This Privacy Notice explains how Gareth Williams t/a TradesOps.uk (TradesOps, 5 Barcote Close, Swindon SN25 2BH) handles personal data collected through TradesOps.uk (the Service). It covers Traders (the people who sign up for a subscription) and prospective Traders (people who visit the marketing site or start a free trial). Separate arrangements apply to your customers’ personal data that you upload or capture through the Service — see the Data Processing Addendum.
For the purposes of the UK GDPR and Data Protection Act 2018 we are the data controller of the personal data described in this Notice.
1. What data we collect
1.1 Account and business profile
- your name and email address;
- the trading name of your business and (optionally) trade vertical, town, and postcode;
- VAT registration status and VAT number, if you provide them;
- contact details you choose to publish on your enquiry link.
1.2 Sign-in and security
- Supabase-managed authentication tokens and session data;
- IP address and user agent captured for rate limiting and abuse prevention;
- optional Telegram username and chat identifier if you pair your Telegram account.
1.3 Subscription and billing
- subscription status and trial end date;
- Stripe customer identifier and payment status (we do not store your card details — Stripe does).
1.4 Usage and support
- server logs, request timings, and error reports;
- records of AI drafting jobs run on your behalf (inputs, outputs, token counts and cost);
- content of any support message you send us.
2. How we use your data and the lawful basis
- To provide the Service — including creating your account, running AI drafters on the notes you send, sending customer emails on your behalf, taking subscription payments, and providing support. Lawful basis: performance of a contract.
- To keep the Service secure — rate limiting, fraud checks, abuse detection, security logs. Lawful basis: legitimate interests (running a secure service).
- To meet legal obligations — including VAT records, responding to lawful requests from authorities. Lawful basis: legal obligation.
- To improve the Service — anonymous or aggregated analysis of usage patterns. Lawful basis: legitimate interests.
- To send you service updates — including notices about pricing, maintenance and material changes to these terms. Lawful basis: legitimate interests (keeping you informed about a service you have signed up for). You cannot opt out of essential service messages while your subscription is active.
- To send you optional product news — occasional emails about new features. Lawful basis: consent. You can withdraw at any time.
3. Sub-processors and third-party providers
We use a small number of trusted providers to deliver the Service. Each has its own privacy notice and appropriate contractual and technical safeguards.
- Supabase (Supabase Inc.) — hosted Postgres database, authentication and object storage. Data hosted in the European Union.
- Vercel (Vercel Inc.) — application hosting and edge network.
- Cloudflare (Cloudflare Inc.) — DNS and edge protection for tradesops.uk.
- Anthropic (Anthropic PBC) — large language model API used to draft enquiries, customer replies, quotes, and other content. Prompt content is sent to Anthropic to produce the draft; Anthropic does not use API data to train its models by default.
- Resend (Resend, Inc.) — outbound email delivery for authentication codes and transactional messages.
- Stripe (Stripe Payments Europe, Ltd.) — subscription billing. Stripe holds your card details; we hold only a token.
- Telegram (Telegram FZ-LLC) — the messaging platform used for trader notifications. Telegram receives your chat identifier and the content of messages we send you.
4. International transfers
Some of our sub-processors are established outside the United Kingdom. Where a transfer of your personal data outside the UK takes place, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision, as appropriate. Details are available on request.
5. Retention
- Account and business profile data: kept for as long as your account is active, plus 30 days after termination for export.
- Billing records: kept for 7 years to meet UK tax record-keeping obligations.
- Server logs and security logs: kept for up to 90 days.
- AI job records (inputs and outputs): kept for as long as the associated quote/booking/invoice is active, then deleted with those records.
6. Your rights
Under UK data protection law you have the right to:
- ask us for a copy of the personal data we hold about you (access);
- ask us to correct data that is inaccurate or incomplete (rectification);
- ask us to delete data we no longer need to keep (erasure);
- ask us to restrict how we use your data while a query is resolved (restriction);
- ask us to provide certain data to you or another provider in a portable format (portability);
- object to our use of your data on the basis of our legitimate interests (objection);
- withdraw any consent you have previously given.
Contact us at legal@tradesops.uk to exercise any of these rights. We will respond within one month.
If you are not satisfied with how we have handled your data you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
7. Cookies
We only use strictly necessary cookies — the session cookie set by Supabase to keep you signed in, and short-lived tokens used to verify webhook and form submissions. We do not use advertising or third-party analytics cookies. Because these cookies are strictly necessary for the Service, no consent banner is displayed.
8. Children
The Service is not intended for children. You must be at least 18 years old to sign up.
9. Changes to this Notice
We may update this Notice from time to time. Material changes will be notified by email at least 30 days before they take effect.
10. Contact
Questions about this Notice or your data: legal@tradesops.uk.