Privacy Policy

1. Introduction

Tradehand ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

Tradehand is a trading name of OUTSIDE HQ LTD, a company registered in England and Wales (company number 13895333). Registered office: Abbey Mill Gardens, Colebrook Street, Winchester, England, SO23 9LH.

This policy applies to users in the United Kingdom and complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1A. Who controls your data

Tradehand is used by property maintenance companies to run their operations, so who controls personal data depends on whose data it is:

• A company's customers and contacts. When a company uses Tradehand to serve its customers, tenants, landlords, property managers, and other job contacts, that company is the data controller and Tradehand is its processor: we handle that data on the company's instructions to run its jobs, as set out in our Data Processing Addendum. Tradehand provides a standard privacy notice that the company adopts; the company remains the controller for its customers' data.
• Companies, owners, team members, and website visitors. Tradehand is the controller of the account and business data of the companies and people who are our own customers, and of visitors to our website.
• Tradehand's own narrow purposes. Tradehand is also an independent controller for a small, defined set of purposes: preventing fraud and abuse, producing aggregated analytics to improve the Services and the agents, and meeting our own legal obligations.

This policy explains how Tradehand handles data where it is the controller. Where a company is the controller, that company's own privacy notice applies. If you have questions about this policy, please contact us through the app.

2. Information We Collect

Personal Information (Customers)

When you use Tradehand as a customer, we collect:

• Name and contact information (phone number, email address)
• Address and location data for the job or property
• Job details and problem descriptions
• Payment information (processed securely through Stripe)
• Communication history with the company, traders, or Tradehand assistant tools through our platform (including SMS and call recordings)

Company and Trader Information

When companies and traders use Tradehand, we may collect professional, business, and compliance information:

• Trade registration details: Registration numbers, certificate information, and registration status where relevant to the work
• Professional qualifications: Certificates, training records, and qualification dates
• Business information: Business name, trading name, business address, and VAT number (if applicable)
• Public liability insurance: Insurance certificate details and coverage amounts
• Service area and specialisations: Geographic coverage, types of maintenance work performed, and areas of expertise
• Availability and pricing: Working hours, rates, and pricing set by the company
• Stripe Connect information: The company's bank account details for payment processing (stored securely by Stripe). Individual team members do not connect their own Stripe accounts

Where relevant, we may retain copies of certificates, registration documents, and insurance evidence so companies can manage jobs, documents, and compliance records in one place.

Usage Information

We automatically collect:

• Device information and identifiers
• App usage data and interactions
• IP address and location data
• Log files and analytics data

3. Legal Basis for Processing

Under UK GDPR, we process your personal data based on the following lawful bases:

• Contract Performance: Processing is necessary to perform our contract with you, facilitate the platform, manage job records, communications, and process payments
• Legitimate Interests: We have legitimate interests in operating our platform, preventing fraud, improving our services, and communicating with you about jobs, accounts, and support
• Legal Obligation: We must process certain data to comply with legal requirements (tax, financial regulations, safety reporting)
• Consent: Where required, we obtain your consent for specific processing activities (marketing communications, optional features)

4. How We Use Your Information

We use your information to:

• Verify and onboard companies and traders: Check relevant registrations, validate professional information, and support compliance record keeping
• Help companies answer calls and messages, create jobs, schedule traders, and coordinate customers or contacts
• Facilitate communication: Enable phone calls (via ElevenLabs) and SMS messaging (via Twilio) between customers, companies, traders, and relevant job contacts
• Record and analyze interactions: Call recordings and transcripts are used for quality assurance and dispute resolution, and, in aggregated or de-identified form, to improve the Services
• Process payments securely through Stripe
• Provide customer support and respond to your inquiries
• Detect and prevent fraud, security threats, and illegal activity
• Improve our platform, services, and user experience through analytics
• Send important updates about jobs and accounts
• Comply with legal obligations (tax, financial regulations, safety reporting)
• Enforce our Terms of Service
• Resolve disputes, investigate complaints, and troubleshoot problems

5. Information Sharing and Disclosure

We share your information only in the following circumstances:

With the company running your job

When a job is created, the relevant details: such as name, contact details, address, postcode, and job description. Are available to the company handling the work and the team member assigned to it, and, where a job involves more than one party, to the other job contacts who need them, such as a tenant, landlord, or property manager. Tradehand handles this data on the company's behalf so it can run the job.

With Service Providers (Data Processors)

We use third-party service providers who process data on our behalf under strict data processing agreements:

• Convex (database and backend): Stores all platform data including user accounts, job requests, and messages
• Clerk (authentication): Manages user authentication and account security
• Stripe (payment processing): Processes payment transactions and stores payment method details
• ElevenLabs (voice calls): Facilitates automated phone calls and processes voice-agent tool results, call recordings, and transcripts. We opt the workspace out of using this content to train ElevenLabs models
• Twilio (SMS): Sends and receives text messages between customers, companies, traders, and job contacts
• OpenRouter and Google Gemini (text assistant): OpenRouter routes requests to the Google Gemini models that power the Tradehand text assistant. Every request uses routing that excludes providers which collect request data, and the workspace data-use discount is disabled so inputs and outputs are not used to improve OpenRouter's product. The same routing powers the calendar classifier that tells customer work from personal entries
• Vercel (hosting): Hosts our website
• Google Analytics and Google Ads: Google Analytics, unless you say no in Cookie settings, and Google Ads only if you say yes, measure marketing-site and Tradehand product use, onboarding progress, and our own demo and revenue marketing events without customer details or typed content
• Searchable Analytics: Unless you say no in Cookie settings, measures human visits and AI-referred traffic on tradehand.com
• Meta, Reddit, and X (advertising measurement): With your optional consent, receive ad click IDs and hashed identifiers for our own lead, booked-demo, and revenue events. This covers Tradehand prospects only, never a trade company's customers or job data
• LinkedIn, Facebook, and Instagram (optional social posting): When a Tradehand company administrator connects an account, the selected provider receives the completed-work caption and photos needed to publish to the connected destination. Tradehand stores the authorization token, granted permissions, provider account identifiers, and confirmed post identifiers needed to operate and audit the connection

Legal and Safety Disclosures

We may disclose information when:

• Required by law, regulation, or legal process
• Necessary to respond to lawful requests from public authorities
• Needed to enforce our Terms of Service or protect our rights
• Required to protect the safety, property, or rights of users or the public
• In connection with a business transaction (merger, acquisition, or sale)

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

5A. Google Calendar Integration

Traders can optionally connect their Google Calendar so they can see and edit their whole day in Tradehand, and so Tradehand avoids double-booking. Google is the provider for this integration. The connection is always started by the Google account holder. Nothing is connected unless the trader chooses to link their own calendar and grants access on Google's consent screen, where Tradehand asks to view and edit events on their calendars and to see their list of calendars.

We store the trader's calendar list (names, colours, and the trader's access to each) and the authorization tokens. For the calendars the trader shows in Tradehand, we store each event's title, time, location, notes, guests (name, email address, and reply), colour, repeat rule, video-call link, and attachment names and links. We use them to show and edit the trader's events in Tradehand and to keep them in step with Google, and we refresh them while the connection is active.

Other people at the trader's company see only “Busy” and the start and end time for the trader's Google events. Scheduling, dispatch, and customer booking use those busy times only. Voice agents also receive only busy times and the resulting candidate or booked times. The text assistant also reads the trader's own events from the last month (title, time, notes, location, and guests) when it looks for finished customer work the trader may want to invoice and chase. Only the trader sees what it finds, and a customer is messaged only after the trader picks the job and confirms who it was for.

Changes the trader makes in Tradehand are written back to Google: new, edited, moved, and deleted events, guests, and responses to invitations. Google sends any invitation emails to guests. The trader can also have their Tradehand jobs added to a calendar they choose, with the scheduled time and the job details needed in that entry, and can turn that off at any time.

To tell customer work from personal entries, an AI model reads each new event's title, notes, location, and guests. Customer work becomes a job in Tradehand; the trader can undo it and the entry returns to being an event. When the model is unsure, the entry stays an event. Nothing is sent to the customer or the guests. The model is Google Gemini, reached through OpenRouter. Every request uses routing that excludes providers which collect request data, and the workspace settings that let OpenRouter log or learn from inputs and outputs are off. We do not use Google Calendar data, raw or derived, to create, train or improve any AI model.

If the trader allows it on their phone, the Tradehand app also reads and changes events in the phone's own calendars, using the phone's calendar permission. Those events are handled the same way as Google events.

We use Google Calendar data only for the visible calendar and scheduling features described above. It is never used for advertising, sold, or shared for marketing. Our staff do not read it unless the trader asks us to look at specific items for support and we record that request, it is needed for security or abuse investigation, or the law requires it.

Connections made before this version keep their earlier, narrower permission until the trader reconnects, and we will ask them to.

The trader can disconnect at any time in Tradehand, or by removing Tradehand in their Google Account's third-party access settings. Disconnecting first removes the jobs and events Tradehand wrote to Google, leaves the trader's own Google events untouched, revokes Tradehand's Google access, and deletes its authorization tokens, calendar list, and stored copies of the trader's Google data. Jobs already made from events stay in Tradehand.

Tradehand's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5B. Social Account Integrations

A Tradehand company administrator can optionally connect LinkedIn, Facebook, or Instagram. Tradehand uses the completed-work summary and eligible work photos stored for that company to prepare a caption and publish it only to the destination explicitly authorized by the provider. Before publishing, Tradehand checks each proposed photo and rejects it if it contains a person, customer-identifying information, an address, vehicle registration, document, screen, personal belongings, sensitive private interior, or anything uncertain. The caption generator is instructed not to include customer names, addresses, postcodes, prices, contact details, or inferred claims.

We store the connected account's provider identifier, display name, handle where supplied, authorization token, granted permissions, expiry time, and confirmed post receipt. These details are used only to operate, secure, and audit the company's social posting feature. They are not sold or used for advertising.

You can revoke Tradehand in the social provider's account settings. To ask us to delete the related connection data, follow our social account data deletion instructions.

5C. Gmail Integration

Traders can optionally connect their Gmail account so the emails they approve in Tradehand, such as quotes, invoices, and follow-ups, are sent from their own address. The connection is always started by the account holder. Nothing is connected unless the trader chooses to link their own Gmail and grants access on Google's consent screen, where Tradehand asks only to send email on their behalf and to know which address is connected.

Each email Tradehand sends carries a Tradehand reply address for the business, so the customer's reply comes to Tradehand and appears in the trader's conversation. When a reply answers an email Tradehand sent, Tradehand also places a copy in the trader's own Gmail inbox, using the same permission.

Tradehand does not read, search, label, or delete the trader's Gmail messages. We store the authorization tokens (encrypted), the connected email address, and the identifiers of the emails we send.

We use this access only to send the emails the trader approves and the copies of replies addressed to the trader. It is never used for advertising, sold, or shared for marketing. No Google user data is used to create, train, or improve any AI model.

The trader can disconnect at any time in Tradehand, or by removing Tradehand in their Google Account's third-party access settings. Disconnecting revokes Tradehand's access and deletes the authorization tokens. Emails already sent stay in Tradehand's conversation history.

Tradehand's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information. This includes encryption, secure data storage, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

Typical retention periods:

• Account information: Retained for the duration of your account, plus 6 years after closure (for legal and tax purposes)
• Job records and communication: Retained for 6 years after job completion (for dispute resolution and legal compliance)
• Payment records: Retained for 7 years (HMRC requirement)
• Call recordings: Retained for 90 days unless needed for dispute resolution or legal purposes
• SMS messages: Retained for 6 months after job completion
• Analytics data: Aggregated and anonymized after 2 years
• Installation ordered through a partner store: When you ask a partner store to arrange installation, the store shares your name, contact details and address with us to arrange it. If no installation is booked, we remove them from our records 90 days after we last hear about your order, unless you have a booking, an open quote or other business with us. If an installation is booked, we keep the order details your store shared for six years after the end of the accounting year in which the job ends (our accounting year ends on the last day of February), or, if you ask your store to erase your data, we remove them when the job ends and keep only your name, the installation address, what was installed and its dates, and the job's invoice and payment records for those six years, as tax and legal claims require

When we no longer need your information, we securely delete or anonymize it.

7. Your Rights Under UK Data Protection Law

Under UK GDPR, you have the following rights:

• Right of Access: Request a copy of the personal information we hold about you (commonly called a "Subject Access Request" or SAR)
• Right to Rectification: Request correction of inaccurate or incomplete information
• Right to Erasure ("Right to be Forgotten"): Request deletion of your information, subject to legal retention requirements
• Right to Restrict Processing: Request that we limit how we use your information in certain circumstances
• Right to Data Portability: Receive your information in a structured, machine-readable format and transfer it to another service
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time
• Rights Related to Automated Decision-Making: We do not currently use fully automated decision-making that produces legal effects

How to Exercise Your Rights: To exercise any of these rights, please contact us through the app. We will respond to your request within one month, or inform you if we need additional time (up to three months for complex requests).

Right to Lodge a Complaint: You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe we have not handled your data properly. Visit ico.org.uk or call 0303 123 1113.

8. Cookies and Tracking Technologies

We use essential storage to operate the site. We count visits to improve Tradehand unless you say no. We load advertising technologies only if you say yes.

Types of cookies we use:

• Essential Cookies: Required for authentication, security, core platform functionality, recording your privacy choice, and reliably completing a booking or consent sync (these cannot be disabled)
• Analytics Cookies: Google Analytics and Searchable Analytics count visits and show which pages help, so we can improve the site. They work only for us, and nothing is shared for advertising. Turn them off any time in Cookie settings
• Advertising Cookies: Google Ads, Meta, Reddit, and X measure our campaigns and audiences. We may store campaign parameters, platform click IDs, and pixel identifiers, then send hashed contact identifiers for our own consented conversion events

The paid-attribution cookie lasts up to 90 days, your choice lasts up to 12 months, and duplicated delivery/readback payloads are deleted after 30 days. Rejecting optional cookies does not affect your ability to browse or book a demo.

On iPhone and iPad the Tradehand app asks for permission before it measures anything, because our Google Analytics property is linked to Google Ads for advertising. Everywhere else it measures from the start. You can switch it off at any time under Privacy in the app. It sends broad screen areas, onboarding steps, completed action types, the account the app is signed in to, and an identifier for the installation, but not customer details, message contents, or anything you type.

Use Cookie settings on any website page to accept, reject, or withdraw optional tracking at any time. Withdrawal clears our first-party advertising identifiers and suppresses any linked conversion delivery that has not completed. You can also manage cookies in your browser. For general browser guidance, visit aboutcookies.org.

9. Children's Privacy

Our platform is not intended for users under 18 years of age. We do not knowingly collect personal information from children.

10. International Data Transfers

Some of our service providers are located outside the United Kingdom, which means your personal data may be transferred to and processed in countries that may not offer the same level of data protection as the UK.

When we transfer your data internationally, we ensure appropriate safeguards are in place:

• UK transfer safeguards: We use the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified, to ensure your data receives adequate protection
• Adequacy Decisions: Where possible, we use service providers in countries deemed adequate by the UK government
• Additional Safeguards: We implement technical and organizational measures including encryption, access controls, and regular security audits

After transfer, your data remains subject to UK GDPR protections and the contractual safeguards we have in place with our service providers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes through the app or by email. Continued use after changes are posted constitutes acceptance of the updated policy.

12. Third-Party Links

Our platform may contain links to third-party websites or services. We are not responsible for the privacy practices or content of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

13. Contact Us and Data Protection Queries

If you have questions about this Privacy Policy, how we handle your data, or wish to exercise your rights, please contact us through the app or visit our About page.

We aim to respond to all data protection queries within 48 hours and resolve Subject Access Requests within one month.