Privacy Policy
Who we are
TradeComply (“we”, “us”) provides an accreditation and certificate-tracking tool for UK trade contractors. We are the data controller for the personal data described here.
Registered address: 43 Dunmore Road, Market Harborough, LE16 8AZ. For any privacy question or to exercise your rights, contact hello@tradecomply.co.uk.
What we collect
- Account details — your email address and password (stored only as a secure hash by our authentication provider).
- Business profile — your company name and number, the schemes you hold, and the answers to the onboarding questions.
- Certificates and documents you upload or forward, and the dates, reference numbers and names within them. These may include personal data about your staff (for example a named insured or a qualification holder).
- Reminder recipients — the names and email addresses of colleagues you add as watchers.
- Usage and diagnostics — with your consent, analytics about how you use the app; and error diagnostics to keep it working.
Why we use it, and our lawful basis
- To provide the service (tracking your dates, sending reminders, generating share links) — performance of our contract with you.
- To send reminder and account emails — performance of our contract; reminders are transactional, not marketing.
- To take payment — performance of our contract and our legal obligations.
- To improve the product (analytics) — your consent, which you can withdraw at any time.
- To keep the service secure and working (error monitoring, fraud/abuse prevention) — our legitimate interests.
Certificate field extraction (AI)
When you upload or forward a certificate and this feature is enabled, the document’s text may be sent to our processor Anthropic to read the dates and reference numbers from it. It is never used to train any model. You can always enter dates yourself instead.
Who we share it with
We do not sell your data. We share it only with the processors below, who act on our instructions. Where a processor is outside the UK, transfers are covered by the UK International Data Transfer Agreement or EU Standard Contractual Clauses.
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and encrypted document storage | United Kingdom / EU region |
| Vercel | Application hosting and delivery | United States / globalUK IDTA / EU Standard Contractual Clauses |
| Stripe | Subscription billing and card payments (PCI-DSS; we never see card numbers) | United States / EUUK IDTA / EU Standard Contractual Clauses |
| Mailjet (Sinch) | Sending reminder, account and confirmation emails; inbound certificate forwarding | European Union |
| Anthropic | Optional certificate field extraction — only when you upload or forward a document and this feature is enabled | United StatesUK IDTA / EU Standard Contractual Clauses |
| Sentry | Error monitoring and diagnostics — only a pseudonymous account id is attached (no email); URL access tokens are scrubbed before egress | United StatesUK IDTA / EU Standard Contractual Clauses |
| PostHog | Product analytics and session replay — only with your cookie consent | European Union (EU Cloud) |
| Companies House API | Looking up your company by name during onboarding | United Kingdom |
How long we keep it
We keep your account data for as long as you have an account. Certificate records are kept as an audit history (replacing a certificate adds a new version rather than deleting the old one) so you can prove what you held and when — for example to meet employers’ liability record-keeping expectations. When you close your account we delete your data within 30 days, including cancelling billing and removing stored files.
Your rights
Under UK GDPR you have the right to:
- access a copy of your data (available in-app via Export your vault);
- correct inaccurate data;
- erase your data (Delete account, which completes within 30 days);
- restrict or object to processing;
- data portability;
- withdraw analytics consent at any time.
To exercise any of these, use the controls on your Account page or email hello@tradecomply.co.uk. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk).
Cookies
We use only essential cookies plus, with your consent, privacy-friendly product analytics. See our cookie policy.