Privacy policy

Who is responsible for your data

TradeScribe is the data controller for the personal data described in this policy. That means we decide what is collected and what happens to it, and we are the people you hold to account for it.

You can reach us by email at hello@tradescribe.co.uk, or by post at:

[CONTACT ADDRESS TO BE ADDED]

We are based in the United Kingdom and this policy is written around the UK GDPR and the Data Protection Act 2018.

What we collect, and why

Account information

When you sign in we use Firebase Authentication, operated by Google. If you sign in with Google we receive your name, email address and the profile picture attached to that Google account. If you sign in with an email link we receive only your email address. In both cases we store a Firebase user identifier so that your saved work can be shown back to you and to nobody else.

We need this to give you an account at all, so the lawful basis is performance of a contract with you, and our legitimate interest in running a service where your documents stay yours.

Your business profile

The details you enter once and reuse on every estimate: business name, contact details, address, logo, day rate, VAT position, registration numbers and any standard terms or footer text you set. These are stored in Firestore and used to write your documents. Lawful basis: legitimate interest in delivering the service you asked for.

Job notes, photographs and saved estimates

The notes you type or dictate, photographs you upload of handwritten pads or of the job itself, any reference documents you supply so we can match your existing format, and the estimates produced from them.

Photographs of a job may incidentally contain personal data, including a customer name, an address or an image of a person. Please only upload what you need to, and remember that you are responsible for the customer information you put into the service. Lawful basis: legitimate interest in delivering the service. Uploading a photograph is always optional and the service works from typed notes alone.

Technical and usage information

Our Cloud Functions record request timestamps, error diagnostics and a count of how many estimates an account has generated, which is how the free monthly and daily limits are enforced. IP addresses are processed transiently by Google infrastructure for security and abuse prevention. Lawful basis: legitimate interest in keeping the service available, secure and free of abuse.

Optional things

Anything genuinely optional, such as being emailed about new features or taking part in research, is asked for separately and runs on consent. You can withdraw that consent at any time and it will not affect anything else.

Your notes and photographs are sent to Anthropic

This is the part of the policy worth reading twice, because it is the one people care most about.

To turn your notes into a written estimate, we send the text and any photographs you upload to Anthropic, the company behind the Claude AI models, through their API. Anthropic processes that content on our instructions and returns the drafted estimate. In data protection terms Anthropic is our processor and we remain the controller.

Content sent through the Anthropic API is not used to train Anthropic's models. We use the commercial API, where inputs and outputs are processed to return your result and are not fed back into model training. We do not agree to any arrangement that would allow your job notes or customer photographs to be used as training data.

Where this processing involves your data leaving the UK, we rely on the transfer safeguards permitted by Article 46 of the UK GDPR, specifically the International Data Transfer Addendum to the European Commission's standard contractual clauses.

If you would rather no third party model provider ever saw a particular job, do not put it into TradeScribe. There is no version of this product that writes your estimate without processing your notes.

Who else processes your data

• Google (Firebase and Google Cloud): authentication, the Firestore database holding your profile and saved jobs, file storage for uploads, and the Cloud Functions that run our server logic. Our Cloud Functions are deployed in the europe-west2 region, which is London.
• Anthropic: model processing of your notes and photographs, as described above.

We do not sell personal data, we do not share it with advertising networks or data brokers, and we do not use it to build profiles of you or your customers. We may disclose data where we are legally required to, for example in response to a valid court order, and we will tell you if we are permitted to.

How long we keep things

• Account and business profile: for as long as your account exists. If you delete your account we remove it, and the data attached to it, within 30 days.
• Saved jobs and estimates: until you delete them, or until your account is deleted. They are yours to remove at any time.
• Uploaded photographs: deleted within 30 days of processing unless they are attached to a job you have chosen to save, in which case they follow that job.
• Operational logs and error diagnostics: no more than 90 days.
• Records we must keep by law, such as anything needed for tax or to defend a legal claim, are kept for the period the law requires and no longer.

Your rights

Under the UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Rectification: have inaccurate data corrected and incomplete data completed.
• Erasure: have your data deleted where there is no overriding reason for us to keep it.
• Restriction: have us pause processing while a dispute about accuracy or legitimate interests is resolved.
• Portability: receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider where that is technically feasible.
• Object to processing carried out on the basis of legitimate interests, including any direct marketing, which we will stop on request without needing a reason.
• Withdraw consent at any time, where consent is what we relied on.

The estimate produced by TradeScribe is a draft that you read, edit and decide whether to send. It is not an automated decision that produces a legal or similarly significant effect on anyone, so the rules on solely automated decision-making do not apply to it.

How to exercise your rights

Email hello@tradescribe.co.uk and tell us what you want. You do not need to use any particular form of words or cite any legislation. We will respond within one month, and will tell you if a complex request needs longer, which the law allows in limited circumstances. There is no charge.

We may ask you to confirm that you control the email address on the account, because handing somebody else's estimates to the wrong person would be a far worse outcome than a short delay.

Cookies, local storage and tracking

We do not use advertising cookies, and we do not run third-party advertising or cross-site tracking on this site.

What we do use:

• Sign-in tokens, stored in your browser by Firebase Authentication so that you stay signed in. These are strictly necessary for the service to work.
• Local storage for preferences, such as whether you have chosen the light or dark theme.
• Local storage for draft notes, so that a half-written job survives a closed tab or a dropped connection. This stays in your own browser until the estimate is generated. Clearing your browser data removes it.
• Google Analytics, but only if you agree to it. We use it to see which pages people find useful and how many visitors the site gets. It sets cookies, so under the Privacy and Electronic Communications Regulations we have to ask first, and we do, on your first visit, with a real choice. If you decline, the analytics code is never loaded at all: it is not merely switched off, it is not downloaded. We have also disabled the advertising features of Google Analytics, so it is not used for advertising or ad personalisation.

The first three are strictly necessary or preference storage and do not require consent. Analytics does, which is why the banner exists. You can change your mind at any time by clearing this site's data in your browser, which resets the question so you are asked again.

Security

Data is held on Google Cloud infrastructure, encrypted in transit and at rest. Access to your saved work is controlled by Firebase Security Rules tied to your authenticated account rather than by anything hidden in the page. Server-side limits and validation run in our Cloud Functions, not in the browser, because anything enforced only in the browser is not enforced at all.

No system is perfect. If we ever suffer a breach that is likely to risk your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours and tell you directly where the risk to you is high.

Children

TradeScribe is a tool for running a business and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We will update this page when what we do changes, and we will change the date at the top when we do. If a change materially affects how your data is used we will tell account holders directly rather than relying on you to notice.

Complaints

If you are unhappy with how we have handled your data, please tell us first at hello@tradescribe.co.uk so we have the chance to put it right.

You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office, at any time and without going through us first. The ICO can be reached at ico.org.uk, on their helpline, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.