Privacy Notice

1. Who we are

TradeSmith is operated by Andrew Anthony Nevinson, a sole trader in the United Kingdom trading as TradeSmith. For the personal data described here, Andrew Anthony Nevinson is the data controller — meaning we decide how and why your personal data is used.

Contact for privacy matters: privacy@tradesmith.live.

2. What we collect and why

• Account data — name, email address, password credentials, trade type, business name and address, hourly rate, logo. Used to create and run your account and to brand your quotes and invoices. Legal basis: performance of our contract with you.
• Business content you enter — your customers' names, addresses, phone numbers and emails, job notes, quotes, invoices, expenses, receipt images and photos. Used to provide the service to you. You are responsible for the personal data of your own customers that you enter; we process it on your behalf. Legal basis: performance of our contract with you.
• Support messages — the content of emails or messages you send us. Used to answer you. Legal basis: contract / legitimate interests.
• Usage and device data — log data, IP address, browser and device identifiers, pages viewed, error reports. Used for security, fraud prevention, diagnosing faults and improving the product. Legal basis: legitimate interests.
• AI feature inputs — the prompts, notes and receipt images you submit to the AI assistant, plus the relevant business records needed to answer. Used to generate the requested output. Legal basis: performance of our contract with you.
• Marketing preferences — where you opt in to product updates. Legal basis: consent, which you can withdraw at any time.

Payment card details are collected and processed by Paddle at checkout, not by us — we never see or store your card number.

3. Who we share data with

• Service providers / subprocessors — cloud hosting and database providers, our application platform, AI model providers used to power the assistant and receipt scanning, and email delivery providers. They act on our instructions under contract.
• Paddle, our Merchant of Record — for the sale of subscriptions, subscription management, payments, invoicing and tax compliance.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where we are required to disclose by law.

We do not sell your personal data.

4. International transfers

Some of our providers process data outside the UK/EEA. Where that happens we rely on appropriate safeguards — UK/EU adequacy decisions or Standard Contractual Clauses together with the UK International Data Transfer Addendum.

5. How long we keep data

• Account and business content: for as long as your account is active.
• After you close your account: deleted or anonymised within 90 days, except where we must keep records longer.
• Billing and tax records: retained as required by UK tax law (generally 6 years).
• Security and error logs: typically up to 12 months.

6. Your rights

Under UK GDPR you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where processing is based on consent.

Email privacy@tradesmith.live and we will respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

7. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, encryption at rest with our hosting provider, row-level access controls so each account can only reach its own records, and restricted administrative access. No system is completely secure, so we encourage you to use a strong, unique password.

8. Cookies and local storage

We use only what the app needs to work: cookies and browser storage that keep you signed in, remember your theme preference, and keep the app secure. We do not use advertising or cross-site tracking cookies. You can clear cookies and site storage in your browser settings, though doing so will sign you out.

9. Changes to this notice

We may update this notice. Material changes will be notified in the app or by email, and the "last updated" date above will change.