for example Gmail or Microsoft Outlook) so that customer emails sit alongside the relevant Opportunity.
Connecting is optional. Nothing is connected unless the user selects “Connect Email” and approves access. The rest of the Platform works without a connected email account.
Gmail. If a Gmail account is connected, we access the user’s emails, including message content (bodies), message metadata such as sender, recipients, subject and dates, and attachments, using read and send access granted through Google. We use this access to display emails in the Mailbox, link emails to Opportunities, and send emails the user chooses to send from their connected account. We do not create Gmail drafts, and we do not modify, delete, archive or label messages in Gmail. We do not access Google Contacts, Google Calendar, Gmail labels or any other Google service.
Microsoft Outlook. If an Outlook account is connected, we access message content, metadata and attachments using access granted through Microsoft. We use this access to display emails in the Mailbox, link them to Opportunities and send emails the user chooses to send. We do not access Outlook Calendar, Contacts or OneDrive.
What we store and where. We store copies of emails relating to the Trade Person’s client contacts, linked to Opportunities, in our database hosted in the UK (AWS London).
Who can see them. Emails linked to an Opportunity may be visible to other users within the same Trade Person account, depending on that account’s permissions.
Other people’s information. Emails contain personal information about the people the Trade Person corresponds with. The Trade Person is responsible for connecting only accounts it is entitled to connect, for having a lawful basis to process that information, and for using the Mailbox in line with data protection law.
Disconnecting and deletion. A user can disconnect an email account in the Platform and can also withdraw our access in their Google Account or Microsoft account settings. Once disconnected, we stop accessing that account. Disconnecting does not automatically delete emails we have already stored, but the Trade Person can ask us to delete them at any time (see section 11). If we correct or delete stored email data at your request, we will tell anyone we have shared it with, unless this is impossible or involves disproportionate effort.
5. Google user data and Limited Use
This section applies to information we receive from a Google account.
TPH’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular we:
use Google user data only to provide or improve the user-facing Mailbox features described in section 4;
do not transfer Google user data to others, except to provide those features, for security purposes, to comply with law, or as part of a merger or sale after obtaining your explicit consent;
do not let our staff read Google user data unless you have given specific consent, it is needed for security or abuse investigation, it is needed to comply with law, or the data is aggregated and anonymised for internal operations;
do not use Google user data for advertising, and do not sell it;
do not use Google user data to determine credit-worthiness or for lending; and
do not use Google user data to develop, improve or train generalised artificial intelligence or machine-learning models.
Gmail data is not sent to the TPH AI Assistant or to OpenAI, and the AI Assistant cannot access the Mailbox. We do not share Google user data with third partiesother than Amazon Web Services, which hosts our database in the UK (see section 9).
Deleting Google user data. You can disconnect your account in the Platform and revoke our access in your Google Account settings. To ask us to delete Google user data we hold, contact devon@tradespayhero.com. We will respond within one month.
If we later want to access a new type of Google data, we will update this policy and ask for your consent before accessing it.
If we later want to access a new type of Google data, we will update this policy and ask for your consent before accessing it.
6. AI features
The Platform includes an optional AI Assistant. Using it is not required, and it can be turned off at any time. Its use is limited to summarising information within the Trade Person’s account, all of which has been entered by the Trade Person in line with their own privacy obligations and this policy.
We use OpenAI to provide the AI Assistant, and we send it information relating to Clients, Hot Leads, Opportunities, Quotes, Products and Packages. We do not send Gmail or Mailbox data, email bodies, attachments or contacts to OpenAI, and the AI Assistant cannot access them.
We use OpenAI on a stateless basis, meaning each request is processed on its own and we do not use OpenAI to store conversations or customer data between requests. We have opted out of all available options for OpenAI to use our customers’ data to train or improve its models.
AI output may be inaccurate, so users should check it before relying on it. We do not make decisions about people based solely on automated processing that has legal or similarly significant effects.
7. Client Portal and disputes
Clients receive links to quote and job pages and do not need an account. The Client Portal shows the information the Trade Person has chosen to share. Clients can raise a dispute about a job through the portal, and the dispute process is described in our Terms & Conditions.
Dispute comments and history are stored as part of the quote or job record and can be seen by the Trade Person and the Client. TPH staff do not take part in or review disputes, and TPH does not hold or move any money.
8. How we use information, and our lawful bases
Purpose | Main information | Lawful basis (UK GDPR) |
|---|---|---|
Provide accounts and the Platform | Account, business, team, quote, job, content | Contract |
Process a Trade Person’s client, lead, quote, job and email data on its instructions | Client, lead, opportunity, quote and job data | We act as processor; the Trade Person’s lawful basis applies |
Provide Mailbox features after you connect an account | Connection and account access details | Contract (the feature you ask for) |
Store and display emails linked to Opportunities | Email content, metadata, attachments | We act as processor; the Trade Person’s lawful basis applies |
Client Portal and dispute workflow | Client interactions, comments | We act as processor; the Trade Person’s lawful basis applies |
AI Assistant summaries | Client, lead, opportunity, quote, product and package data | We act as processor; the Trade Person’s lawful basis applies |
Security, fraud prevention, bug fixing | Technical and log data | Legitimate interests |
Improve and develop the Platform | Usage and technical data | Legitimate interests |
Service messages and notices | Contact data | Contract; legitimate interests |
Marketing emails | Contact data | Consent, or legitimate interests for existing customers (with an easy unsubscribe) |
Respond to rights requests, complaints and legal claims | Relevant data | Legal obligation; legitimate interests |
9. Who we share information with
Within a Trade Person’s account, with team members according to the permissions the Trade Person sets.
Between users. A Client sees what the Trade Person shares through the portal, and the Trade Person sees what the Client does there.
Service providers acting for us: Amazon Web Services (hosting; our production database is in the AWS London region), SendGrid (platform notification emails) and OpenAI (AI features, as described in section 6).
Advisers, insurers, regulators and authorities where necessary to protect our rights or comply with law.
Business transfers. If TPH is involved in a merger, acquisition or sale of assets we may share information with the other party; for Google user data we will first obtain your explicit consent.
We do not sell personal information.
10. International transfers
Our production database is hosted in the UK (AWS London). OpenAI and SendGrid may process information in the United States. Where they do, we rely on a transfer mechanism recognised under UK law, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or the UK Extension to the EU-US Data Privacy Framework, together with appropriate safeguards.
11. How long we keep information
We keep information for as long as needed for the purposes in this policy. At present:
Account and business information is kept while the account is active and afterwards as needed for legal, security and support reasons.
Quotes, jobs, client and opportunity records are kept for as long as the Trade Person keeps them in the Platform.
Email data from connected accounts is not deleted automatically when an account is disconnected or a user is removed. You can ask us to delete it by contacting us, and the Trade Person can ask us to delete its business data at any time.
We will delete or anonymise information we no longer need, subject to legal obligations.
12. Security
We use technical and organisational measures appropriate to the risk, including hosting in a UK cloud region, encrypted connections, and restricted access to systems. No online service is completely secure, so please keep your login details safe. We will tell affected people and the Information Commissioner’s Office (ICO) about personal data breaches where the law requires.
13. Your rights
Under UK data protection law you may have the right to: be informed; access your personal information; have inaccurate information corrected; have information erased in certain circumstances; restrict processing; receive your information in a portable format; object to processing based on legitimate interests or for direct marketing; withdraw consent where we rely on it; and not be subject to solely automated decisions with legal or similarly significant effects.
To use your rights, contact us at devon@tradespayhero.com. We may ask for proof of identity, and for evidence of authority if someone acts for you. We aim to reply within one month. If we hold your information on behalf of a Trade Person, we will usually pass your request to them. If we correct, erase or restrict your information, we will tell anyone we have shared it with, unless this is impossible or involves disproportionate effort.
14. Complaints
You can complain to us about how we have handled your personal information, using the contact details in section 18. We will acknowledge your complaint within 30 days, investigate without undue delay, keep you informed and tell you the outcome. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. You do not have to complain to us first.
15. Marketing and cookies
We send service and account messages. We will send marketing emails only where the law allows, with a simple way to unsubscribe, and we never use Google user data for marketing. The Platform uses only the cookies and similar technologies needed to keep you signed in, maintain user sessions, support authentication and security, and provide essential functionality. We have not identified any analytics, advertising or behavioural tracking cookies in use. If we add non-essential cookies or similar technologies, we will update this policy and ask for consent where required.
16. Children
The Platform is for adults and businesses. We do not knowingly collect personal information from anyone under 18.
17. Changes to this policy
We will post any update here with a new date and, for material changes, tell users in the Platform or by email. Changes affecting Google user data will be handled as described in section 5.
18. Contact
Tradespay Hero Limited, 1st Floor, 48 Chancery Lane, London, England, WC2A 1JF.
Privacy contact: Devon Passmore, Support Manager, devon@tradespayhero.com.