Privacy Policy
Last updated: 23 October 2026
1. Who We Are
TradePilot is a trading name of TRADESMANEXPERT LTD (company number 16970808, registered office 13 Shieldclose, Washington, United Kingdom, NE37 1LQ). TRADESMANEXPERT LTD is the data controller for personal data processed through the TradePilot platform. We are registered in England and Wales. If you have any questions about this policy or how we handle your data, contact our privacy contact at [email protected].
2. Data We Collect
We collect personal data in the following categories:
Account & Identity Data
Name, email address, phone number, job title, and business information provided when you register or update your account.
Billing & Payment Data
Subscription details, payment method tokens (we do not store full card numbers), and transaction history. Payments are processed by PCI-DSS compliant third parties.
Usage & Technical Data
IP address, browser type, operating system, pages visited, session duration, and error logs, collected through server logs. In the mobile app, which screens and buttons you use, only if you switch on Share usage statistics (see section 4).
Location Data
GPS coordinates transmitted by the mobile app when engineers check in to jobs. Location data is only captured when the app is actively in use and the engineer has granted permission.
Customer Data You Input
Names, addresses, contact details, and job history of your customers that you enter into TradePilot. You remain the data controller for this data; we process it on your behalf as a data processor.
3. Legal Basis for Processing
We process your data on the following legal bases:
- Contract performance — to provide the TradePilot service you have subscribed to
- Legal obligation — to comply with UK tax, employment, and financial regulations
- Legitimate interests — to improve the Service, prevent fraud, and maintain platform security
- Consent — for marketing communications, which you may withdraw at any time
4. How We Use Your Data
- Providing and improving the TradePilot platform
- Processing payments and managing your subscription
- Sending transactional emails (receipts, job alerts, system notices)
- Sending marketing communications where you have consented
- Detecting and preventing fraud and abuse
- Complying with legal and regulatory obligations
- Measuring how the Service is used so we can improve it: on our website with Cloudflare Web Analytics, which sets no cookies, and in the mobile app only if you agree. Share usage statistics is off until you switch it on, and you can switch it off at any time in the app under Settings, then Privacy.
5. Data Sharing
We do not sell your personal data. We share data with third parties only as necessary to provide the Service:
- Payment processors (Stripe) — to process subscription and job payments
- Accounting integrations (Xero, QuickBooks) — services a business chooses to connect. They act for that business under its own agreement with them, so they are not our sub-processors.
- Infrastructure providers — hosting (Hetzner Online GmbH, Finland) and the other providers on our sub-processor list, each bound by a data processing agreement
- AI providers — OpenAI OpCo, LLC (United States), to transcribe voice notes and to power AI features such as drafting messages, estimating jobs and suggesting schedules. Transfers to OpenAI are protected by the EU Standard Contractual Clauses as amended by the UK International Data Transfer Addendum.
- Legal authorities — where required by law or to protect the rights of TradePilot or our users
6. Data Retention
We keep your account data while your account is open. When you delete your account, or a business account closes, we delete its data within 30 days; a business owner can export the business's records first. Jobs, quotes and invoices a business creates are that business's records. If a staff member deletes their account, the records they created stay with the business, shown as “Deleted user”. If a customer deletes their portal sign-in, their customer record stays with the business; to have it erased, ask the business or send a privacy request from the customer portal. We keep our own subscription invoices and payment records for 6 years, as UK tax law requires. Location data from engineer check-ins is part of the job record and is deleted with the business's data. Our backups are encrypted and roll over within 12 months; until then, deleted data in them is kept out of use.
7. International Transfers
We store personal data in the European Economic Area, in Hetzner's data centre in Helsinki, Finland. Our hosting provider is Hetzner Online GmbH. UK data protection law treats every EEA country, including Finland, as providing an adequate level of protection, so no additional safeguards are needed for this transfer. Where a provider handles data outside the UK or EEA, we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), or the EU Standard Contractual Clauses with the UK Addendum issued by the Information Commission. Our sub-processor list gives the safeguard for each provider.
8. Security
We use industry-standard security measures including TLS encryption in transit, encrypted backups and role-based access controls. In the event of a personal data breach that poses a high risk to individuals, we will notify affected users and the Information Commission (ICO) as required by UK GDPR.
9. Cookies
We use only the cookies and storage needed to sign you in, keep your session secure and remember your settings. We do not use analytics or advertising cookies. Our Cookie Policy lists each one.
10. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access — to request a copy of the data we hold about you
- Right to rectification — to correct inaccurate or incomplete data
- Right to erasure — to request deletion of your data where we have no legal basis to retain it
- Right to restrict processing — to limit how we use your data in certain circumstances
- Right to data portability — to receive your data in a structured, machine-readable format
- Right to object — to processing based on legitimate interests or direct marketing
- Rights related to automated decisions — we do not make solely automated decisions with legal effect
To exercise any of these rights, contact us at [email protected]. We will respond within one month.
11. Complaints
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commission, known as the ICO, at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concern before you approach the ICO.