Privacy Notice

Who we are

Trades Lite OS is a software platform for trade businesses. The legal operator is [insert legal entity name], trading as Trades Lite OS, of [insert registered or principal address]. Contact us at [insert privacy contact email].

We are the controller for platform accounts, subscriptions, security, product communications and our own website. A trade business using the platform is normally the controller for its customer, quote, job, invoice and review information; we process that information on its behalf. Contact the relevant trade business first about its customer records.

Information we process

• Account identity, email, authentication, organisation membership, role and session information.
• Business profile, staff, website, VAT, CIS, banking-display and document configuration.
• Customer enquiries, contact details, scopes, quotes, signatures, jobs, schedules, invoices, payments and reviews.
• Acceptance evidence including signer name, signature image, time, IP address, browser information and a fingerprinted document snapshot.
• Audio, transcripts, images, attachments and AI-generated drafts submitted through assisted workflows.
• Removal-survey videos and selected still frames where a customer expressly consents to an assisted video survey.
• Google connection tokens, selected calendar, email-delivery metadata and calendar event identifiers when connected.
• Stripe customer, subscription, connected-account, Checkout and payment identifiers. Stripe processes card details; we do not intend to store complete card numbers.
• Audit, backup, diagnostic, device, usage, security and support records.
• Error diagnostics, performance traces, page structure and interactions recorded through privacy-masked session replay. Replay text and inputs are masked and media is blocked.

Why we use information

We use personal information to provide and secure the service, operate tenant workspaces, process subscriptions, deliver requested integrations, maintain evidence and audit records, support users, prevent abuse, improve reliability and comply with legal obligations.

Depending on the activity, our lawful basis is performance of a contract, legitimate interests in operating and securing the platform, compliance with a legal obligation, or consent where required. Trade businesses must identify and communicate their own lawful bases for customer data and direct marketing.

Source video, extracted evidence frames and their AI analysis for an assisted removal survey are scheduled for deletion after 30 days. A customer can also delete an unfinished survey sooner from the survey workflow. The linked quote request and customer-confirmed inventory follow the trade business's normal record-retention rules.

Who receives information

Information may be processed by carefully selected providers used to run the platform, including:

• Clerk for authentication and organisation access.
• Vercel, Neon and related infrastructure providers for application delivery, storage, databases and security.
• Stripe for platform subscriptions, connected accounts and customer payments.
• Google when a user connects Gmail or Google Calendar.
• OpenAI or an approved AI provider when a user requests transcription or AI-assisted scope generation.
• Sentry for error monitoring, performance diagnostics and privacy-masked session replay.
• PostHog for product usage analytics and privacy-masked session replay.
• Professional advisers, authorities or counterparties where legally required or necessary to establish or defend legal rights.

We do not sell personal information. A complete, verified subprocessors list will be published before production launch.

International transfers

Some providers may process information outside the UK. Where required, we will use an adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard. Production launch requires the transfer locations and safeguards for every subprocessor to be documented.

How long we keep information

We keep information only for as long as needed for the purpose for which it was collected, contractual and support requirements, security, tax/accounting obligations and the establishment or defence of legal claims. Tenant records are retained while the workspace is active and for [insert deletion window] after termination unless law or an agreed export requires otherwise. Signature evidence, invoices, payment and audit records may require longer periods.

Security and automated assistance

We use access controls, tenant separation, encryption where supported, audit records, backups and service monitoring. No internet service is completely secure. AI output is a draft and must be reviewed by a person; the platform does not make solely automated decisions producing legal or similarly significant effects about individuals.

Your rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict information, object to processing, receive portable information and withdraw consent. Contact the relevant trade business for its customer records, or contact us for platform-account data. We may need to verify your identity.

You may complain to the UK Information Commissioner's Office at ico.org.uk, although we would appreciate the opportunity to address the issue first.

Cookies and local storage

The service uses strictly necessary authentication, security, session and preference technologies. We will not place non-essential analytics or marketing cookies before obtaining any consent required by law. A verified cookie inventory, durations and consent control must be added before enabling non-essential tracking.

Sentry reliability monitoring may use browser storage and diagnostic identifiers. Its session replay masks rendered text and input values and blocks media. We will apply consent controls where required following the production privacy and storage review.

PostHog product analytics and session replay are enabled only in environments where its public browser configuration is present. Replay masks all rendered text and inputs, blocks media, and omits network request details. Production enablement remains subject to the same consent, cookie-inventory and storage review.

Changes and contact

We may update this notice as the product, providers or law changes. We will identify material updates and provide an appropriate notice. Send questions or rights requests to [insert privacy contact email].